Latham & Watkins Scores Major GDPR Victory for SCHUFA Before German Federal Court of Justice

Today, the German Federal Court of Justice (BGH) ruled on the permissible duration for storing personal data relating to settled payment delinquencies of borrowers. The plaintiff argued that SCHUFA had retained personal data concerning his creditworthiness for longer than permitted under the EU General Data Protection Regulation (GDPR). The case concerned information on settled payment delinquencies. He claimed to have suffered non-material harm as a result and sought compensation from SCHUFA under Article 82 GDPR.

SCHUFA stores data on settled payment delinquencies in accordance with the applicable code of conduct governing review and retention periods for personal data used by German credit rating agencies. As a rule, the code of conduct provides for storage for three years after the settlement of the delinquency, with exceptions for individual cases. This code has been coordinated with all German data protection authorities and approved by the competent supervisory authority pursuant to Article 40 GDPR.

Today, the BGH ruled in favor of Latham’s client. As a result, lenders can continue to assess their customers’ creditworthiness. The BGH held that the code of conduct “generally provides for an appropriate balancing of interests.”

If data on settled payment delinquencies were no longer available to the economy, consumers in Germany would face higher hurdles in obtaining credit, resulting in fewer loans. Ultimately, this would also lead to higher interest rates and weaker protection for consumers against over-indebtedness.

Wolf-Tassilo Böhm, data law counsel at Latham & Watkins, said, “With today’s judgment, the Federal Court of Justice has confirmed SCHUFA’s existing data retention practices. Our client processes personal data in accordance with the requirements of the GDPR and the credit rating agencies’ code of conduct. The Federal Court of Justice thereby confirms the view of the data protection authorities, the prevailing case law of the regional and higher regional courts, and our arguments that settled payment delinquencies may, as a rule, be stored for up to three years.”

Tim Wybitul, data law partner at Latham & Watkins, said, “We welcome the judgment. It brings clarity and legal certainty and provides the credit industry with an appropriate framework for assessing borrowers’ creditworthiness. The BGH confirms that the code of conduct applied by SCHUFA generally represents an appropriate balance of interests. The judgment thus also enables consumers to access affordable credit more easily and strengthens the overall business environment. The German legislature should now, like the BGH, use the code of conduct as a guiding framework for appropriate regulation.”

The Latham team was led by Frankfurt data law partner Tim Wybitul and counsel Wolf-Tassilo Böhm, with associate Thies Schmitte. Advice was also provided on litigation matters by associate Lisa Hoops.