Data Protection and Insolvency: New Requirements for Credit Bureaus Following the Decision of the Schleswig-Holstein Higher Regional Court
The interaction between data protection law and insolvency law is a central issue in the storage and processing of sensitive financial information. In its ruling of June 2, 2022 (Case No. 17 U 5/22), the Schleswig-Holstein Higher Regional Court (OLG) set essential guidelines for credit bureaus such as SCHUFA. This ruling limits the period for which personal data of insolvent debtors may be processed and explicitly ties it to the publication period in the “Insolvency Announcements Portal”. The decision extends beyond the individual case and has a concrete impact on data-processing companies, insolvent private individuals, and affected companies.
Background: Tension Between Data Protection and Interests of Credit Bureaus
With the Europe-wide applicable General Data Protection Regulation (GDPR), the requirements for processing personal data have significantly increased. In particular, Art. 5 and Art. 6 GDPR impose strict conditions and clear deadlines for storage. At the same time, the legitimate interest of credit bureaus in collecting and distributing credit information is recognized to provide lenders and market participants a basis for economic decisions.
In the context of storing insolvency-related information, the balance between transparency and the right to be forgotten is challenged. The legislator has set a clear deletion period of six months after the conclusion of proceedings for the publication of personal data in the Insolvency Announcements Portal (www.insolvenzbekanntmachungen.de). The adoption of this deletion period by private credit bureaus was previously controversial.
The Core Statements of the Judgment and Their Justification
Subject of the Decision
In the decided case, a consumer had filed a lawsuit against SCHUFA for continuing to store his insolvency data after the insolvency proceedings had long been completed and the discharge of residual debt had been granted. While the Insolvency Announcements Portal had dutifully deleted the data after six months, SCHUFA continued to retain and distribute it to third parties.
Legal Basis and Balancing of Interests
The OLG Schleswig-Holstein based its assessment on Art. 6 para. 1 lit. f GDPR (“legitimate interest”). The decisive factor was the overall balancing between SCHUFA’s economic interest in being able to provide credit-relevant information and the data subject’s right to the protection of his data. It was significant for the court that the legislator had provided a strict deletion period for the insolvency portal and thus explicitly excluded further public access to the data after a certain period.
This legislative value judgment must also, according to the court, impact processing by private credit bureaus. As a result, insolvency-related data may not be processed by credit bureaus beyond the six-month publication period. There is no “legitimate interest” within the meaning of the GDPR for further processing beyond this period.
Impact of the Decision
SCHUFA’s practice of continuing to store and communicate information about concluded insolvency proceedings for up to three years is in clear contradiction to the GDPR and the legislator’s valuation regarding the Insolvency Announcements Portal. The ruling obliges credit bureaus to align their storage and deletion periods with the statutory regulation for the public portal.
Relevance for Companies, Creditors, and Affected Individuals
Consequences for Credit Bureaus and Data Processors
This decision not only leads to the adaptation of internal company processes for credit bureaus but also affects banks, leasing companies, trading companies, and all data-processing entities that rely on credit information. When processing and passing on person-related insolvency data, the legal deletion periods must be strictly observed in the future. Exceeding this period can trigger data protection claims from those affected and lead to official review.
Protection of Privacy and Business Interests
For entrepreneurs, investors, and wealthy private individuals, the ruling offers a clearer legal basis for enforcing their right to the deletion of personal insolvency data. At the same time, companies and investors must rely on current and lawfully stored data for credit assessments. The jurisdiction demands transparent and legally compliant handling of sensitive credit information.
Significance for Ongoing and Future Proceedings
It should be noted that the decision of the OLG Schleswig-Holstein was made in the specific case. Since there is no supreme court ruling from the Federal Court of Justice on this specific constellation, it remains to be seen whether the new practice will be established nationwide. Nevertheless, the decision provides a clear direction and is likely to significantly influence the handling of insolvency-related data (Status: June 2022; see https://urteile.news/Schleswig-Holsteinisches-Oberlandesgericht_17-U-522_Schufa-muss-Daten-loeschen-Schufa-darf-die-Daten-eines-Insolvenzschuldners-nicht-laenger-verarbeiten-als-sie-im~N31841).
For all market participants, the legal requirements and boundaries regarding the handling of insolvency and credit data are subject to continuous development through legislation and case law. Complying with deletion obligations is not only a compliance issue but pertains to the core of personal data processing and the balance between creditor-related informational interests and the protection of those affected.
Conclusion and Outlook
The decision of the OLG Schleswig-Holstein marks an important step towards consistent application of data protection standards in the storage of insolvency information by private credit bureaus. It brings increased requirements for data processing practices and a stronger orientation towards the legally established deletion periods. Companies, investors, and affected private individuals should closely observe the impact on their data and credit processes. Those who encounter uncertainties in the context of insolvency proceedings or the handling of credit data can find further information and individual support under Legal Advice in Insolvency Law.
