Court case VI ZR 375/24 – Court Ruling (Germany, 2026)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A court ruled against a debt collection agency for improperly sharing a customer's debt information with a credit agency. The customer received damages for the negative impact on their credit score. This case highlights the importance of having a legal basis for sharing personal financial information.
What happened
A debt collection agency shared a customer's outstanding debt information with a credit information agency without proper consent.
Who was affected
The customer whose credit score was negatively affected by the agency's actions.
What the authority found
The court found that the agency lacked a legal basis for sharing the customer's personal data and awarded damages.
Why this matters
This case sets a precedent for how personal financial information should be handled. It emphasizes the need for companies to ensure they have valid reasons for sharing sensitive data.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
A debt collection agency (the controller) sent reminders to a customer (the data subject) for delayed installment payments related to a terminated electricity contract in November 2019. The data subject considered the claimed sums to be excessive and refused to pay. The controller transmitted the information on outstanding debts of €795 and €817 to a credit information agency, which in turn made negative entries in its database. This lowered the credit score assigned to the data subject by the credit information agency. The data subject sued the controller for disclosing outstanding receivables to the credit information agency. The court of first instance ordered the controller to revoke the negative entries contained in the credit ranking database and awarded the data subject €500 in damages. The controller appealed this decision. The appellate court held that there had been no legal basis for the transmission of personal data, as the data subject had not consented to the processing and the requirements for legitimate interests pursuant to Article 6(1)(f) GDPR were not met. However, the court considered that the data subject had not suffered any non-material damage within the meaning of Article 82 GDPR. The controller appealed the case further to the Federal Court of Justice. The Federal Court of Justice dismissed the controller’s appeal and referred the case back to the appellate court. First, the court held transmitting the personal data to the credit information agency had been unlawful due to the lack of a legal basis. It pointed out that the requirements for processing based on legitimate interests laid down in Article 6(1)(f) GDPR were not met. As such, legitimate public interests in preventing the granting of credit to those who are unable or unwilling to pay could justify the transfer of data to credit information agencies. However, no meaningful indications regarding the data subject’s ability or willingness to pay could be derived from the credit inform
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case VI ZR 375/24 in DE
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case VI ZR 375/24 - Germany (2026). Retrieved from cookiefines.eu
Last updated: