§ 31 BDSG
Protection of commercial transactions in the case of scoring and credit reports
(1)The use of a probability value for a specific future behaviour of a natural person for the purpose of deciding on the establishment, implementation or termination of a contractual relationship with that person (score) shall be permissible only if
1.the provisions of data protection law have been observed in the calculation of the score
2.the data used for the calculation of the score are demonstrably essential for the calculation on the basis of a scientifically recognised mathematical-statistical procedure
3.the score has not been calculated solely on the basis of address data and
4.in the case of the use of address data, the data subject has been informed in advance of the planned use of such data; this shall not apply if the data are processed in accordance with Article 6 Subsection (1)(f) of Regulation (EU) 2016/679.
(2)The use of a score by a credit agency shall additionally require that the conditions under which address data may be used for the calculation of the score are disclosed to the data subject upon request.