Scoring (BDSG new)
Scoring (BDSG-new) takes a special look at the term scoring in general. On the assumption that Art. 22 of the GDPR requires this, the national legislature has further developed scoring as part of profiling . In this in § 31 BDSG-new a regulation corresponding to § 28b BDSG-old was enacted under the heading “Protection of commercial transactions with scoring and creditworthiness information”. In paragraph 1, the scoring is defined as
" Use of a probability value about a certain future behavior of a natural person for the purpose of deciding on the establishment, implementation or termination of a contractual relationship with this person "
Are defined.
backgrounds
According to Art. 4 No. 4 GDPR, profiling is any type of automated processing of personal data that consists of using this personal data to evaluate certain personal aspects relating to a natural person, in particular aspects relating to work performance to analyze or predict the economic situation, health, personal preferences, interests, reliability, behavior, whereabouts or change of location of this natural person.
Section 31 (1) of the BDSG then further specifies the requirements for profiling beyond what is specified in the GDPR and reads as follows:
“(1) The use of a probability value for a certain future behavior of a natural person for the purpose of deciding on the establishment, implementation or termination of a contractual relationship with this person (scoring) is only permitted if
- 1. the provisions of data protection law have been complied with,
- 2. the data used to calculate the probability value are verifiably significant for the calculation of the probability of the specific behavior based on a scientifically recognized mathematical-statistical procedure,
- 3. Address data was not used exclusively for calculating the probability value and
- 4. in the case of the use of address data, the data subject has been informed of the intended use of this data before calculating the probability value; the instruction must be documented. "
Finally, Art. 31 Para. 2 BDSG-new regulates the (not of interest here) use of probability values about the solvency and willingness to pay of a natural person (see also credit scoring )
literature
- Simitis / Hornung / Spiecker, Commentary on data protection law, 1st edition 2019, Appendix 2 to Art. 6 marginal no. 17; Kühling / Buchner, DS-GVO and BDSG Commentary, 2nd edition 2018, § 31 BDSG Rn. 4 ff