AG: automated payment-option refusals can breach GDPR ban

Advocate General Laila Medina has proposed that refusing a customer the choice of invoice or instalment payment on the sole basis of an automated creditworthiness assessment can fall under the GDPR's ban on solely automated decisions — but only where the refusal is capable of preventing the sale contract from being concluded at allEuropa. In her Opinion of 15 October 2026 in Case C-568/25, on a reference from the Oberster Gerichtshof (Supreme Court, Austria), she proposes answers to three questions on Article 22(1) and Article 22(2)(a) of Regulation (EU) 2016/679; the Court itself has yet to ruleEuropa.

The dispute concerns the mail-order company Universal Versand, which receives tens of thousands of Austrian orders a month, around 90% of them on part-payment or invoice terms. Before allowing such terms, the company runs an automated solvency check combining internal default-probability scoring with, for new customers, a query to an external credit-information firm. Unknown customers are refused outright; known customers receive a colour-coded signal, red meaning automatic refusal and yellow a manual database check, and refused customers may ask for manual review. The consumer association Verein für Konsumenteninformation claims systematic breach of Article 22 GDPR; the company denies significant effects and invokes contract necessity.

On the first question, the Advocate General proposes a conditional yesEuropa. Article 22(1) requires three cumulative conditions — a decision, based solely on automated processing including profiling, with legal or similarly significant effects — and only the third is disputed. Whether refusing those terms meets it is for the referring court to assess, guided by the SCHUFA Holding (Scoring) judgment (C-634/21): there, an automatically generated probability value counted as a significantly affecting decision because banks drew on it so strongly that a low score led almost systematically to refusal of the loan. The analogy turns partly on whether invoice-payment contracts count as consumer credit — Directive 2008/48/EC may exclude them under Article 2(2)(f), though Austria was free to treat them as such — but even without it, customers unable to pay upfront by the imposed alternatives (credit card or PayPal) cannot conclude the sale at all, comparable to a refused loan.

For the Article 22(2)(a) contract-necessity derogation, the Opinion proposes the strict two-stage test of the Article 6(1)(b) case lawEuropa: the assessment must be objectively indispensable to the contract's main object — here, transferring goods against payment, where offering a suitable payment method secures performance — with no less intrusive workable alternative. That requires showing an objective link between the contract's object and the solvency assessment, and that the data collected are objectively appropriate and strictly necessary for it under the Article 5 data-minimisation principle. Which data were collected, why, and their appropriateness must be proved by the company under the Article 5(2) accountability rule.

On the third question, the derogation requires the automated decision itself — not just any decision — to be necessaryEuropa: the definite article ("the decision") refers back to the solely automated decision of Article 22(1), confirmed by recital 71 and the strict construction owed to derogations. Commercial convenience alone is not enough: order volumes, customers' expectation of an instant answer at online checkout, and business savings count only if objectively shown to make automation indispensable — for instance where human review would be practically unrealistic given the data volumes. A pending Commission digital-omnibus proposal that would clarify this point cannot affect the reading, since it has not entered into force.

Legal basis: Regulation (EU) 2016/679, Articles 4(4), 5, 6(1)(b) and 22; AG Opinion of 15 October 2026 in Case C-568/25; judgment of 7 December 2023 in Case C-634/21.