In addition to its actual database with consumer creditworthiness information, Schufa apparently also has a shadow database. This also includes millions of customer data, but this should have been removed from the inventory long ago due to legal deletion obligations. Schufa itself confirms that it maintains this “historical data,” but says it only uses it for testing purposes. In addition to the question of the legality of this shadow database, there is massive criticism from data and consumer advocates.
Read more after the ad
There are always legal proceedings regarding the storage period of creditworthiness data. In principle, organizations like Schufa are obliged to delete data after a certain period of time or on appropriate occasions due to the “right to be forgotten” enshrined in the General Data Protection Regulation (GDPR). With Schufa, this is about paying off old debts. But the credit rating service still stores and uses this data, as the Tagesschau reports after research by NDR and SZ.
Schufa: Historical data for testing purposes only
Schufa has now publicly admitted this, as it has recently been writing on its own website how companies test the new Schufa score based on historical data. This is the official reason for this shadow database. Schufa’s corporate customers can use it to test consumers’ ability to pay for a specific day in the past. The credit rating service wants to demonstrate the reliability of the new Schufa score and market it accordingly.
However, the legality of such tests based on this shadow database, which contains some sensitive information such as consumer loans, credit cards, debts and bankruptcies, is questioned. “Historical scores provide some insight into the financial situation of the people affected in the past,” explains Ruth Janal, an expert in data protection law and professor at the University of Bayreuth. “This is simply none of the business of Schufa’s contractual partners.”
Data accuracy before data protection
Schufa, on the other hand, sees itself in the right. “The storage and further processing of historical data is based on several, mutually complementary data protection permissions,” it says on request. Banks are legally obliged to be able to rely on meaningful scores. As a result, “Schufa is required to store historical data for testing purposes,” according to the credit service’s statement.
Read more after the ad
Read also
Schufa emphasizes that the data “will be deleted from banks and other companies after the tests have been completed”. Claudio Zeitz-Brandmeyer from the Federal Association of Consumer Organizations (VZBV) still considers this to be problematic, “because it is very tempting for the companies that receive this data not only to use this data for testing purposes, but also to actually use it for credit decisions, for example.” According to Schufa, the historical data has no influence on the score and the creditworthiness assessment.
Consumers remain in the dark
This is probably one of the reasons why Schufa does not reveal, even when asked by consumers, whether their data is stored in the shadow database. Since the end of March, consumers have been able to view their own Schufa score free of charge, but this apparently does not include historical data. “We do not show historical data separately on the data copy in accordance with Art. 15 GDPR,” she writes. Data protection law expert Janal believes this is misleading. The right to information according to the GDPR “of course also includes these data that Schufa describes as historical data”.
Another data protection expert even calls for an investigation into this shadow database. “Schufa has to ask itself what level of irresponsibility there is here,” explains Matthias Spielkamp from the non-governmental organization AlgorithmWatch. However, such a process has already begun. Since spring 2025, the Hessian state data protection officer responsible for Schufa has been examining the legal basis for these data tests as well as the exclusion of historical data in consumer inquiries, as the authority announced upon request. However, this investigation is still ongoing.
(fds)
