German data-rights group noyb warns SCHUFA over shadow database

What happened

• Investigations by NDR and SZ uncovered that SCHUFA retains millions of credit records past the legally required deletion period.
• The agency uses the retained data for testing and third‑party credit‑score validation.
• SCHUFA has refused GDPR Article 15 access requests for the historic data. noyb issued a formal warning and announced an injunction, while opening a register for potential class‑action claimants.

Why it matters

Other credit bureaus and data controllers must audit legacy data stores to confirm that records are fully erased, not merely hidden, once retention periods expire.

Business impact

Failure to delete or properly anonymise outdated records could trigger enforcement actions by data‑protection authorities and expose organisations to class‑action liability.

What to check

1. 1

   audit legacy data storesHigh priority

   Identify any personal data retained beyond the GDPR‑specified retention period and verify it is permanently deleted.

2. 2

   update retention policiesHigh priority

   Align internal data‑deletion schedules with GDPR requirements and document the process for regulator review.

3. 3

   enhance access‑request proceduresMedium priority

   Ensure that all stored personal data, including archived or hidden records, is disclosed when a lawful Article 15 request is received.