Private Individual – Court Ruling (Germany, 2021)

Controller (company B) is a company that collects debts. The data subject had a contractual relationship with a bank (company A), since they had a credit card account at this bank. The data subject experienced payment difficulties in 2017, which resulted in debt. Ultimately, this led company A to commission company B with the collection of the accumulated debt. Although it remained disputed between the parties whether the data subject and company B concluded a payment arrangement to pay off the debt, the data subject then paid instalment fees to company B to resolve the whole debt. However, company B still registered a claim for €1,546 with SCHUFA Holding AG. This is a credit reference agency that registers debt so that other companies can assess a customer's creditworthiness. The data subject then brought the action before the Regional Court of Lüneburg (Case number 3 O 143/20), in which the data subject and company A concluded a settlement, in which company A promised to have the registered claim of €1,546 removed from the database of SCHUFA Holding AG, pursuant to Article 17(1)(a) GDPR. Company B then contacted the SCHUFA Holding AG to have the claim removed, but the latter did not fulfil the request for deletion. On 10 February 2021, the data subject filed a complaint with the Hessian DPA. The DPA, however, rejected the complaint because it did not see a violation of the GDPR. Consequently, it held that there was no possibility of obliging SCHUFA Holding AG to delete the entry. It was assumed that an agreement on payment in instalments had not been concluded, even if the data subject had behaved in this way. The data subject appealed against this decision before the Administrative Court of Wiesbaden. The Administrative Court of Wiesbaden upheld the appeal. First, the Court considered that the Hessian DPA is the competent supervisory authority pursuant to Article 64(1)(a) GDPR, and that the Court is competent to hear the disputes pursuant to Section 20(1) a