DPIA

The wait is over
Ailance™ DPIA is here!

Schufa ruling: Negative entries must be deleted promptly after payment

Schufa must delete negative entries promptly after a payment.
Categories:

Will Schufa's long retention periods soon be history? The Cologne Higher Regional Court considers it a violation of the GDPR if a credit agency does not delete negative entries promptly after liabilities have been settled. The Hessian data protection authority had approved Schufa's actions.

Deletion after fulfillment of liabilities

The plaintiff, a natural person, took legal action against Schufa because it had continued to store corresponding negative payment entries even after the settlement of three undisputed claims and had kept them available for retrieval by its contractual partners.

In detail, these were the following claims:

  • An enforceable claim for € 150 from an enforcement order dated August 15, 2019, which the plaintiff settled on December 2, 2020.
  • A claim for € 428.27 from an invoice dated January 31, 2020, paid on November 4, 2021, for which several reminders were sent.
  • An enforceable claim for € 160.99 from an enforcement order dated February 7, 2022, which the plaintiff settled in December 2022.


After the plaintiff had fulfilled these obligations, he demanded the deletion of the corresponding negative features, non-material damages of at least €1,500 and reimbursement of pre-trial legal costs from the defendant.

At the time the lawsuit was filed on November 25, 2023, the debt entries were still stored. In the course of the legal dispute, the defendant deleted the first two entries after three years had passed since payment and the third entry with regard to new rules of conduct for credit agencies, which provided for a reduction of the storage period to 18 months under certain conditions.

After the defendant had carried out the deletions, the parties agreed to settle the dispute on the merits. The legal dispute then focused solely on the plaintiff's claim for non-material damages and reimbursement of his pre-trial legal costs.

Bonn Regional Court: Schufa's 3-year retention period covered by GDPR

The Bonn Regional Court dismissed the claim. It considered the continued storage of the entries for three years in each case to be covered by Art. 6 para. 1 lit. f GDPR. Furthermore, immaterial damage had not been sufficiently demonstrated.

The plaintiff appealed against this. He claimed that the defendant had not complied with the requirements regarding the storage period, in particular that it should have deleted the data promptly after the claims had been settled. He referred to the case law of the European Court of Justice (ECJ) on the retention period of negative creditworthiness information.

The defendant defended the first instance decision. It referred to its own empirical studies, which showed an increased probability of renewed payment problems even three years after a claim had been settled. It also referred to the new rules of conduct for credit agencies that came into force later.

Reading tip: GDPR violation due to Schufa report

OLG Cologne: Schufa data must be deleted promptly after satisfaction of the claim

The Cologne Higher Regional Court (OLG) partially upheld the plaintiff's appeal and dealt in detail with the requirements for data processing by credit agencies (15 U 249/24).

The court found that the continued storage of information about settled claims beyond the respective settlement violates Art. 6 para. 1 lit. f GDPR. According to this standard, the processing of personal data is only permitted if there is a legitimate interest of the controller or a third party and the interests or fundamental rights and freedoms of the data subject do not outweigh this. The Higher Regional Court found that the plaintiff's legitimate interest in the erasure of his data outweighed this after the claims had been met.

The court attached particular importance to the statutory interpretation of section 882e (3) no. 1 ZPO. According to this, entries in the debtor register must be deleted immediately after the claim has been satisfied. This statutory provision leads to the conclusion that private credit agencies are also obliged to delete corresponding data promptly after satisfaction of the claim in order to avoid contradictions in value with public law registers.

The Higher Regional Court of Cologne referred to the current case law of the European Court of Justice (ECJ, judgments C-26/22 and C-64/22), which had prohibited credit agencies from unlawfully exceeding the retention periods of public registers. This case law is also transferable to entries in the debtor register and comparable private negative data.

The defendant could also not successfully invoke the new rules of conduct approved by the Hessian Data Protection Commissioner pursuant to Art. 40 GDPR. The OLG clarified that such rules of conduct cannot modify or relativize the requirements of the GDPR. Unlawful data processing remains unlawful even if internal rules of conduct are complied with.

Compensation for damages due to continued enrichment

Finally, the OLG affirmed a claim for non-material damages pursuant to Art. 82 para. 1 GDPR. The continued storage and transmission of the settled claims had demonstrably affected the plaintiff's credit rating with various contractual partners. Even if concrete economic disadvantages such as credit refusals could not be proven, the damage to reputation was already sufficient for the award of damages.

The court emphasized that, according to recent ECJ case law, non-material damages have a purely compensatory function. A deterrent or punitive component should not be taken into account. Taking into account all the circumstances of the individual case, the OLG set the compensation for pain and suffering at €500.

In addition, it awarded the plaintiff pro rata pre-trial legal costs.

The appeal was only allowed in favor of the defendant in order to enable the highest court to clarify the question of whether Section 882e (3) No. 1 ZPO also applies to credit agencies. However, the appeal was not allowed for the plaintiff.

Significance for practice

This ruling has far-reaching implications for the practice of credit agencies:

  • Shortened storage periods: Information on settled claims must be deleted promptly in future.

  • Increase in risk: Credit reference agencies are exposed to considerable liability risks if they continue to rely on outdated storage practices.

  • Limited protective effect of rules of conduct: The approval of codes of conduct by data protection supervisory authorities does not provide reliable protection against claims for damages.

  • Clearer demarcation between public and private registers: Data from other sources may also not be stored for longer than the corresponding entries in the public debtor register.

Schufa has already announced that it will appeal against the ruling of the Cologne Higher Regional Court. "The ruling contradicts the regulation approved by the data protection supervisory authorities and deviates from previous case law," explained Schufa in a statement.

Source: Judgment of the Cologne Higher Regional Court dated 10.04.2025 (15 U 249/24)

Tags:
Share this post :
en_USEnglish