Court case VI ZR 375/24 – Court Ruling (Germany, 2026)

A debt collection agency (the controller) sent reminders to a customer (the data subject) for delayed installment payments related to a terminated electricity contract in November 2019. The data subject considered the claimed sums to be excessive and refused to pay. The controller transmitted the information on outstanding debts of €795 and €817 to a credit information agency, which in turn made negative entries in its database. This lowered the credit score assigned to the data subject by the credit information agency. The data subject sued the controller for disclosing outstanding receivables to the credit information agency. The court of first instance ordered the controller to revoke the negative entries contained in the credit ranking database and awarded the data subject €500 in damages. The controller appealed this decision. The appellate court held that there had been no legal basis for the transmission of personal data, as the data subject had not consented to the processing and the requirements for legitimate interests pursuant to Article 6(1)(f) GDPR were not met. However, the court considered that the data subject had not suffered any non-material damage within the meaning of Article 82 GDPR. The controller appealed the case further to the Federal Court of Justice. The Federal Court of Justice dismissed the controller’s appeal and referred the case back to the appellate court. First, the court held transmitting the personal data to the credit information agency had been unlawful due to the lack of a legal basis. It pointed out that the requirements for processing based on legitimate interests laid down in Article 6(1)(f) GDPR were not met. As such, legitimate public interests in preventing the granting of credit to those who are unable or unwilling to pay could justify the transfer of data to credit information agencies. However, no meaningful indications regarding the data subject’s ability or willingness to pay could be derived from the credit information entries at issue: the controller had failed to demonstrate the debts existed in the amount claimed. Therefore, it could not rely on legitimate interests as a legal basis. Second, the court held that the data subject was entitled to the revocation of the disputed credit information entries due to the unlawful disclosure of their personal data. According to the court, this claim could be based on 1) the application of Article 19 GDPR in conjunction with Article 17(1) (d) GDPR, 2) Article 19 GDPR in conjunction with Articles 5(1)(a), 5(2), and 24(1) GDPR, or 3) national law by analogy. Third, the court held that the data subject had suffered non-material damage within the meaning of Article 82 GDPR due to the harm caused to their economic reputation. The fact that the credit reports adversely affected the data subject’s credit score, which could then be taken into account by potential contractual partners, was enough to give rise to a claim for damages. The court pointed out that the transmission of personal data to one recipient and the risk of further transmissions to third parties already constituted loss of control; the data subject did not need to prove a feeling of helplessness, fear, or anxiety to be entitled to damages.