OP is in Germany where they have a private database called Schufa that pools information about you collected from banks, mobile carriers and internet providers, and provides a "score" to them as well as to landlords.

It's borderline legal under GDPR because it doesn't actually store anything about things like nationality, employment, religion, marital status or sensitive financial information like income, assets, expenses.

The score is based on things like loan existence & repayments, ongoing utility contracts (with privately owned companies), if you've filed for insolvency, how often 3rd parties inquire about your score and other circumstantial data.

Generally speaking you're correct, in most countries there are very clear rules about loans that are based on what other loan repayment you have vs what's your current income, and there are rules about how far much debt you can take as a ratio of the two (say, you can't take a new loan if you're already using 60% of your income to repay previous loans).

Also, the information about loans is typically restricted to this exact inquiry: can this person get a new loan (yes/no) and if yes what's the maximum they allowed to repay per month (X euro). So the bank knows they can structure a loan to you based on a repayment of up to X per month, but nothing else.

I'm guessing Germany doesn't have regulation like this (since accessing any information about your income and expenses is forbidden), so Schufa was created to be a (poor) substitute.