Schufa has records of the financial history of millions of people. But what actually happens to data that has long since disappeared from the publicly available Schufa credit report? A heated debate has now erupted over precisely this issue.
Data privacy advocates allege that old information is not actually deleted, but merely removed from the regular database and continued to be stored in the background.
Schufa strongly disagrees. It does not refer to a “shadow database,” but rather to a data archive. And it argues that without historical data, neither reliable creditworthiness models nor adequate oversight of its own work would be possible.
Now a court could decide whose point of view is correct.
Old debts settled—but are they really a thing of the past?
For consumers, the issue is fairly straightforward at first glance: a bill has been paid, a loan has been repaid, or a financial problem occurred years ago. At some point, the relevant information should no longer be used against the person in question.
This is precisely where the criticism from the privacy advocacy group NOYB comes in. It accuses Schufa of continuing to store data on cases that were settled long ago. According to an investigation by NDR and the *Süddeutsche Zeitung*, this reportedly includes, among other things, old loans, garnishments, and personal bankruptcies.
A particularly contentious issue is what “deletion” actually means.
According to NOYB, while certain information would be removed from the database used for current credit reports, it would not disappear entirely from Schufa’s systems. Instead, it could remain in the historical archive and be used to validate scoring models.
NOYB refers to this database as a “shadow database.” The organization has therefore demanded that Schufa cease certain practices, delete historical data, and provide consumers with complete information about the data stored on them.
Schufa considers this statement to be incorrect.
Schufa says: An archive is not a secret database
Schufa's response is clear: “We do not have a ‘shadow database.’ Schufa has a data archive, just like other companies.”
From Schufa’s perspective, this distinction is crucial. Historical data is stored separately from the current database. It is this current database that Schufa uses to generate its current credit reports.
So why is the old data being kept at all?
Schufa cites several reasons for this.
For one thing, it must remain possible to trace which data was processed in the past. This is important in case data protection authorities or courts later need to verify whether the processing was lawful. If all historical information were to disappear immediately, such verification could become significantly more difficult or even impossible.
On the other hand, historical data is needed to verify the quality of credit models. After all, a credit score shouldn’t just look plausible today; it should be able to assess as reliably as possible, for example, the likelihood of a default.
To do this, models must be tested against past trends.
Schufa therefore argues that if historical data is completely destroyed, the company is simultaneously deprived of the opportunity to scientifically test and further develop its models.
At first glance, that sounds reasonable. But this is exactly where the real problem begins.
After all, “stored” doesn’t always mean “stored”
The dispute is not merely about whether old data still exists. Rather, the key issue is what it is still being used for and who has access to it.
If a company retains information solely to be able to prove at a later date what happened in the past, that is different from continuing to analyze that same information for business purposes.
NOYB claims that the historical data is used, among other things, for “score validations” and is therefore not merely stored as a passive archive.
Schufa, for its part, explains that historical data is stored for specific purposes and in accordance with applicable regulations. According to Schufa, certain retention periods apply to normal credit reporting operations. The historical archive, however, is to be distinguished from this.
This brings two very different perspectives into conflict.
One of them is: Anything that needs to be deleted must not simply continue to exist under a different label.
The other point is this: Not every instance of data retention automatically constitutes further use as current credit information. A company must be permitted to archive past data under certain conditions, particularly if doing so enables it to comply with legal audit and record-keeping requirements.
In the end, this question is likely to be far more important than the headline about the “shadow database.”
A particularly sensitive issue: What exactly do consumers actually see?
The dispute becomes even more contentious when it comes to the issue of access to information.
Consumers can find out from Schufa what personal data is being processed about them. However, NOYB criticizes the fact that, according to the organization, historical data is not automatically included in this information.
Schufa, on the other hand, states that it initially provides the information processed in its current database. Anyone who requests additional information regarding historical data and specifies what they are looking for can also receive it.
That sounds like a minor detail. But for those affected, it isn't.
After all, transparency only really works if a person even knows that there is additional information they should be asking for.
That is precisely why this issue could become particularly interesting for further discussion: Is a company required to proactively disclose to a consumer what historical personal information it still holds? Or is it sufficient to provide additional data only upon specific request?
At the same time, Schufa points out that the legal requirements for transparency will be expanded in the future. According to Schufa, starting November 20, 2026, certain historical data related to calculated credit scores will be included in the data report. Schufa has announced that it will adapt its data report accordingly and, according to its own statements, will even go beyond the minimum legal requirements.
As a result, the issue of transparency is likely to take on even greater importance in the future.
The dispute will likely end up in court now
There is no sign of an agreement between the parties at this time.
Schufa has not issued the cease-and-desist declarations demanded by NOYB. NOYB has therefore announced that it will file a lawsuit seeking an injunction. This means the dispute is likely to end up exactly where such a matter of principle can ultimately be resolved: in court.
And this could have far-reaching consequences.
If a court were to rule that certain historical data may in fact no longer be stored or processed, this could have implications for Schufa’s data holdings and operations.
Conversely, a court ruling upholding the Schufa’s position could make it clear that, under certain conditions, a company is permitted to retain personal data beyond the time limits that apply to standard credit reports.
There is also the possibility of claims for damages. NOYB has already set up a list of interested parties for a potential class-action lawsuit. This pertains in particular to consumers who have requested a credit report from Schufa in recent years and may not have received complete information regarding historical data.
However, there is certainly no guarantee of a payment of a specific amount. Whether any claims exist at all—and, if so, how much they would amount to—would first have to be determined both legally and factually.
legaldata says: An archive should not be a free pass
There is one point Schufa raises that must be taken seriously: It is not possible to develop and monitor a credit scoring model effectively if all historical data disappears immediately. Government agencies and courts may also need verifiable information about what has happened in the past.
But that does not mean, by any means, that a company is allowed to retain old personal data indefinitely.
From legaldata's perspective, this is precisely where the crucial line is drawn: An archive must not become a convenient dumping ground for data that should have been removed from circulation long ago.
The term itself is of secondary importance. Whether one refers to it as a “shadow database,” “data archive,” or “historical dataset” is ultimately a matter of how it’s presented. What matters is what actually happens to the data.
If a completed financial transaction is no longer allowed to appear in a consumer’s current credit assessment but continues to be analyzed in the background, this raises an uncomfortable question: What does “deleted” actually mean in this context?
Especially for an organization whose assessments can help determine whether someone gets a loan, a cell phone contract, or possibly an apartment, transparency shouldn't only begin when someone asks for it.
The ball is therefore now in the courts’ court. And perhaps that’s actually the best solution. Because there’s one thing that’s certainly open to debate: whether a historical data archive is necessary. However, the company that relies on the data for its livelihood should not be the sole decision-maker regarding how far such an archive should go and what “deletion” actually means.
