Skip to content
News · noyb - European Center for Digital Rights EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

‘Shadow database’ scandal: noyb sends SCHUFA cease-and-desist letter; interest list for class action opened

Credit Scoring In mid-July, investigations by NDR and the SZ revealed that the credit information agency SCHUFA stores millions of data records that should have been deleted long ago.

Full text

Credit Scoring In mid-July, investigations by NDR and the SZ revealed that the credit information agency SCHUFA stores millions of data records that should have been deleted long ago. It has since become clear that SCHUFA also uses this data for its customers’ ‘testing purposes’. Potentially, all 69 million people on whom SCHUFA holds data are affected. And SCHUFA continues to stonewall: Even in response to access requests under Article 15 GDPR, the company refuses to disclose this historical data. Given the obvious GDPR violations, noyb has now issued a formal warning to the credit information agency and announced an injunction. Data subjects whose historical data has been withheld by SCHUFA can also register their interest in a future class action for damages. Please keep me updated! Investigations by NDR and the SZ: “Schufa’s ‘shadow database’”SCHUFA’s response: “The truth about the alleged ‘shadow database’”Response from SCHUFA’s lawyer Tim Wybitul on LinkedInPetition by Algorithm

How it connects

C/09/697386 / HA ZA 26-52 Den Haag District Court: 51 gamblers sue Unibet operator Risepoint over unanswered GDPR The District Court of The Hague (the Court) considered an action brought by 51 individuals who had participated in online gambling offered through the website Unibet before 1… Rb. Den Haag Sep 2, 2026 Right of Access Personal Data Data Portability