SCHUFA report without a payment default: is positive data lawful?

The case

A customer had concluded a mobile phone contract in 2018. In January 2022, his provider transferred his name, gender, address, date and place of birth, as well as the start, end and number of this contract, to SCHUFA — as so-called positive data (Positivdaten), without there ever having been a payment default. The customer only found out about this through a later request for access to his data (Selbstauskunft) and sued for damages and an injunction.

The Lübeck Regional Court (Landgericht) initially found partly in his favour and awarded EUR 400 in non-material damages. Its reasoning: although the provider had a legitimate interest in the report, in particular for fraud prevention, in the balancing of interests the customer's right to informational self-determination prevailed. A general reference in the data protection information sheet at the time the contract was concluded was not sufficient as consent, and the loss of control over one's own data already constituted compensable damage.

The OLG's decision

In its decision of 10 July 2025 – 5 U 28/25, the Schleswig-Holstein Higher Regional Court (OLG) set this judgment aside and dismissed the action in its entirety. Its reasoning: in the mobile phone business, it is customary to provide customers, together with a contract, with discounted high-quality devices that are paid off via the monthly bill. This makes this business model particularly vulnerable to persons concluding several contracts within a short time under a false identity, solely in order to obtain the devices. Because, in the case of a false identity, there can by its nature be no payment default, an evaluation of negative data alone does not help here — only checking whether, and how often, a person concludes contracts in quick succession reveals this pattern.

The court therefore considers the transfer of such unremarkable contract data to be a suitable and necessary means of fraud prevention, for which no equally effective, less intrusive alternative is apparent. In the balancing of interests, it additionally weighed in the provider's favour that the data transferred was not very sensitive, had no stigmatising effect and was made accessible only to a narrowly limited group — unlike, for example, in the case of a data leak. The court therefore did not need to examine damage at all.

An open question

This leaves open another question of practical importance: what applies if a credit agency additionally uses such positive data, reported for fraud prevention, for the general assessment of creditworthiness (scoring)? The Lübeck Regional Court has since referred precisely this question to the CJEU (Court of Justice of the European Union). Until it has ruled, the legal position on this point remains unresolved. Anyone who wants to know which data about them is stored at SCHUFA and for what purposes it is used should continue to request access under Art. 15 GDPR.

Affected by a SCHUFA entry? Take the SCHUFA check and instruct me directly.