(Bloomberg) -- Europe’s top court delivered a blow to Germany’s dominant provider of consumer credit ratings, saying the way it helps businesses decide whether to conclude contracts risks violating European Union privacy rules.

The EU Court of Justice ruled on Thursday that the bloc’s General Data Protection Regulation prohibits banks and other businesses from giving Schufa Holding AG’s rating scores “a determining role” in their credit decisions. The court also said that individuals have data deletion rights.

“The verdict forces Schufa to act more responsibly than it has in the past,” the non-governmental organization Finanzwende, which has previously been critical of the firm, said in a statement. “It is good that the EU Court of Justice has reined in Schufa’s power.” 

Schufa is largely owned by lenders including Deutsche Bank AG and Commerzbank AG and it provides consumer credit ratings to a large swathe of them as well as to other firms such as phone companies and e-commerce businesses. A low Schufa score can severely impair an individual’s ability to get a mortgage or take out a loan for large purchases like cars. 

The majority of Schufa’s clients don’t use its scores as “the only decisive factor in concluding a contract,” a Schufa spokesperson said in an emailed statement. “That’s why the majority of our customers will continue to be able to use Schufa scores without adjusting their processes.”

The cases are: C-634/21 SCHUFA Holding (Scoring), and C-26/22, C-64/22 SCHUFA Holding (Liberation de reliquat de dette).

©2023 Bloomberg L.P.