[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fhR1cnYpadmqsOmv13NQw3EuaOitE7GWiaDsafBcgdCQ":3},{"article":4,"iocs":52,"watch_terms":53,"solutions":54,"lesson":132},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"3536c32d-87c6-483b-94c1-dfe0c35e2943","‘Shadow database’ scandal: noyb sends SCHUFA cease-and-desist letter; interest list for class action opened","shadow-database-scandal-noyb-sends-schufa-cease-and-desist-letter-interest-list--56cd1f","Credit Scoring In mid-July, investigations by NDR and the SZ revealed that the credit information agency SCHUFA stores millions of data records that should have been deleted long ago. It has since become clear that SCHUFA also uses this data for its customers’ ‘testing purposes’. Potentially, all 69 million people on whom SCHUFA holds data are affected. And SCHUFA continues to stonewall: Even in response to access requests under Article 15 GDPR, the company refuses to disclose this historical data. Given the obvious GDPR violations, noyb has now issued a formal warning to the credit information agency and announced an injunction. Data subjects whose historical data has been withheld by SCHUFA can also register their interest in a future class action for damages. Please keep me updated! Investigations by NDR and the SZ: “Schufa’s ‘shadow database’” SCHUFA’s response: “The truth about the alleged ‘shadow database’” Response from SCHUFA’s lawyer Tim Wybitul on LinkedIn Petition by Algorithm Watch: “Schufa scandal: Delete the shadow database immediately!” SCHUFA and its transparency promise. In Germany, there is virtually no way around SCHUFA. Anyone who wants a loan, a mobile phone contract or a rental apartment must hope that the powerful credit information agency confirms that they have a sufficient credit rating. However, the way in which SCHUFA arrives at its credit scores has always been a black box – and, as a result, has regularly been the subject of criticism and legal proceedings, right up to the European Court of Justice. Recently, SCHUFA launched a ‘transparency campaign’ and has since been celebrating itself for having created ‘complete transparency’. A basement full of ‘deleted’ data. According to the SCHUFA privacy policy, the retention period for data used to calculate the credit score is also to be determined by self-imposed codes of conduct. Debt collection claims or data on settled loans, for example, would be deleted three years after payment. However, ‘deleted’ apparently means something quite different to SCHUFA than it does under the GDPR – and to the general public: the data is apparently only ‘hidden’ and thus disappears from view of consumers, but not from SCHUFA’s systems. Quite the contrary: the data continues to be processed behind the scenes and is even used for third parties’ ‘credit score validations’. Martin Baumann, data protection lawyer at noyb: “SCHUFA’s ‘shadow database’ is a textbook example of unlawful data processing. SCHUFA secretly processes data which, according to its own statements, should have been deleted long ago, and ultimately makes money from doing so.\" Right of access flatly denied. SCHUFA becomes thoroughly inconsistent when it comes to the right of access: on the one hand, SCHUFA claims that the previously unknown ‘shadow database’ is entirely transparent. On the other hand, it admits that data subjects do not receive a copy of the historical data still stored when making an access request under Article 15 GDPR. In essence, SCHUFA argues that data subjects are only interested in which data is currently factored into their score. The data stored secretly therefore does not need to be disclosed. Legally speaking, this is a completely absurd line of reasoning. A company cannot simply limit its obligation to provide information to data which it itself deems ‘of interest’ to data subjects. The European Court of Justice has long since made it clear: a data copy must be a complete, faithful reproduction of all processed data. Marco Blocher, data protection lawyer at noyb: “It is clearly unlawful for SCHUFA to store data that has supposedly been ‘deleted’ in a ‘shadow database’ but not to disclose it. SCHUFA is blatantly breaking the law here – and those in charge at SCHUFA are probably well aware of this.” Hessian supervisory authority remains inactive. In theory, the Hessian Data Protection Authority (HBDI) is supposed to oversee SCHUFA. In fact, the supervisory authority appears to have been aware of the ‘shadow database’ since spring 2025. However, the (notoriously inactive) authority seems to still protect