
SCHUFA shadow database: what data subjects should know
SCHUFA is alleged to continue processing data that has supposedly been deleted. What is known, what Art. 15 and 17 GDPR require and what data subjects can do.
Read articleA debt collection agency reports a claim to SCHUFA before the deadline for filing an objection has even expired. In 2025, the BGH (Federal Court of Justice) decided how easily the resulting damage can be proven.
In July 2019, a debt collection agency (Inkasso) reported an electricity supplier's claim to SCHUFA, on the very same day on which the enforcement order (Vollstreckungsbescheid) against the customer was issued. The deadline for an objection could therefore not yet have expired. The customer claimed that the report had led to terminated credit card agreements, a threatened termination of his account and a failed property financing.
The Mainz Regional Court (Landgericht) awarded him EUR 5,000 in damages. The Koblenz Higher Regional Court (OLG), by contrast, dismissed the action because he had not sufficiently proven damage. In its judgment of 13 May 2025 – VI ZR 67/23, the BGH (Federal Court of Justice) set that judgment aside and referred the case back.
Two points are important. First, the report was unlawful because the debt collection agency should at least have waited for the deadline for an objection to the enforcement order to expire. Second, no excessive requirements may be imposed on demonstrating non-material damage under Art. 82 GDPR. Anyone who describes specific negative consequences of the report, such as terminated credit cards, does not have to prove any particular seriousness.
For data subjects, this means: record what consequences the entry had, such as rejected contracts, terminated cards or refused loans, and keep the relevant letters. This is the basis for a later claim for damages, the amount of which depends on the individual case.
Affected by a SCHUFA entry? Take the SCHUFA check and instruct me directly.

SCHUFA is alleged to continue processing data that has supposedly been deleted. What is known, what Art. 15 and 17 GDPR require and what data subjects can do.
Read article
Art. 13 Data Act reviews unilaterally imposed data clauses between businesses: scope, black and grey list, legal consequences.
Read article
The BGH sets out what determines the amount of GDPR damages: punitive character or deterrence are not criteria.
Read article