Court case 17 U 2/24 – Court Ruling (Germany, 2024)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A German court ruled that an electricity provider must remove negative payment information about a customer from a credit agency because it lacked a legal basis. This is significant as it emphasizes that companies must have valid reasons to share personal data with credit agencies.
What happened
The electricity provider shared a customer's payment information with a credit agency without a valid legal basis.
Who was affected
A customer who was affected by the negative payment information reported to the credit agency.
What the authority found
The court held that the electricity provider had no legal basis for processing the customer's data, and the customer was awarded €500 in damages.
Why this matters
This ruling reinforces the need for companies to ensure they have proper legal grounds before sharing personal data, especially with credit agencies.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 22 March 2026.
Processing notes: articles corrected, national law identified, authority corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The data subject had an electricity contract with an electricity provider. The electricity provider’s terms and conditions included the following paragraph: “For the purpose of credit checks, the energy supplier may obtain information from credit agencies and pass on personal customer data relating to the energy supply contract to them under the conditions of § 28a BDSG.” The contract started in April 2014 and was cancelled by A due to outstanding bills in September 2014. In October 2014, the electricity provider sent an invoice to the data subject which listed a due amount of €529.16. According to the invoice, this amount included, inter alia, electricity costs, reminder charges, damages caused by delay, and a bank transfer fee. In November 2014, the debt collecting agency (the controller) reminded the data subject of the payment and added a fee for their services. In 2019, the electricity company conveyed the claim to the controller. In 2020, the controller warned the data subject about a possible transfer of their payment data to a credit rating agency. In 2021 and 2022, the controller informed the credit rating agency Schufa about the fact that the data subject had not paid. The data subject refused to pay and invoked the statute of limitations. The controller accepted this and Schufa noted it as well. Following this, the data subject was refused several contracts by different companies such as a mobile phone contract, a credit, and an insurance. The controller refused to remove the information from Schufa. Following a lawsuit filed at the Regional Court of Kiel (Landgericht Kiel – LG Kiel) the LG Kiel decided that the controller had to withdraw their information from Schufa because there was no legal basis for the processing of personal data. Furthermore, the LG Kiel held that the data subject was entitled to €500 in non-material damages under Article 82(1) GDPR. Both the controller and the data subject appealed the decision to the Higher Regional Court Schlesw
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case 17 U 2/24 in DE
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case 17 U 2/24 - Germany (2024). Retrieved from cookiefines.eu
Last updated: