SCHUFA Holding AG – Court Ruling (Germany, 2022)

The controller is the SCHUFA Holding AG, the biggest German credit rating agency. The data subject is as a businessman operating an one-man business in the steel pipe trading sector and working as a commercial agent as a side-job. In the past, insolvency proceedings had been initiated against the data subject which was published - as required under German law - on the insolvency announcement portal "www.insolvenzbekanntmachungen.de". On March 25 2020, these proceedings were terminated. Under § 3(1) of the German Insolvency Announcement Regulation (InsoBekV) (a provision implementing and specifying EU insolvency law) entries in the insolvency announcement portal must be deleted not later than six months after the termination of the insolvency proceedings. The respective entry on the data subject was deleted during this period in the portal. The controller, however, stored the information about the insolvency proceedings in their own database even after this period. As a result of these records, the data subject was not able to switch his health insurance, rent an apartment or conduct business without prepayment. On 30 November 2020, the data subject requested the controller to stop disclosing the personal information from his insolvency proceedings to third parties and delete the information. The controller rejected the request of the data subject. It argued that its customers have a legitimate interest to know that the data subject had been insolvent during the time of the insolvency proceedings even after the six months period has elapsed. It considered a three years storage period appropriate as laid down in the "Rules of conduct for the review and deletion periods of personal data by the German credit agencies" ("Verhaltensregeln für die Prüf- und Löschfristen von personenbezogenen Daten durch die deutschen Wirtschaftsauskunfteien") ("Rules of Conduct"), an internal policy of the association of the biggest German credit rating agencies ("Die Wirtschaftsauskun