The Court of Justice of the European Union rendered a decision prohibiting certain automated credit scoring and extended data retention practices under the EU General Data Protection Regulation. The scoring practices of German credit bureau SCHUFA generally contradict GDPR provisions on the use of automated decision-making technology. The court also ruled SCHUFA's data retention concerning discharge from remaining debt does not meet the six-month retention period laid out in the GDPR and German law.