‘Shadow database’ scandal: noyb sends SCHUFA cease-and-desist letter; interest list for class action opened

SCHUFA, Germany's largest credit agency, was found secretly retaining millions of records that should have been permanently deleted under GDPR data retention policies, effectively operating a hidden 'shadow database' outside of its disclosed data processing activities. The company compounded the violation by using this unlawfully retained data for third-party credit score validations without data subjects' knowledge, and then refused to disclose it in response to legally mandated Article 15 access requests. This case illustrates how data retention obligations are not merely administrative formalities — failure to enforce deletion schedules can expose individuals to invisible, ongoing harm from data they believe no longer exists. With up to 1.6 million potential victims and a class action looming, the financial and reputational consequences of treating GDPR compliance as optional are severe and systemic.