‘Shadow database’ scandal: noyb sends SCHUFA cease-and-desist letter; interest list for class action opened

Credit Scoring In mid-July, investigations by NDR and the SZ revealed that the credit information agency SCHUFA stores millions of data records that should have been deleted long ago.

Right of Access Procedures Personal Data

Aug 26, 2026Sourcenoyb.eu

Full text

Credit Scoring In mid-July, investigations by NDR and the SZ revealed that the credit information agency SCHUFA stores millions of data records that should have been deleted long ago. It has since become clear that SCHUFA also uses this data for its customers’ ‘testing purposes’. Potentially, all 69 million people on whom SCHUFA holds data are affected. And SCHUFA continues to stonewall: Even in response to access requests under Article 15 GDPR, the company refuses to disclose this historical data. Given the obvious GDPR violations, noyb has now issued a formal warning to the credit information agency and announced an injunction. Data subjects whose historical data has been withheld by SCHUFA can also register their interest in a future class action for damages. Please keep me updated! Investigations by NDR and the SZ: “Schufa’s ‘shadow database’”SCHUFA’s response: “The truth about the alleged ‘shadow database’”Response from SCHUFA’s lawyer Tim Wybitul on LinkedInPetition by Algorithm

How it connects

Related across sources

€100,000 HDPA fines Teleperformance for failing to properly handle employee access request The DPA received a complaint from a former employee of the Service 800 Teleperformance Single Member S.A. (the controller), after the controller failed to comply with the data… Greece ·Art. 5, 12, 13 +3 Personal Data Right of Access Storage Limitation

C/16/608667 / HA RK 26-54 The data subject was involved in disputes with a school organisation ("controller") Those disputes concerned a communication ban, their membership in a participation council, and their internship. The data subject submitted an access request under Article 15… C/16/608667 / HA RK 26-54 ·Rb. Midden-Nederland Sep 22, 2026 Right of Access Personal Data Controllers

W101 2326836-1 40 natural persons submitted access requests to a mobile communications provider (controller) via an attorney Some of these persons were (former) customers of the controller, others have never been in a contractual relationship with the controller. In the access requests, the data… BVwG - W101 2326836-1 ·Federal Administrative Court Oct 2, 2026 Personal Data Right of Access Right to Restriction

C/09/697386 / HA ZA 26-52 Den Haag District Court: 51 gamblers sue Unibet operator Risepoint over unanswered GDPR The District Court of The Hague (the Court) considered an action brought by 51 individuals who had participated in online gambling offered through the website Unibet before 1… Rb. Den Haag Sep 2, 2026 Right of Access Personal Data Data Portability

Danish DPA finds employer unlawfully refused former employee's access request The DPA received a complaint from a former employee (data subject) of the controller concerning the refusal of an access request. More specifically, the data subject was dismissed… 2025-31-2078 ·Denmark ·Datatilsynet (DK) Sep 24, 2026 Right of Access Personal Data Supervisory Authorities

2984/2026 Bulgaria SAC: Controller must provide copies of loan documents under GDPR Art. 15 access The data subject requested that a Bulgarian non-banking financial institution specialized in providing online fast loans and installment loans (the controller) provide copies of… Oct 13, 2026 Controllers Right of Access Personal Data