German Federal Court of Justice Upholds SCHUFA Data Retention Under GDPR

Latham & Watkins represented SCHUFA in litigation before the German Federal Court of Justice concerning the permissible retention period for personal data on settled payment delinquencies under the EU General Data Protection Regulation (GDPR). The case arose after a plaintiff challenged SCHUFA’s retention of information on settled payment delinquencies, arguing that SCHUFA had held personal data on his creditworthiness for longer than permitted under the GDPR and seeking compensation under Article 82 GDPR for non-material harm. SCHUFA stores such data in accordance with the applicable code of conduct governing review and retention periods for personal data used by German credit rating agencies. That code generally provides for storage for three years after settlement of the delinquency, with exceptions for individual cases, and has been coordinated with German data protection authorities and approved by the competent supervisory authority pursuant to Article 40 GDPR. The German Federal Court of Justice (BGH) ruled in favor of SCHUFA, holding that the code of conduct generally provides an appropriate balancing of interests and that SCHUFA’s existing data retention practices comply with the GDPR. The court noted that removing access to data on settled delinquencies would raise hurdles for consumers seeking credit, likely resulting in fewer loans, higher interest rates and weaker protection against over-indebtedness. The decision thereby preserves lenders’ ability to assess borrowers’ creditworthiness and provides clarity and legal certainty for the credit industry. Latham & Watkins represented SCHUFA with a team composed by: Tim Wybitul (partner, data law), Wolf-Tassilo Böhm (counsel, data law), Thies Schmitte (associate) and Lisa Hoops (associate, litigation).

German Federal Court of Justice Upholds SCHUFA Data Retention Under GDPR

Read the full story