Noyb Targets Schufa Over Alleged Shadow Database
Noyb, the European Centre for Digital Rights, has formally challenged Schufa’s alleged retention and use of historical consumer data. The Vienna-based privacy organization claims that Germany’s largest credit-scoring agency maintains a database of information that should have been erased under applicable retention periods, including records relating to past loans and personal insolvencies.
According to Noyb, the allegedly retained information continues to be processed and made available for creditworthiness assessments used by banks, landlords, and other businesses. German media reports in July described the alleged system as a “shadow database,” suggesting that data marked for deletion may still affect individuals’ financial profiles.
Noyb argues that the practice may breach the EU General Data Protection Regulation, particularly the principles of storage limitation, transparency, and lawfulness of processing. It also alleges that Schufa has failed to provide individuals with complete access to historical data on request, potentially violating the GDPR right of access under Article 15.
The organization has issued a formal notice requiring Schufa to stop retaining data beyond lawful periods and to disclose historical data when requested by affected individuals. If Schufa does not comply, Noyb has indicated that it may seek a court injunction and consider collective litigation for compensation.
Schufa rejects the allegations. It states that its historical-data processing complies with legal and regulatory requirements and argues that deletion would harm consumers and the wider economy. The dispute could become an important test of how GDPR rules on retention, access rights, and automated credit scoring apply to commercial credit-reference agencies.
