The Court of Justice of the EU (CJEU) ruled on Thursday (7 December) that decision-making by scoring systems that use personal data is unlawful, a judgement that could have significant spillover effects for social security and credit agencies.