CJEU: The Rating of a Natural Person’s Creditworthiness by a Credit Rating Agency Constitutes Profiling and Can Be an Automated Decision under Article 22 GDPR journal article Jan Horstmann European Data Protection Law Review, Volume 10 (2024), Issue 1, Page 117 - 123 Case C-634/21 OQ v Land Hessen (Scoring), Judgment of the Court of Justice of the European Union (First Chamber) of 7 December 2023 Article 22 (1) of Regulation (EU) 2016/679 (General Data Protection Regulation) must be interpreted as meaning that the automated establishment, by a credit information agency, of a probability value based on personal data relating to a person and concerning his or her ability to meet payment commitments in the future constitutes ‘automated individual decision-making’ within the meaning of that provision, where a third party, to which that probability value is transmitted, draws strongly on that probability value to establish, implement or terminate a contractual relationship with that person.