What happened
It was reported that a consumer in Austria applied online for an energy contract with Unsere Wasserkraft | go green energy. According to the complainant’s account recorded in the decision, within one minute the complainant received a welcome email as a new customer, followed by a message refusing the application for credit reasons.
The Austrian Data Protection Authority records in decision D124.1994/24 of 25 September 2025 that the supplier had obtained a credit score from KSV1870. The score was 403. It was reported that the supplier automatically refuses applications with a score of 400 or higher.
The decision records that the complainant, represented by the privacy group noyb, complained to the Austrian Data Protection Authority on 29 August 2024.
What an auditable version would have shown
It was reported that KSV1870 argued it only supplied credit information and had no power to decide whether the supplier accepted a customer. The bureau said its score was a simple recommendation, rather than a decision.
The authority found that the supplier’s decision rested solely on automated processing. It records that the supplier had expressly admitted this.
It was reported that the authority applied the EU Court of Justice’s 2023 SCHUFA judgment, C-634/21. It held that KSV1870’s score was a decisive, if not the only, criterion in whether the contract was made.
Where the gap was
It was reported that the authority held KSV1870 had made an automated decision about the complainant under Article 22(1) GDPR. It found the bureau had failed to tell the complainant about the automated decision or explain its logic.
The authority prohibited KSV1870, with immediate effect, from processing the complainant’s personal data to calculate credit scores automatically where those scores are used for automated decision-making, including profiling, under Article 22(1) and the complainant has not consented.
It was reported that the supplier’s refusal was also treated as an automated decision. The authority held it was lawful under the contract exception in Article 22(2)(a) and dismissed the Article 22 complaint against the supplier. It still found the supplier had failed to tell the complainant about the automated decision and explain its logic.
The decision records that the supplier receives about 6,000 to 10,000 energy supply applications each month. After the complainant intervened, it offered an alternative tariff.
It was reported that the score was later reviewed by hand and set lower. The authority noted that the lower score was better.
A ConstraintGate is designed to check an action against declared rules before it goes ahead, such as a rule the organisation sets for itself that a refusal based only on a score goes to a person for review. The authority did not require this here.
A ConductRecord keeps, for each refusal, which score was used, who produced it and which rule applied it.
ConstraintGate and ConductRecord are Headlights designs.
What governance should have looked like
It was reported that the authority ordered both companies to explain the logic to the complainant within four weeks.
The decision was not final. According to noyb’s case record, KSV1870 and the complainant’s side appealed to the Federal Administrative Court. The case remained pending as of 3 October 2026.
Where a score from one company decides a refusal by another, best practice would be for each to record its part, tell the person that the decision was automated, and give them a way to reach a human who can change it.
Failure Pattern: according to the Austrian data protection authority, a credit bureau’s score was a decisive, if not the only, criterion in an automatic refusal of an electricity contract, while the bureau said it only gave a recommendation.
Governance Principle: when a score decides who gets an essential service, the organisation that produces the score and the one that applies it should each be able to explain the decision and who is answerable for it.
The reference implementation of ConstraintGate and ConductRecord is open source. It lives at github.com/saffronandindia/headlights-oss, Apache 2.0 licensed and free to install. The repository is public now.
Sources
- Datenschutzbehörde, decision D124.1994/24, 2025-0.355.103, 25 September 2025 (redacted copy published by noyb)
- C088 KSV 1870, Unsere Wasserkraft: case record (noyb)