Summary

SCHUFA Holding AG, founded in 1927 and owned by a consortium of German banks, savings banks, cooperative banks and retailers, runs Germany's dominant credit bureau. It pools payment events from banks, telecoms, energy utilities, retailers and landlords into a proprietary model that returns a credit score used in lending, rental, telecom and other contract decisions. About 68 million people are scored, with about 140 million queries a year from about 9,000 contract partners.

Legal history

• 2014 — the Federal Court of Justice (Schufa I) holds the scoring formula to be a trade secret protected from disclosure to the people scored.
• 2018 — AlgorithmWatch's OpenSCHUFA investigation documents demographically patterned scoring and a penalty for moving house.
• 2021 — the Administrative Court of Wiesbaden refers the interpretation of Article 22 GDPR to the Court of Justice of the EU, on the facts of a pseudonymous applicant's refused loan.
• 7 December 2023 — the CJEU holds in C-634/21 that the score is itself an automated individual decision under Article 22 GDPR where it plays a determining role in a third party's decision; in C-26/22 and C-64/22 it holds that SCHUFA's retention of public insolvency data beyond the statutory period breaches the GDPR.
• 17 March 2026 — SCHUFA announces a reform: about 250 criteria reduced to about 12, a uniform 100–999 scale, a free account and score simulator, and retention of one-time payment delays shortened from 36 to 18 months. Its effect has not yet been verified.

Note on evidence

Six of twelve critical claims are confirmed from at least two sources, three are triangulated and three rest on a single source pending further collection. Scores for family, health and reputation are open to review at the next version.