SCHUFA. As a state-approved Qualified Entity, noyb has therefore taken action to protect consumers from SCHUFA’s unrestrained data-hoarding and secrecy. Compliance with the GDPR is now to be restored in several stages: Please keep me updated! Step 1: Cease-and-desist letter and injunction: noyb has today sent a cease-and-desist letter to SCHUFA. With it, noyb requests that the credit information agency ceases to store data beyond the specified retention periods. In addition, noyb requests that SCHUFA provides affected individuals with historical data as part of their access requests and ensures transparency regarding its data processing practices. Should the credit information agency refuse to comply with these requests, noyb will bring an action for an injunction to have SCHUFA’s unlawful practices prohibited by the courts. Max Schrems, Chair of noyb: “Unfortunately, we are increasingly witnessing a breakdown of the public data protection authorities in Germany. We must therefore take legal action as a non-profit organisation acting in the public interest.” Possible step 2: Class action: Data subjects whose data is (or was) stored in the ‘shadow database’ and who have sent an access request under Article 15 GDPR to SCHUFA in recent years may have suffered non-material damages. According to its own information, SCHUFA stores data on more than 69 million people – which is almost the entire adult population in Germany. It appears that 1.6 million people a year have received incorrect responses to their access requests: Historical data wasn’t provided to anyone. Typically, immaterial damages can be estimated at around €500 per person. A class action requires significantly more preparation than an injunction. Nevertheless, noyb has already set up an online interest list. Anyone can sign up here to be informed at a later date, should legal action be taken. As a donation-funded organisation, noyb takes legal action solely in the interests of those affected. Max Schrems, Chair of noyb: “SCHUFA has not only broken the law, it has lied to and harmed those affected. We intend to seek compensation for these damages on a non-profit basis.” A broad civil society front. Other NGOs and data protection experts are also massively criticising SCHUFA and demanding that the ‘shadow database’ be deleted. The NGO AlgorithmWatch has launched a petition against SCHUFA and the data protection authority in Hesse, which has failed to take action. It also provides a form that allows those affected to request specific information about their historical data from SCHUFA. Matthias Spielkamp, AlgorithmWatch: “We and nearly 145,000 signatories to our petition are demanding: SCHUFA must provide those affected with full information; the Hessian Data Protection Authority must finally take action and oblige SCHUFA to permanently delete the ‘shadow database’, and impose the maximum possible fine.” Most recently, several lawyers have also voiced critical views and pointed out possible further consequences: Raphael Rohrmoser, partner at AdvoAdvice Rechtsanwälte: “There have already been countless court cases against SCHUFA concerning the right of access and the right to erasure. It has now emerged that ‘deleted’ data is in fact still extensively available and that nobody was informed. This raises the key question of whether the information provided by SCHUFA in the court proceedings was always accurate.” Peter Hense, partner at Spirit Legal Rechtsanwälte: “If a credit agency passes on data labelled as ‘deleted’ to third parties in return for payment, this may constitute a criminal offense. Perhaps we need the public prosecutor’s office and the courts to finally drain the SCHUFA data swamp.”","German credit agency SCHUFA has been caught maintaining a 'shadow database' containing millions of data records that should have been permanently deleted under GDPR retention policies, while secretly using this data for third-party credit score validations. The company refuses to disclose this historical data in response to Article 15 GDPR access requests, claiming subjects only need current scoring data. noyb has issued a formal cease-and-desist letter and announced injunction proceedings, with plans for a class action covering potentially 1.6 million annual victims claiming €500 immaterial damages each.","SCHUFA faces cease-and-desist for storing 69M Germans' 'deleted' data in illegal shadow