Schufa Holding AG – Court Ruling (Germany, 2021)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A German court ruled that Schufa Holding AG must delete certain credit information after six months, not three years. Schufa kept data longer than allowed, affecting a person's credit rating. This case stresses the importance of timely data deletion for credit agencies.
What happened
Schufa retained credit information longer than legally permitted, impacting a person's credit rating.
Who was affected
Individuals whose credit information was kept by Schufa beyond the six-month legal limit.
What the authority found
The court decided that Schufa must erase credit data after six months, as keeping it longer violated GDPR.
Why this matters
This decision highlights the importance of adhering to data retention limits, especially for credit agencies. It underscores the need for businesses to regularly review and update their data deletion practices.
GDPR Articles Cited
National Law Articles
The controller is the Schufa Holding AG, a German credit rating agency. The data subject went into private insolvency after a failed business start-up. The insolvency proceedings were concluded and he was discharged from residual debt. This was published - as provided for under national law - on the online insolvency notice portal (www.insolvenzbekanntmachungen.de). § 3(1) of the German Insolvency Notification Regulation (InsoBekV) provides that such publications must be deleted no later than six months after the discontinuation of the insolvency proceedings has become unappealable. The respective entry on the data subject was deleted during this period. The controller included the information on the discharge of residual debt in its database at the time of its publication on www.insolvenzbekanntmachungen.de. However, it continued to store the information in its database after it was deleted from the aforementioned register and processed it for credit assessment purposes. The controller is a member of an association of German credit agencies. This association has given itself rules of conduct according to which the information about the discharge of residual debt is to be deleted after 3 years. The data subject received (after deletion on www.insolvenzbekanntmachungen.de) a rejection for a flat enquiry because of his bad credit rating. An action by the data subject for deletion of the entry on residual debt discharge was dismissed at first instance. The data subject appealed against this decision to the Schleswig-Holstein Higher Regional Court (OLG Schleswig-Holstein). The court ruled that the data subject was entitled to erasure under Article 17(1)(d) GDPR, as the data processing was not lawful. In any case, the requirements of Article 6 GDPR were no longer met 6 months after the discharge of residual debt had become unappealable. = The court first states that the processing cannot be based on Article 6(1)(e) GDPR. For this to be the case, the processing must be
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Schufa Holding AG in DE
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Schufa Holding AG - Germany (2021). Retrieved from cookiefines.eu
Last updated: