20260718 Auch Schufa muss Datensparsamkeit beachten

Delete the shadow database!

Actually, Schufa — a private company that holds nearly all the important financial data on almost everyone in Germany — should become more transparent. You can now ask Schufa what your personal score is. Even if it refuses to disclose its method for calculating personal scores — as many have demanded — it should no longer take ancient data into account. That data should be deleted and made inaccessible to everyone.

However, Netzpolitik.org writes: Schufa, the country’s largest credit bureau, maintains — in addition to its current data — a “shadow database” containing historical and outdated data on millions of people. This was uncovered by a joint investigation by NDR and the Süddeutsche Zeitung. The data includes “garnishments and personal bankruptcies, as well as debts that those affected often settled years ago.”

If such data is considered “outdated” and is no longer disclosed upon request, then it must not continue to be stored. This follows from the principle of data minimization, which is established in the GDPR. Schufa claims to use this data to test the reliability of its algorithms for calculating credit scores. An easily created test dataset with a few thousand virtual test users would suffice for this purpose — there is no need for a database containing millions of real people.

Campact has launched a petition on WeAct demanding that the old shadow database be deleted immediately. This is also required by German and European data protection law.