§ 31 BDSG
Protection of commercial transactions in the case of scoring and credit reports
(1)The use of a probability value for a specific future behaviour of a natural person for the purpose of deciding on the establishment, implementation or termination of a contractual relationship with that person (score) shall be permissible only if 1 the provisions of data protection law have been observed in the calculation of the score,; 2 the data used for the calculation of the score are demonstrably essential for the calculation on the basis of a scientifically recognised mathematical-statistical procedure,; 3 the score has not been calculated solely on the basis of address data and; 4 in the case of the use of address data, the data subject has been informed in advance of the planned use of such data; this shall not apply if the data are processed in accordance with Article 6 Subsection (1)(f) of Regulation (EU) 2016/679.
(2)The use of a score by a credit agency shall additionally require that the conditions under which address data may be used for the calculation of the score are disclosed to the data subject upon request.