SCHUFA shadow database: what data subjects should know

What is known

According to investigations by NDR and SZ and statements by the organisation noyb, SCHUFA continues to store data that, under its own deletion deadlines, should long since have ceased to be visible. According to these reports, the data is merely "hidden" and continues to be processed internally — according to noyb, also for analyses for customers. SCHUFA rejects the allegations. noyb has sent it a formal warning letter (Abmahnung) and announced an action for an injunction. No court has yet decided whether the practice is unlawful.

Legal framework

Two points are decisive. First, Art. 17 GDPR requires actual erasure. Merely hiding data in the database is generally not sufficient for this if the data continues to be processed. Second, access under Art. 15 GDPR must cover all data processed. The CJEU (Court of Justice of the European Union) has described the copy of the data as a complete and faithful reproduction (C‑487/21).

What data subjects can do

Anyone who wants to know what is stored about them can request access from SCHUFA under Art. 15 GDPR and check whether it also includes older, apparently deleted entries. Whether this gives rise to claims for erasure or for damages under Art. 82 GDPR depends on the individual case.

If the information provided remains incomplete or an entry is a burden for you, I will be happy to examine what can be done about it.

This article is for general information purposes only and does not replace advice in an individual case.

Affected by a SCHUFA entry? Take the SCHUFA check and instruct me directly.