In its long-awaited decision in proceedings between an individual and the Federal State of Hessen, Germany, (Hessen) (C- 634/21)(1) the Court of Justice of the European Union (CJEU) has now interpreted the “automated decision-making” framework under the GDPR. The CJEU ruled in its judgment on 2 January 2024 that a credit scoring agency that uses automated processing to create credit repayment probability scores on which its customers (usually lenders) rely heavily for its decisions on the establishment, implementation or termination of contracts, is itself engaging in automated individual decision-making.