Austrian regulator: KSV1870's credit score was itself an automated decision

A consumer in Austria applied online for an electricity contract with Unsere Wasserkraft | go green energy. Within one minute came a welcome email as a new customer, followed by a refusal for credit reasons. The supplier had obtained a credit score from KSV1870, Austria's largest credit bureau: 403. The supplier automatically refuses any application scoring 400 or higher — and it processes roughly 6,000 to 10,000 energy-supply applications a month through this funnel.

The complainant, represented by privacy group noyb, went to the Austrian Data Protection Authority on 29 August 2024. In decision D124.1994/24 of 25 September 2025, the authority applied the CJEU’s 2023 SCHUFA judgment (C-634/21): because the score was a decisive — if not the only — criterion in the contract decision, KSV1870 had itself made an automated decision under Article 22(1) GDPR. Its argument that it merely supplied a recommendation was rejected. The authority prohibited KSV1870, with immediate effect, from scoring this complainant for automated decision-making without consent.

The supplier's refusal was held lawful under the contract exception in Article 22(2)(a), so the complaint against it on that point failed — but the authority still found the supplier had violated its duty to tell the complainant about the automated decision and explain its logic. Notably, the score was later reviewed by hand and set lower; the authority observed that the lower score was the better one.

The DSB prohibited KSV1870 with immediate effect from scoring this customer for automated decisions without consent; both firms failed transparency duties.

The decision extends SCHUFA from credit to utilities: a threshold-filtered score in an electricity signup is an Article 22 decision with a right to explanation.

The bureau, not just the customer-facing firm, bears the Article 22 duty — 'we only supply a recommendation' did not survive contact with a hard 400 cutoff.

Both parties failed transparency independently: lawful refusal, unlawful silence about the machinery behind it.

The human re-review produced a better score, evidence the automation's call was wrong on the facts, not merely under-explained.

After the CJEU's SCHUFA ruling, a score that drives the answer is a decision, not advice — and the bureau that computes it owes the disclosure, not just the firm that uses it.

The prohibition against KSV1870 took immediate effect for this complainant's data, and the decision (published in redacted form via noyb) stands as Austria's application of the SCHUFA doctrine to automated credit scoring in consumer contracts. The supplier, dismissed on the refusal itself, remains in breach findings on disclosure for its 6,000–10,000 monthly applicants' funnel.