Schufa ruling: Negative entries must be deleted promptly after payment

Schufa must delete negative entries promptly after a payment.
Categories:

Will Schufa's long retention periods soon be history? The Cologne Higher Regional Court sees a Infringement against the GDPRif a credit agency does not promptly delete negative entries after debts have been settled. The Hessian data protection authority had approved Schufa's actions.

Deletion after fulfillment of the liabilities

The plaintiff, a natural person, took legal action against Schufa because it had continued to store corresponding negative payment entries even after the settlement of three undisputed claims and had kept them available for retrieval by its contractual partners.

In detail, these were the following claims:

  • An enforceable claim for € 150 from an enforcement order dated August 15, 2019, which the plaintiff settled on December 2, 2020.
  • A claim for € 428.27 from an invoice dated January 31, 2020, paid on November 4, 2021, for which several reminders were sent.
  • An enforceable claim for € 160.99 from an enforcement order dated February 7, 2022, which the plaintiff settled in December 2022.


After the plaintiff had fulfilled these obligations, he demanded from the defendant the Deletion of the corresponding negative features, non-material damages of at least € 1,500 and reimbursement of pre-trial legal costs.

At the time the lawsuit was filed on November 25, 2023, the debt entries were still stored. In the course of the legal dispute, the defendant deleted the first two entries after three years had passed since payment and the third entry with regard to new rules of conduct for credit agencies, which provided for a reduction of the storage period to 18 months under certain conditions.

After the defendant had carried out the deletions, the parties agreed to settle the dispute on the merits. The legal dispute then focused solely on the plaintiff's claim for non-material damages and reimbursement of his pre-trial legal costs.

LG Bonn: 3-year storage period of the Schufa by GDPR covered

The Bonn Regional Court dismissed the claim. It considered the continued storage of the entries for three years in each case to be justified by Art. 6 para. 1 lit. f GDPR covered. Furthermore, immaterial damage had not been sufficiently demonstrated.

The plaintiff appealed against this. He claimed that the defendant had not complied with the requirements regarding the storage period, in particular that it should have deleted the data promptly after the claims had been settled. He referred to the case law of the European Court of Justice (ECJ) on the retention period of negative creditworthiness information.

The defendant defended the first instance decision. It referred to its own empirical studies, which showed an increased probability of renewed payment problems even three years after a claim had been settled. It also referred to the new rules of conduct for credit agencies that came into force later.

Reading tip: GDPR violation due to Schufa report

OLG Cologne: Schufa data must be deleted promptly after satisfaction of the claim

The Cologne Higher Regional Court (OLG) partially upheld the plaintiff's appeal and dealt in detail with the requirements for data processing by credit agencies (15 U 249/24).

The court found that the continued storage of information about settled claims beyond the respective settlement violates Art. 6 para. 1 lit. f GDPR is violated. According to this standard, the Processing of personal data is only permitted if there is a legitimate interest of the controller or a third party and the interests or fundamental rights and freedoms of the data subject do not outweigh this. The OLG found that, following the fulfillment of the claims, the plaintiff's legitimate interest in the Deletion of its data predominates.

The court attached particular importance to the statutory interpretation of section 882e (3) no. 1 ZPO. According to this, entries in the debtor register must be deleted immediately after the claim has been satisfied. This statutory provision leads to the conclusion that private credit agencies are also obliged to delete corresponding data promptly after satisfaction of the claim in order to avoid contradictions in value with public law registers.

The Higher Regional Court of Cologne referred to the current case law of the European Court of Justice (ECJ, judgments C-26/22 and C-64/22), which had prohibited credit agencies from unlawfully exceeding the retention periods of public registers. This case law is also transferable to entries in the debtor register and comparable private negative data.

The defendant could also not successfully rely on the new rules of conduct approved by the Hessian Data Protection Commissioner pursuant to Art. 40 GDPR invoked. The OLG clarified that such rules of conduct meet the requirements of the GDPR cannot be modified or relativized. Unlawful data processing remains unlawful even if internal rules of conduct are complied with.

Compensation for damages due to continued enrichment

Finally, the OLG affirmed a claim for non-material damages pursuant to Art. 82 para. 1 GDPR. The continued storage and Transmission of the settled claims had a demonstrable impact on the plaintiff's credit rating with various contractual partners. Even if concrete economic disadvantages such as loan rejections could not be proven, the damage to reputation was already sufficient for the award of damages.

The court emphasized that, according to recent ECJ case law, non-material damages have a purely compensatory function. A deterrent or punitive component should not be taken into account. Taking into account all the circumstances of the individual case, the OLG set the compensation for pain and suffering at €500.

In addition, it awarded the plaintiff pro rata pre-trial legal costs.

The appeal was only allowed in favor of the defendant in order to enable the highest court to clarify the question of whether Section 882e (3) No. 1 ZPO also applies to credit agencies. However, the appeal was not allowed for the plaintiff.

Significance for practice

This ruling has far-reaching implications for the practice of credit agencies:

  • Shortened storage periods: Information on settled claims must be deleted promptly in future.

  • Increase in risk: Credit reference agencies are exposed to considerable liability risks if they continue to rely on outdated storage practices.

  • Limited protective effect of rules of conduct: The approval of codes of conduct by data protection supervisory authorities does not provide reliable protection against claims for damages.

  • Clearer demarcation between public and private registers: Data from other sources may also not be stored for longer than the corresponding entries in the public debtor register.

Schufa has already announced that it will appeal against the ruling of the Cologne Higher Regional Court. "The ruling contradicts the regulation approved by the data protection supervisory authorities and deviates from previous case law," explained Schufa in a statement.

Source: Judgment of the Cologne Higher Regional Court dated 10.04.2025 (15 U 249/24)

Tags:
Share this post :