Schufa CEO Praised Transparency Weeks Before Hidden Database Revelation

A joint NDR and Süddeutsche Zeitung investigation uncovers Schufa's hidden database of outdated consumer information, violating GDPR's 'right to be forgotten' and potentially impacting credit scores.

Just weeks after Germany's largest credit bureau touted a new, transparent scoring system, a joint investigation by NDR and Süddeutsche Zeitung reveals the company allegedly maintained a secret database of outdated consumer information—affecting 68 million people.

The cache included old loans, court-ordered seizures, and private insolvencies that the Schufa kept on file years beyond the legally required deletion periods, according to the report. The company never informed consumers about the continued storage, raising serious questions about the "right to be forgotten"—a cornerstone of the European General Data Protection Regulation (GDPR).

Internal Tests That Spilled Over

Schufa justified holding onto the aging data by claiming it was needed for internal quality checks and development of new scoring models. But the investigation found that results from these tests were also shared with business clients: banks, energy providers, telecommunications firms, and service companies in e-commerce and payment processing.

That means the stale information could still indirectly influence a consumer’s creditworthiness—even though the events themselves were years old.

A reporter involved in the NDR investigation told the news outlet that the analyses derived from the hidden database directly benefited the company’s commercial partners. Legal experts are calling this potential indirect impact on credit scores the core of the problem.

Regulators Already on the Case

The legal grounds for such storage practices are being heavily disputed. A legal scholar at the University of Bayreuth described the tests as impermissible under current law. The Consumer Advice Centre (Verbraucherzentrale Bundesverband) also warned of possible abuse of the data trove.

The Hessian data protection authority has been examining Schufa’s storage practices since spring 2025. The key question: whether using data that should have been deleted—even for internal optimisation—is compatible with European law.

The revelations stand in sharp contrast to public statements made by Schufa CEO Tanja Birkholz in March 2026. At that time, she promoted a new scoring system and emphasised the company’s commitment to transparency in its procedures.

Consumer advocates and legal professionals are now demanding a full, unimpeded investigation into the company’s data handling.