BGH clarifies requirements for SCHUFA reports
The Bundesgerichtshof (BGH, Federal Court of Justice) ruled on 12 May 2026 on the conditions under which personal data concerning alleged outstanding claims may be transmitted to a credit reference agency. The decision was issued under case no. VI ZR 375/24 and is documented under the ECLI identifier ECLI:DE:BGH:2026:120526UVIZR375.24.0 as well as under WKRS 2026, 16681.
At the center of the case was the reporting of an alleged claim by a debt collection company to SCHUFA Holding AG. The claimant sought withdrawal of the reports as well as compensation for non-material damage. The BGH dismissed the appeal on points of law brought by the defendant debt collection company in its entirety. However, on the claimant’s cross-appeal on points of law, it set aside the appellate judgment insofar as it was adverse to the claimant and remitted the matter to the Schleswig-Holsteinisches Oberlandesgericht (Higher Regional Court of Schleswig-Holstein) to that extent. The proceedings therefore have not yet been concluded as regards compensation.
Background to the dispute
Electricity supply contract and disputed final invoice
In 2014, the claimant obtained electricity from an energy supply company. The company terminated the contractual relationship without notice because the claimant had fallen into arrears with advance payments. It subsequently invoiced the claimant, by final invoice dated 11 October 2014, for an amount of EUR 529.16.
A debt collection company initially instructed in the matter sent reminders for the claim on behalf of the energy supplier. In a letter dated 29 November 2014, the claimant informed the energy supplier that he had received neither the invoice nor reminders. Irrespective of this, he rejected the claim as “excessive and overstated” and requested that a corrected invoice be sent. The energy supply company then sent its unchanged final invoice on 2 and 9 December 2014.
Report to SCHUFA
As of 25 November 2019, the defendant debt collection company took over the debt collection services for the claim arising from the final invoice. On 12 March 2021, it caused the claim to be entered as a negative entry in SCHUFA’s database. This entry adversely affected the score determined by SCHUFA for the claimant.
A further report was made to SCHUFA on 18 March 2022. It concerned alleged outstanding claims of EUR 795 as at 12 March 2021 and EUR 817 as at 18 March 2022.
Decisions of the lower courts
Judgment of the Landgericht Kiel
The Landgericht Kiel (Regional Court of Kiel) ruled on 9 January 2024 under case no. 17 O 130/23. To the extent relevant for the appeal on points of law, it ordered the defendant debt collection company to withdraw the negative entry stored at SCHUFA concerning a payment default and the alleged outstanding claims.
In addition, the Landgericht awarded the claimant “compensation for pain and suffering” in the amount of EUR 500 as well as pre-litigation lawyers’ fees.
Appellate judgment of the OLG Schleswig
The Schleswig-Holsteinisches Oberlandesgericht ruled on 22 November 2024, as amended by a rectification order dated 17 December 2024. It upheld the order requiring withdrawal of the reports, but dismissed the claim for compensation for non-material damage.
The appellate court assumed that the reports had been unlawful. However, it denied that there was compensable non-material damage. In support of this, it relied in particular on the fact that it could not be established that the SCHUFA reports at issue had specifically caused failed contract conclusions. It also did not find any relevant loss of control over personal data.
Lawfulness of the data transfer under the GDPR
Standard under Art. 6(1), first subparagraph, point (f) GDPR
The BGH made clear that the lawfulness of the data transfer at issue is governed solely by the General Data Protection Regulation (GDPR). The transmission of the claimant’s personal data to SCHUFA constituted processing within the meaning of Art. 4 no. 2 GDPR.
According to the findings of the appellate court, the claimant had not given consent. Accordingly, the only possible justification was Art. 6(1), first subparagraph, point (f) GDPR. Under that provision, processing is lawful if it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party and the interests or fundamental rights and freedoms of the data subject do not override those interests.
In this regard, the BGH refers to the three-stage test applied by the Court of Justice of the European Union:
- There must be a legitimate interest pursued by the controller or by a third party.
- The processing must be necessary for the purposes of that interest.
- The interests or fundamental rights and freedoms of the data subject must not override it.
