German Federal Court Examines Schufa's Data Storage Practices for Payment Defaults

Federal Court of Justice Hears Arguments on Schufa Data Retention

The Federal Court of Justice (BGH) in Germany convened on November 6, 2025, in Karlsruhe, to deliberate on the contentious issue of how long credit agencies, specifically Schufa Holding AG, are permitted to store information regarding settled payment defaults. This high-profile case could significantly impact data protection standards for millions of German consumers.

Background of the Legal Challenge

The BGH's examination stems from an appeal lodged by Schufa against a ruling by the Cologne Higher Regional Court (OLG Köln). On April 10, 2025, the OLG Köln determined that fully settled payment defaults must be deleted immediately from Schufa's database, rather than being retained for a standard period of three years. This decision by the OLG Köln was influenced by a prior ruling from the European Court of Justice (ECJ) on December 7, 2023. The ECJ had clarified that it is contrary to the General Data Protection Regulation (GDPR) for private credit agencies to maintain data related to the discharge from remaining debts for a longer duration than public insolvency registers. Public registers typically hold such information for six months, while Schufa's internal code of conduct has historically stipulated a three-year retention period for settled payment defaults.

Schufa's Stance and Economic Implications

Schufa, Germany's largest credit agency, argues that a shorter storage period for settled payment defaults would have detrimental effects on the economy. The company contends that such a change would impair its ability to accurately assess creditworthiness, potentially leading to higher interest rates and a reduction in the availability of loans. Schufa highlights that individuals who have previously settled overdue debts statistically present a significantly higher risk of encountering future payment difficulties compared to those who consistently meet their obligations. Deleting this historical data prematurely, they argue, would create an artificially positive credit profile, thereby increasing risk for lenders and potentially leading to increased payment defaults across the financial sector.

GDPR and Data Retention Framework

The legal landscape surrounding data retention for credit agencies has evolved with the introduction of the GDPR in 2018. Unlike the previous Federal Data Protection Act (BDSG), the GDPR does not specify fixed retention periods. Instead, the current three-year retention period for settled payment defaults is based on a 'Code of Conduct for Review and Storage Periods,' which was developed by credit agencies in Germany and approved by data protection supervisory authorities. Furthermore, a '100-day rule' came into effect on January 1, 2025, offering a mechanism to shorten the retention period to 18 months under specific conditions, particularly if a payment default is resolved swiftly.

Awaiting the BGH's Decision

The BGH has not yet issued its verdict, and the date for the final decision remains unannounced. The outcome of this case is eagerly anticipated, as it will establish a definitive legal precedent for data retention practices by credit agencies in Germany, balancing consumer data protection rights with the interests of the financial industry. The ruling is expected to provide much-needed clarity on the interpretation of GDPR principles in the context of credit scoring and data storage.