The Landgericht Bamberg has declared the automated scoring process of SCHUFA Holding AG incompatible with the General Data Protection Regulation (GDPR) in a significant ruling. The court awarded a plaintiff €1,000 in damages, marking a pivotal moment in the ongoing debate over data privacy and consumer rights in Germany.
At the heart of the ruling is the court's assertion that the exclusive reliance on algorithmically determined credit scores, particularly the basic score and specific sector scores, violates Article 22 of the GDPR. This article stipulates that individuals have the right not to be subject to decisions based solely on automated processing, which significantly affects them.
The decision also prohibits companies, landlords, or credit institutions from receiving scores generated solely through automated data processing. This ruling follows a December 2023 decision by the European Court of Justice (ECJ), which found that automated assessments of creditworthiness, without human intervention, and which serve as a substantial basis for contractual decisions, are generally inadmissible under the GDPR.
This landmark judgment is the first time a German court has established that SCHUFA's practices constitute a violation of existing data protection laws. It opens the door for individuals to seek compensation for damages resulting from the company’s automated scoring practices.
The SCHUFA score, which assesses a person's risk of default, ranges from 0% to nearly 100%. Scores above 97.5% are deemed low risk, while those below 90% are considered high risk. Consumers are now advised to request a self-disclosure from SCHUFA under Article 15 of the GDPR to verify the accuracy of their stored data.
In light of the recent ruling, consumers should also file a written request for data deletion under Article 17 of the GDPR if they find that a settled claim is still recorded in their SCHUFA report. Legal experts suggest that individuals consult with legal professionals to explore potential claims for immaterial damages due to unlawful data storage practices.
Furthermore, the ruling strengthens consumer rights significantly in the realm of data protection. Regularly checking one’s SCHUFA report and taking immediate action against any unlawful entries is now more crucial than ever. Only by asserting their rights can consumers hope to rectify any injustices and prevent further legal losses.
Currently, all legal protection insurers in Germany cover costs associated with legitimate actions against SCHUFA. There is also the option of litigation financing, allowing individuals without legal protection insurance to challenge the corporation without financial risk.
Legal representatives like Klamert & Partner Rechtsanwälte in Munich are already involved in over 15,000 cases across Germany, advocating for affected consumers and establishing themselves as leaders in consumer rights issues.
In a related development, the Oberlandesgericht (OLG) Cologne has ruled that consumers who have fully paid their debts can demand the immediate deletion of negative SCHUFA entries. This ruling marks a significant shift from the previous three-year storage period for settled claims.
The OLG Cologne determined that a completed payment is sufficient grounds for immediate deletion, irrespective of whether the entry could have initially been recorded in the public debtor register. This decision stems from a case where a consumer sued SCHUFA for retaining information about three undisputed claims even after they had been paid off.
In this case, the consumer had settled a claim of €150 in December 2020, €428.27 in November 2021, and €160.99 in December 2022. After filing a lawsuit in November 2023 for deletion and €1,500 in damages, the consumer found that SCHUFA had deleted the entries after the usual three-year period. However, the consumer sought compensation for the prolonged storage of these entries.
The court ruled in favor of the consumer, awarding €500 in damages for the unlawful retention of data and €540.50 in attorney's fees. This ruling aligns with the European Court of Justice's earlier decision that private credit agencies cannot retain information about debt relief longer than public insolvency registers.
Both the OLG Cologne and the Landgericht Aachen have now reinforced that credit agencies must delete completed entries immediately. The LG Aachen, in a ruling from April 17, 2025, echoed the OLG Cologne's stance, declaring that retaining paid debts for an extended period is unlawful.
The LG Aachen's decision, while not yet final, reflects a growing trend in judicial rulings favoring consumer rights. The court emphasized that internal storage rules of credit agencies must comply with higher-ranking data protection laws.
As these legal battles unfold, consumers are encouraged to proactively monitor their SCHUFA entries and pursue deletion of any unjustified negative records. Legal experts recommend that individuals seek assistance from legal firms specializing in consumer rights to navigate this evolving landscape.
In conclusion, the recent rulings from both the Landgericht Bamberg and the OLG Cologne represent a significant shift in how consumer rights are protected in Germany, particularly regarding automated data processing by credit agencies like SCHUFA. These decisions not only empower consumers but also set a precedent for future legal actions against similar practices in the industry.
