Profiling (GDPR)

On December 7, 2023, the Court of Justice of the European Union held in SCHUFA (C-634/21) that calculating a creditworthiness score can in itself be an automated decision when a third party relies on it decisively. Upstream of any decision, that score falls under a broader concept, which the GDPR defines in Article 4(4): profiling. It covers any form of automated processing of personal data used to evaluate certain aspects of a person, in particular to analyze or predict their economic situation, health, reliability, behavior or movements. A motor pricing model that predicts a driver's claim frequency is profiling. So is a fraud score, and so is a marketing segmentation by propensity. Profiling does not require any decision and falls under the general rules of the regulation, whereas Article 22, covered in the entry on automated decisions, only targets decisions based solely on automated processing that produce legal or similarly significant effects. In practice, the insurer has to disclose the profiling in the Article 13 and 14 notices, give it a legal basis and, often, carry out an impact assessment under Article 35. The legal basis governs the right to object in Article 21. Pricing a contract the customer asked for generally rests on performance of the contract or pre-contractual steps, and the policyholder cannot object on that ground. Fraud prevention most often rests on legitimate interest, which Recital 47 names expressly: the policyholder can object, and the insurer must then show compelling legitimate grounds that override, a case fraud teams would do well to write before the first request arrives. For direct marketing, the objection is absolute and the insurer has nothing to show.