No direct application of § 31 BDSG
The appellate court had relied on § 31(2) BDSG (Federal Data Protection Act) as a specification or interpretive aid. By contrast, the BGH clarified that § 31 BDSG is not applicable to the question of data transfers to credit reference agencies. In the BGH’s view, the provision does not directly regulate the transmission of data to credit reference agencies.
It was therefore not decisive for the decision whether § 31 BDSG is compatible with EU law. The relevant standard remained solely Art. 6(1), first subparagraph, point (f) GDPR.
Disputed and unsubstantiated claim
Requirements regarding the probative value of claim data
The BGH acknowledged that credit reference agencies such as SCHUFA may pursue legitimate interests. Among other things, they serve the interests of potential lenders by reducing information asymmetries and enabling an assessment of creditworthiness.
The transmission of claim data to a credit reference agency may also, in principle, be considered for the purposes of safeguarding legitimate interests. However, this requires that the transmitted data be suitable for allowing meaningful conclusions to be drawn about the data subject’s ability or willingness to pay.
In the BGH’s view, this was not the case in the specific circumstances. The claim had not been reduced to an enforceable title, had been disputed by the claimant, and had not been plausibly substantiated in its entirety by the defendant.
Doubts regarding individual invoice items
The appellate court had found that the claimant had already rejected the final invoice as “excessive and overstated” before the SCHUFA report. In doing so, he had stated what, from his perspective, was an objective reason for non-payment.
Although the appellate court considered it plausible that the claimant had fallen into arrears with advance payments, the final invoice did not concern the advance payments as such. In addition, the final invoice contained various items whose basis was not explained in greater detail.
These included in particular:
- a billing of 1,543.86 kWh instead of the actual consumption of 1,306.8 kWh, possibly due to a flat-rate agreement,
- so-called “damages for non-performance,”
- reminder and bank transfer fees,
- several amounts described as “default costs,”
- set-offs against advance payments already made.
The defendant had not explained these components in greater detail. According to the BGH’s account, it did not raise procedural objections against the corresponding findings of the appellate court.
Withdrawal of the SCHUFA reports
Unlawful report as the basis of the claim
The BGH upheld the order requiring the defendant to withdraw the two SCHUFA reports. According to its legal assessment, the reports were unlawful because the transmission of the personal data was not justified under Art. 6(1), first subparagraph, point (f) GDPR.
According to the unchallenged findings of the appellate court, the data continued to be stored by SCHUFA. The claimant was therefore entitled to request the removal of the continuing impairment.
Legal basis for the claim remains partly open
The BGH left open whether the claim already arises directly from the General Data Protection Regulation. A possible point of reference is Art. 19 sentence 1 GDPR in conjunction with Art. 17(1)(d) GDPR. Art. 19 GDPR concerns the obligation to notify recipients of personal data where data are rectified or erased or their processing is restricted.
If such a claim for remediation of consequences does not arise directly from the GDPR, the BGH in any event bases it on national law. A corresponding application of § 1004(1) sentence 1 BGB (German Civil Code), § 823(1) BGB in conjunction with Art. 1(1) and Art. 2(1) GG (Basic Law for the Federal Republic of Germany) may be considered due to an infringement of the general right of personality in its manifestation as the right to informational self-determination.
The BGH emphasized that the GDPR does not preclude such an expansion of legal protection under national law. Rather, it may help ensure the high level of protection in the processing of personal data sought by the Regulation.
Non-material damage under Art. 82 GDPR
Appellate judgment legally erroneous in this respect
The claimant’s cross-appeal on points of law was successful. The BGH expressly criticized the appellate court’s view that the claimant had not suffered any non-material damage as a result of the unlawful transmission of the claim data to SCHUFA.
Art. 82(1) GDPR grants a person who has suffered material or non-material damage as a result of an infringement of the Regulation a right to compensation from the controller. A mere infringement of the GDPR is not sufficient for this. What is required is damage caused by the infringement.
The concept of non-material damage must be interpreted autonomously under EU law. According to the case law of the Court of Justice of the European Union, a national practice that makes compensation for non-material damage dependent on a certain threshold of seriousness is not compatible with Art. 82 GDPR.
