Court case VI ZR 375/24 – Court Ruling (Germany, 2026)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A German court ruled that a debt collection agency shared a customer's unpaid debts with a credit agency without proper permission. This decision is important because it highlights the need for companies to have a valid reason for sharing personal information. Businesses should ensure they have consent or a legal basis before disclosing any personal data.
What happened
The court found that the debt collection agency transmitted a customer's unpaid debts to a credit information agency without valid legal grounds.
Who was affected
The ruling affected a customer whose credit score was lowered due to the agency's actions.
What the authority found
The court decided that the debt collection agency lacked a valid legal basis for sharing the customer's personal data, violating GDPR rules.
Why this matters
This case shows that companies must be careful when sharing personal information, as they can be held accountable for unauthorized disclosures. It sets a precedent for ensuring that consent or legitimate interests are properly established.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
A debt collection agency (the controller) sent reminders to a customer (the data subject) for delayed installment payments related to a terminated electricity contract in November 2019. The data subject considered the claimed sums to be excessive and refused to pay. The controller transmitted the information on outstanding debts of €795 and €817 to a credit information agency, which in turn made negative entries in its database. This lowered the credit score assigned to the data subject by the credit information agency. The data subject sued the controller for disclosing outstanding receivables to the credit information agency. The court of first instance ordered the controller to revoke the negative entries contained in the credit ranking database and awarded the data subject €500 in damages. The controller appealed this decision. The appellate court held that there had been no legal basis for the transmission of personal data, as the data subject had not consented to the processing and the requirements for legitimate interests pursuant to Article 6(1)(f) GDPR were not met. However, the court considered that the data subject had not suffered any non-material damage within the meaning of Article 82 GDPR. The controller appealed the case further to the Federal Court of Justice. The Federal Court of Justice dismissed the controller’s appeal and referred the case back to the appellate court. First, the court held transmitting the personal data to the credit information agency had been unlawful due to the lack of a legal basis. It pointed out that the requirements for processing based on legitimate interests laid down in Article 6(1)(f) GDPR were not met. As such, legitimate public interests in preventing the granting of credit to those who are unable or unwilling to pay could justify the transfer of data to credit information agencies. However, no meaningful indications regarding the data subject’s ability or willingness to pay could be derived from the credit inform
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case VI ZR 375/24 in DE
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case VI ZR 375/24 - Germany (2026). Retrieved from cookiefines.eu
Last updated: