Court case VI ZR 431/24 – Court Ruling (Germany, 2025)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A German court ruled that a mobile phone provider can share customer data with a credit agency to prevent fraud. This decision matters because it confirms that companies can use personal data for legitimate business interests. Businesses should understand how to balance data sharing with privacy rights.
What happened
A mobile phone service provider was allowed to transfer positive customer data to the credit agency SCHUFA.
Who was affected
Customers whose positive contract data was shared with SCHUFA.
What the authority found
The Federal Court of Justice ruled that the data transfer was lawful under Article 6(1)(f) of the GDPR, as it served a legitimate interest.
Why this matters
This case sets a precedent for how companies can use customer data for fraud prevention and credit risk assessment. It highlights the importance of having a clear legal basis for data processing activities.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
A consumer protection organisation filed a case against a mobile phone service provider in Germany. The organisation challenged the provider’s practice of transferring “positive data” about customers to the credit agency SCHUFA. Positive data is information about the existence and proper fulfillment of a postpaid mobile contract. The controller stated that this transfer served the purpose of fraud prevention and credit risk management. The organisation claimed that the transfer violated the GDPR, as it was carried out without the data subject’s consent. It also argued that the provider’s data protection notice was an invalid section of the controller's general terms and conditions under German civil law. The lower courts dismissed the claims. The organisation appealed to the Federal Court of Justice (Bundesgerichtshof - BGH). The BGH dismissed the appeal and confirmed that the transmission of positive data to SCHUFA was lawful under Article 6(1)(f) GDPR. The court held that the controller had a legitimate interest in preventing fraud and assessing credit risk when concluding postpaid mobile phone contracts, particularly those involving the provision of smartphones. It found that consumers could reasonably expect such data transfers in this context. The court explained that the transfer of positive data was minimal and proportional because the information shared was limited and did not reveal private preferences or behaviour. The BGH rejected the organisation’s argument that the transfer aimed to identify “contract hoppers" (people who frequently change contracts to get bonuses), as there was no factual evidence to support this claim. It also held that the proceedings did not need to be suspended pending other cases, as the relevant legal issues had already been clarified by the CJEU in its previous case law (Mousse v CNIL C-394/23; Schufa C‑26/22 and C‑64/22). Regarding the data protection notice, the BGH found that it was not part of the contractual terms but mer
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case VI ZR 431/24 in DE
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case VI ZR 431/24 - Germany (2025). Retrieved from cookiefines.eu
Last updated: