
SCHUFA shadow database: what data subjects should know
SCHUFA is alleged to continue processing data that has supposedly been deleted. What is known, what Art. 15 and 17 GDPR require and what data subjects can do.
Read articleEven people who always pay on time can appear at SCHUFA: mobile operators report the conclusion and the end of contracts. In October 2025, the BGH (Federal Court of Justice) ruled that this can be lawful.
Positive data (Positivdaten) is information that does not contain any payment default, for example that a mobile phone contract was concluded or terminated. A mobile operator had transferred such data on customers with postpaid contracts to SCHUFA, together with master data such as their names. The consumer advice centre of North Rhine-Westphalia (Verbraucherzentrale Nordrhein-Westfalen) brought a representative action (Verbandsklage) demanding that it cease doing so.
In its judgment of 14 October 2025 – VI ZR 431/24, the BGH (Federal Court of Justice) dismissed the action, thereby upholding the decisions of the Düsseldorf Regional Court (Landgericht) of 6 March 2024 and of the Düsseldorf Higher Regional Court (OLG) of 31 October 2024 – 20 U 51/24. Under Art. 6(1)(f) GDPR, the transfer can be justified by the legitimate interest in fraud prevention, in particular to prevent identity deception and large numbers of contracts being concluded with different providers in order to obtain expensive devices. In addition, the application for an injunction was too broadly worded, because it would also have covered conduct that is unobjectionable under data protection law.
Important for putting this in context: the BGH decided on a representative action, not on an individual customer's claim for damages. The conference of the data protection supervisory authorities (Datenschutzkonferenz) generally takes a critical view of the reporting of positive data by companies outside the credit industry. The Lübeck Regional Court (Landgericht) has referred questions on this to the CJEU (Court of Justice of the European Union) (Case C-594/25), which, to my knowledge, have not yet been decided.
What you can do: with a request for access under Art. 15 GDPR (Selbstauskunft), you can find out which data about you is stored at SCHUFA and where it comes from. Whether a claim nevertheless exists in an individual case, for example for erasure or damages, depends on the specific circumstances.
Affected by a SCHUFA entry? Take the SCHUFA check and instruct me directly.

SCHUFA is alleged to continue processing data that has supposedly been deleted. What is known, what Art. 15 and 17 GDPR require and what data subjects can do.
Read article
Art. 13 Data Act reviews unilaterally imposed data clauses between businesses: scope, black and grey list, legal consequences.
Read article
The BGH sets out what determines the amount of GDPR damages: punitive character or deterrence are not criteria.
Read article