Credit scoring and personal data protection: comment on the judgments of the Court of Justice of the European Union Dec. 7, 2023

Abstract

The article analyzes the judgments of the Court of Justice of the European Union of December 7, 2023 (Joined Cases C-26/22 and C-64/22 and C-634/21). These decisions give the opportunity to reflect on two main issues: the range of judicial review exercised over a complaint decision adopted by a supervisory authority and the lawfulness of the collection and processing of personal data, including automated processing. The forms of protection related to the processing of personal data, by developing at different levels and in different ways, outline as a whole a system aimed at ensuring the highest level of data protection, which, also from a balancing of interests perspective, appears – at least in accordance with the judgments under consideration – to prevail over the commercial interests related to the use of the data.