Impairment of economic reputation
The BGH considered non-material damage to exist already in the fact that the reports adversely affected the score determined by SCHUFA. This score could be requested by the claimant’s potential contractual partners. According to the findings of the appellate court, it was in fact taken into account in several failed contract negotiations.
In the BGH’s view, the claimant’s creditworthiness and thus his economic reputation were impaired in a manner capable of establishing, in principle, a claim under Art. 82(1) GDPR.
It was not necessary for the low score and the concerns of potential contractual partners triggered by it to have been based solely or predominantly on the defendant’s reports. This question could be relevant only to the amount of compensation.
Loss of control over personal data
The BGH also criticized the appellate court’s assessment regarding loss of control. In the BGH’s view, for non-material damage from this perspective, it was sufficient that the defendant had transmitted the claimant’s personal data to SCHUFA and thereby created the risk of further data transfers to an indefinite number of third parties.
In the specific case, the data, or the score influenced by them, were made available by SCHUFA for retrieval by third parties. In addition, SCHUFA inquiries concerning the claimant had already been made. A feeling of helplessness or of being “observed” was not required for a finding of such non-material damage. Particular concerns or fears could merely deepen or increase the damage.
Finding and withdrawal do not replace compensation for damage
The BGH further clarified that a claim under Art. 82 GDPR cannot be denied on the ground that withdrawal of the report or a finding of unlawfulness is already sufficient legal protection.
The claim for damages under Art. 82 GDPR serves to compensate for the specific damage suffered. In the BGH’s view, an order requiring withdrawal of the negative entry vis-à-vis SCHUFA is not suitable to compensate for non-material damage that has already occurred.
Consequences of the remittal
Amount of damages still open
The BGH did not make a final decision on the amount of any compensation. It set aside the appellate judgment insofar as it was adverse to the claimant and remitted the matter to the Schleswig-Holsteinisches Oberlandesgericht for a new hearing and decision.
It is therefore established that the appellate court’s dismissal of the damages claim could not stand as a matter of law. However, a further decision must be made on the amount of compensation for non-material damage due to the claimant.
Procedural status
The appeal on points of law brought by the defendant debt collection company was unsuccessful. The obligation to withdraw the two SCHUFA reports was upheld before the BGH. As far as compensation for non-material damage is concerned, the proceedings have not yet been concluded following the remittal.
The decision was rendered in the VI. Zivilsenat (Sixth Civil Senate) with the participation, among others, of Judge Dr. Allgayer, Judge Dr. Linder and Judge Böhm. In addition to the reference BKR 2026, 910, the judgment is also documented in other specialist legal services.
Significance for data transfers to credit reference agencies
The decision makes clear that reporting alleged outstanding claims to a credit reference agency is not permissible merely because a claim is being asserted. The decisive question is whether the transmitted data are suitable for allowing reliable conclusions to be drawn about the data subject’s ability or willingness to pay.
In the case of a disputed claim that has not been reduced to an enforceable title and has not been plausibly substantiated, such suitability may be lacking. In such a case, the transmission of personal data to a credit reference agency is not justified under Art. 6(1), first subparagraph, point (f) GDPR.
The decision concerns in particular the following legal aspects:
- permissibility of negative reports to credit reference agencies,
- requirements for substantiating alleged claims plausibly,
- consequences of an unlawful data transfer,
- withdrawal of unlawful SCHUFA reports,
- non-material damage under Art. 82 GDPR,
- impairment of economic reputation through scores,
- loss of control over personal data.
For companies, debt collection service providers, credit institutions and other bodies that transmit claim data or use scores, the decision is of considerable practical relevance. At the same time, it affects consumers and other data subjects whose economic reputation may be influenced by a data transfer to a credit reference agency.
Data protection law assessment by MTR Legal
The BGH judgment shows that data transfers to credit reference agencies require careful examination of the data protection law requirements. This applies in particular where claims are disputed, have not been reduced to an enforceable title, or their composition is not sufficiently comprehensible.
MTR Legal Rechtsanwälte advise companies, investors and high-net-worth individuals on data protection law issues, including in connection with credit reference agencies, scoring, claim data and liability risks under the GDPR. Where legal questions arise on these topics, an individual assessment in the area of legal advice in data protection law may be advisable.