database.","https:\u002F\u002Fnoyb.eu\u002Fen\u002Fshadow-database-scandal-noyb-sends-schufa-cease-and-desist-letter-interest-list-class-action","https:\u002F\u002Fnoyb.eu\u002Fsites\u002Fdefault\u002Ffiles\u002Fstyles\u002Ffacebook\u002Fpublic\u002F2026-08\u002Fschufa_header1.png?h=0abb521b&itok=Nmsn5ytm","2026-08-26T04:00:00+00:00","2026-08-26T08:00:20.964705+00:00",9,[17,20,22,24],{"name":18,"type":19},"SCHUFA","vendor",{"name":21,"type":19},"noyb (None of Your Business)",{"name":23,"type":19},"AlgorithmWatch",{"name":25,"type":19},"Hessian Data Protection Authority (HBDI)","3f0f8451-91df-4b6c-9a73-ef3b2509b7f1",{"id":26,"icon":28,"name":29,"slug":30},null,"GDPR","gdpr",[32,37,42,47],{"category":33},{"id":34,"icon":28,"name":35,"slug":36},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":38},{"id":39,"icon":28,"name":40,"slug":41},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":43},{"id":44,"icon":28,"name":45,"slug":46},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":48},{"id":49,"icon":28,"name":50,"slug":51},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",[],[18,21,23],{"controls":55,"vendors":131},[56,85,114],{"slug":57,"name":58,"problem":59,"products":60},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[61,69,77],{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-dlp","Netskope DLP","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention for web, cloud apps, AI tools and endpoints.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",{"slug":86,"name":87,"problem":88,"products":89},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[90,98,106],{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"utimaco","Utimaco","\u002Fvendor-logos\u002Futimaco.png","utimaco-hsm","Utimaco General Purpose HSM","https:\u002F\u002Futimaco.com\u002Fdata-protection\u002Fgp-hsm","Hardware security modules for key generation, storage and cryptographic operations.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"thales","Thales","\u002Fvendor-logos\u002Fthales.png","ciphertrust","CipherTrust Data Security Platform","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fdata-security-platform","Data discovery, encryption and central key management across on-premises and cloud.",{"slug":115,"name":116,"problem":117,"products":118},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",[119,125],{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":120,"product_name":121,"url":123,"description":124},"drata","Drata","\u002Fvendor-logos\u002Fdrata.png","https:\u002F\u002Fdrata.com\u002F","Continuous control monitoring and audit readiness across security frameworks.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":126,"product_name":127,"url":129,"description":130},"vanta","Vanta","\u002Fvendor-logos\u002Fvanta.png","https:\u002F\u002Fwww.vanta.com\u002F","Automated evidence collection and continuous monitoring for ISO 27001, SOC 2, NIS2 and other frameworks.",[],{"slug":133,"title":134,"body":135,"framework_refs":136,"framework_notes":148},"schufas-hidden-shadow-database-exposes-gdpr-retention-failures","SCHUFA's Hidden 'Shadow Database' Exposes GDPR Retention Failures","SCHUFA, Germany's largest credit agency, was found secretly retaining millions of records that should have been permanently deleted under GDPR data retention policies, effectively operating a hidden 'shadow database' outside of its disclosed data processing activities. The company compounded the violation by using this unlawfully retained data for third-party credit score validations without data subjects' knowledge, and then refused to disclose it in response to legally mandated Article 15 access requests. This case illustrates how data retention obligations are not merely administrative formalities — failure to enforce deletion schedules can expose individuals to invisible, ongoing harm from data they believe no longer exists. With up to 1.6 million potential victims and a class action looming, the financial and reputational consequences of treating GDPR compliance as optional are severe and systemic.",[137,138,139,140,141,142,143,144,145,146,147],"GDPR Article 5(1)(e) – Storage Limitation Principle","GDPR Article 15 – Right of Access by the Data Subject","GDPR Article 17 – Right to Erasure ('Right to be Forgotten')","GDPR Article 30 – Records of Processing Activities (RoPA)","GDPR Article 83 – Administrative Fines","NIST SP 800-53 SI-12 – Information Management and Retention","NIST SP 800-53 AU-11 – Audit Record Retention","NIST Privacy Framework PR.DS-P4 – Data Retention and Disposal","CIS Control 3 – Data Protection (Data Retention and Disposal)","ISO\u002FIEC 27001:2022 Annex A 8.10 – Information Deletion","ITIL Service Design – Information Security Policy (Retention & Disposal)",{}]