The automation of processes is rapidly expanding across various industries, driven by technological advancements and the increasing reliance on data-driven solutions. The automation of processes can benefit all stakeholders and adversely affect fundamental human rights, such as the right to privacy and data protection. The risks to fundamental human rights are addressed by the GDPR, primarily by Article 22. This article set out the right of an individual not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning an individual or similarly significantly affects them.  The CJEU was asked to interpret Article 22 GDPR in ‘SCHUFA case’. The dispute arose from a credit score produced by SCHUFA AG, which led a financial institution to refuse a loan to the individual. The CJEU held that producing credit scores is an ‘automated individual decision’ if a third party draws strongly on that credit score. Such an ‘automated individual decision’ is prohibited in principle by Article 22 GDPR, unless exceptions apply.  This research aims to understand how SCHUFA case has changed the legal framework for agencies and how they may adjust their business practices to ensure compliance with Article 22 GDPR while still ensure their competitive advantage.  The findings indicate that credit scoring is crucially embedded in agencies’ processes as it massively benefits their operations. Agencies engaged in ADM may adjust their practices to legally comply with Article 22 GDPR, however not without momentarily jeopardizing their competitive advantage. Strategic changes necessary to tackle recent legal uncertainty are accompanied by further cost and longer operational response timers.