UF (data subject and claimant before national court) – CJEU Judgment (Germany, 2023)
CJEU judgment — not a DPA enforcement action
This is a Court of Justice ruling, not an enforcement action by a data protection authority. It is not included in cookie statistics or the Risk Calculator.
The Court of Justice ruled that SCHUFA, a credit agency in Germany, could not keep records of debt discharges longer than allowed by law. This decision came after two individuals complained that their debt discharge records were stored for too long. It matters because it reinforces the right of individuals to have their data erased when it is no longer public.
What happened
The Court ruled on a case where SCHUFA intended to store debt discharge records for three years, despite them being erased from public records after six months.
Who was affected
UF and AB, two individuals who had their debt discharge records stored by SCHUFA.
What the authority found
The Court held that SCHUFA's processing of the debt discharge records lacked a valid legal basis, violating GDPR's requirements for data erasure.
Why this matters
This ruling sets a precedent for how long personal data can be stored and reinforces individuals' rights to have their data erased. Companies should ensure they have clear policies for data retention and erasure.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
National Law Articles
The data subjects UF and AB underwent insolvency proceeding in Germany and were granted an early discharge from remaining debts by court decisions of 17 December 2020 and 23 March 2021 respectively. In accordance with § 9(1) Insolvenzordnung (Insolvency Code) and § 3(1)(2) InsBekV (Regulation on public notifications in insolvency proceedings on the internet), the official publication of these decisions on the debt discharges in the German insolvency register was erased after 6 months. SCHUFA Holding AG (SCHUFA), a German credit information agency had recorded these decisions on debt discharges in their own data bases and intended to store it for three years after registration, in accordance with a code of conduct under Article 40 GDPR approved by the competent DPA. UF and AB requested SCHUFA to erase the (no longer public) decisions on the debt discharges. SCHUFA refused and UF and AB lodged complaints with the Hessian DPA (HBDI) under Article 77 GDPR. The HBDI dismissed the complaints, finding SCHUFA's processing lawful. UF and AB each brought an action under Article 78 GDPR against the HBDI's decisions before the Verwaltungsgericht Wiesbaden (VG Wiesbaden), arguing that the HBDI was obliged to take measures in respect of SCHUFA to enforce the erasure of the entries concerning them. The HBDI requested the dismissal of the actions, arguing that Article 77(1) GDPR constitutes a mere "right of petition". Hence the VG Wiesbaden could only review whether the HBDI handled the complaints and informed the complainants of their progress and outcome but not review the substantive correctness of the decisions. On UF's and AB's requests for erasure, the HBDI argued that SCHUFA could store the decisions on debt discharges for as long as is necessary for the purpose of processing (i.e. assessing the creditworthiness of UF and AB) and that the storage period of three years after entry in the file according to the code of conduct should apply. The VG Wiesbaden doubted the HBDI’s
Outcome
CJEU Judgment
A judgment by the Court of Justice of the European Union, typically on a preliminary reference from a national court.
Related Cases (0)
No other cases found for UF (data subject and claimant before national court) in DE
This is the only recorded case for this entity in this jurisdiction.
Details
Judgment Date
7 December 2023
Authority
Court of Justice of the European Union
GDPRhub ID
gdprhub-cjeu-6833About this data
Cite as: Cookie Fines. UF (data subject and claimant before national court) - Germany (2023). Retrieved from cookiefines.eu
Last updated: