# BGH - I ZR 97/25
(This appears to be a legal citation and doesn't require translation.)

- Type: News
- Source: GDPRhub
- Date: 2026-01-07
- Canonical: https://overview.legal/posts/51957
- Topics: Storage Limitation, Retention Period, Legitimate Interest, Controllers, Law Enforcement

## Summary

Facts: The court has ruled that the data retention period for information regarding completed payment defaults by private credit agencies is not automatically limited by rules for deleting data from debtor registers, and that codes of conduct based on the GDPR (General Data Protection Regulation) can serve as a guideline when balancing interests in accordance with Article 6(1)(f) of the GDPR. The Federal Court of Justice has determined that the maximum retention period for data relating to a payment default that has already been resolved by a credit information agency is not limited by national rules for deleting data from a public debtor register.

## Full text

Facts: The court ruled that the retention period for data regarding completed payment defaults by private credit information agencies is not automatically limited by rules for deleting data from a debtor file, and that codes of conduct based on the GDPR (General Data Protection Regulation) can serve as a guideline for balancing interests in accordance with Article 6(1)(f) of the GDPR. The Federal Court of Justice has determined that the maximum retention period for data regarding a payment default that has already been resolved by a credit information agency is not limited by national rules for deleting data from a public debtor file. Summary in English: The responsible party, SCHUFA Holding AG, operates a credit information agency that collects and stores information about payment defaults reported by its contractual partners, with the aim of assessing the creditworthiness of consumers. The responsible party, SCHUFA Holding AG, operates a credit information agency that collects and stores information about payment defaults reported by its contractual partners, with the aim of assessing the creditworthiness of consumers. --- *This content has been automatically translated using machine translation. The original version is available in the source language.* --- *This content was automatically translated using machine translation. The original version is available in the source language.*

## Cited law provisions (1)

### GDPR — gdpr-art-6-par-1-pnt-f-en

processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

---
Generated by overview.legal · https://overview.legal/posts/51957 · 2026-08-22