Observed Signal · Aug 27, 2026 · Legal Action · Source: t3n · Impact: 3/5 · Sentiment: Negative
Noyb sues Schufa over 'shadow database'
The Austrian privacy NGO Noyb has announced a collective legal action against Germany's credit bureau Schufa, alleging the company stores historical financial data far longer than declared and therefore breaches the EU General Data Protection Regulation (GDPR). Investigations by NDR and the Süddeutsche Zeitung revealed a so-called "shadow database" containing historical payment records going back many years and kept for up to ten years. Noyb demands that Schufa stop the practice and has set a September 9 deadline for a cease-and-desist declaration; it also plans to seek damages for affected individuals. Schufa says it uses older records for product development and score validation and disputes the claim, indicating it will defend itself in court up to the Federal Court of Justice (Bundesgerichtshof). The article notes Schufa holds data on about 68 million people and that a Hessian data-protection authority has been investigating the matter since last year.
Alleged GDPR violations by a major data broker (Schufa) could set precedents for data retention and lawful use of historical consumer records; relevant to identity/data-provider practices across advertising and data-broker industries.
Track NDR Signals & Market Shifts in Real-Time
Polaris7 autonomous intelligence agents track regulatory filings, primary sources, executive changes, and deal flow 24/7. Create your free Explorer workspace to monitor these entities.
Key Takeaways & Evidence Grounding
- Noyb announced a collective (class) lawsuit against Schufa over its "shadow database".
- Investigations by NDR and the Süddeutsche Zeitung revealed Schufa stores historical payment data, in some cases for up to ten years.
- Noyb set a deadline of 9 September for Schufa to sign a cease-and-desist declaration and also plans to claim damages for affected individuals.
- Schufa says it uses the older data internally for product development and score testing and intends to defend itself, potentially up to the Bundesgerichtshof (BGH).
- Schufa reports holding data on about 68 million people.
Connected Companies & Entities
4 Entities mapped“Research by NDR and the Süddeutsche Zeitung in July disclosed the existence of the shadow database....”
“TargetVideo GmbH is named as a third-party provider supplying external content embedded in the article's editorial pages....”
“The article was published on the t3n website, which reported the story and linked related coverage....”
Ontology Mapping & Concepts
Related Market Signals & Shifts
Recent verified developments and strategic activity across this market segment.
Schufa stores more consumer financial data than thought
Investigations by NDR and Süddeutsche Zeitung revealed that German credit bureau Schufa maintains a separate archive of historical payment records and linked personal data—reportedly retained for up to ten years and affecting an estimated 68 million people who have had credit inquiries. Schufa confirmed the dataset exists and says it is used exclusively for internal testing and to validate new risk‑scoring methods (including a 12‑criteria score introduced in March), with corporate customers having no direct access. Consumer advocates (VZBV) and privacy lawyers warn long‑term, under‑disclosed retention may violate GDPR rights to access, retention limits and deletion (Article 15) and risk reuse for credit decisions. Schufa cites a commissioned data‑protection expert (Tim Wybitul) defending the practice; the Hessian data protection authority declined to comment during an ongoing procedure.
German Court to Rule on SCHUFA Transparency and AI Impact
The German Federal Court (BGH) is set to decide whether SCHUFA's GDPR data copy must include detailed explanations of how individual credit scores are calculated. Five private plaintiffs argue SCHUFA fails to disclose which data and weightings determine personal scores; the Dresden Higher Regional Court previously found existing disclosures insufficient. SCHUFA recently launched a new, more transparent score system (100–999 scale with 12 criteria) and says it already meets enhanced transparency demands. The outcome could clarify the scope of transparency obligations for automated, data‑driven decisions under the GDPR and affect not only credit bureaus but many future AI‑based scoring systems. A new legal framework for “materially significant scores” will take effect in German law from November 2026.
Schufa launches new 100–999 credit score model
Germany’s Schufa has replaced its previous scoring system and most industry scores with a single transparent point score ranging from 100 to 999. The new model is built from twelve additive criteria so consumers can see how individual factors influence their score. Early user tests show some online-active consumers, younger people, recent immigrants and even affluent individuals without traditional credit histories may receive surprisingly lower results, partly due to frequent company inquiries. Consumers can register on Schufa’s site and verify identity via a PIN letter or the German eID (digital ID) using the ID Now service; Schufa has not yet implemented two‑factor authentication. Free "Meine‑Schufa" accounts will refresh the displayed score only every three months; paid tiers provide more frequent updates. Schufa says the reform aims to increase transparency, but wider adoption by banks and lenders will lag (most will keep using legacy scores at least until end of 2026, with legacy collection continued through 2027).
Track Real-Time Market Signals & Shifts
Set up custom watchlists to receive automated, evidence-grounded executive digests whenever material signals or shifts occur across your tracked landscape.