SCHUFA – Court Ruling (Germany, 2025)

The controller, SCHUFA Holding AG, operates a credit information agency that collects and stores information on payment defaults reported by its contractual partners for the purpose of assessing consumers’ creditworthiness. The data subject had three undisputed payment defaults recorded by SCHUFA. Each claim had been fully settled between December 2020 and December 2022. Despite settlement, SCHUFA continued to store the corresponding entries and made them available to its clients for credit assessments. Over the course of the proceedings, SCHUFA progressively deleted the entries, relying in part on codes of conduct under Article 40 GDPR approved by the Hessian DPA, which provide for deletion after three years, or after 18 months under specific conditions. The data subject sought deletion of the entries, compensation for non-material damage under Article 82 GDPR, and reimbursement of pre-trial legal costs. After the deletion claims were declared settled, the Cologne Higher Regional Court awarded the data subject €500 in non-material damages, holding that continued storage after settlement was unlawful. The court reasoned that, following the CJEU’s judgment in SCHUFA Holding (C-26/22 and C-64/22), private credit agencies could not store data longer than comparable entries in the public debtor register, which must be deleted immediately upon proof of full satisfaction of the claim. SCHUFA appealed the decision to the Federal Court of Justice. The Federal Court of Justice upheld the appeal. The Court confirmed that credit information agencies pursue legitimate interests within the meaning of Article 6(1)(f) GDPR, both in their own economic interest and in the interest of their customers, such as lenders seeking reliable creditworthiness assessments. It emphasised that credit reporting serves recognised economic and consumer-protection functions and may, in principle, justify the processing of data on payment defaults. However, the Court held that the Court of Appeal was wrong in assuming that the lawfulness of storage must always be assessed by aligning storage periods with those applicable to the public debtor register. The immediate deletion rule in § 882e(3) No. 1 ZPO reflects a specific legislative assessment for the debtor register, which cannot be automatically transferred to credit information agencies. Unlike the debtor register, credit agencies rely on data reported by private creditors, store more differentiated information, and serve broader purposes than enforcement alone. The Court distinguished the case from the CJEU’s SCHUFA Holding judgement on residual debt discharge, noting that that case concerned parallel storage of data originating from a public register, whereas the present case involved data obtained independently from contractual partners. As a result, the CJEU’s reasoning on avoiding circumvention of public-register deletion periods did not apply directly. Furthermore, the Court held that approved codes of conduct under Article 40 GDPR, such as the German credit agencies’ rules on review and storage periods, may be used as a benchmark when balancing interests under Article 6(1)(f) GDPR. Such codes can contribute to legal certainty in mass data processing, provided that they lead to an appropriate balance of interests and that the specific circumstances of the individual case are duly taken into account. Because the Court of Appeal had not properly examined whether continued storage was necessary and proportionate in light of these principles, nor conducted a sufficiently individualised balancing of interests, the finding of unlawfulness under Article 6(1)(f) GDPR could not stand. Consequently, the basis for awarding damages under Article 82 GDPR was not established. The case was therefore remitted for an appropriate assessment of the lawfulness of the data processing and, if appropriate, the existence and extent of non-material damage.