According to reports by NDR and the Süddeutsche Zeitung, Schufa, Germany’s largest credit bureau, has been storing aging consumer data from millions of individuals for significantly longer periods than previously understood. This sensitive information is reportedly used by the company for various tests, and the outcomes of these tests are then shared with businesses. Crucially, those whose data is held are not informed about this practice, and prior to these findings, the scope of the hidden database had been largely unknown even within professional circles.
The database primarily holds information that consumers previously believed had been permanently deleted from records, including what are presumably old credit accounts and credit cards, records of debt collections and personal insolvency, and debts that individuals had settled many years ago. This repository allows Germany’s foremost economic information agency to calculate, among other things, the effectiveness of newly developed scoring systems.
Schufa, which already holds data on more than 68 million Germans, plays a critical role in daily life because its ‘Schufa Score’ often determines whether a person can secure a cellular contract or a loan. The company maintains that this additional storage of historical data is legally compliant, citing relevant regulations.
However, consumer protection advocates and legal experts disagree. Several specialists interviewed by NDR and the SZ point out the mandated statutory deletion periods and criticize the practice as violating the GDPR principle of data minimization. They raise particular alarm regarding the dissemination of antiquated scores to commercial partners, especially non-banking entities such as energy providers or telecommunications companies. Furthermore, experts strongly criticize the fact that customers are entirely unaware that their older data is being retained. The Hessian State Data Protection Commissioner is now also examining the situation, currently investigating whether Schufa is legally required to inform consumers about this data retention practice.
