Frankfurt – Tanja Birkholz, the chief executive of credit bureau Schufa, has adopted a combative stance in the ongoing legal dispute concerning what has been dubbed "shadow databases," asserting that the use of historical data is a standard and necessary practice across various predictive modeling applications. Speaking at the Handelsblatt Banking Summit on Wednesday, Birkholz stated, "All forecasting models, whether for the economy or for insurance models, utilize historical data. We have always been transparent about this. Therefore, we are somewhat surprised by the outcry."

The controversy was ignited by investigative reports from NDR and Süddeutsche Zeitung in mid-July, which revealed that Schufa maintains a second repository of older data alongside its primary database. This secondary collection has been referred to as a "shadow database." This archive reportedly contains information on past credit defaults, seizures, and personal bankruptcies, including details on debts that individuals may have settled years ago.

The legal challenge stems from the storage of this historical data. The European data protection organization None of Your Business (NOYB), based in Vienna, recently filed a class-action lawsuit and an injunction against Schufa, demanding the deletion of this historical information. NOYB argues that the continued retention of such data, particularly after debts have been settled, infringes upon individuals’ right to privacy and data protection.

Schufa’s Defense: The Necessity of Historical Data in Risk Assessment

Birkholz, in her remarks, sought to contextualize Schufa’s data practices within the broader landscape of financial risk assessment. She referenced an exception within Hesse’s data protection laws, which, according to Schufa, permits the continued use of such data. Her argument centers on the regulatory obligations placed upon financial institutions. "Banks are regulatorily obligated to validate score models before deployment, and such validations necessitate statistical data from the past," Birkholz explained. She indicated Schufa’s willingness to pursue the legal case to the Federal Court of Justice (Bundesgerichtshof), signaling a firm resolve to defend its data retention policies.

The core of Schufa’s defense appears to be that historical data is indispensable for creating accurate creditworthiness assessments. Without access to past financial behavior, it becomes challenging for lenders to predict future repayment probabilities. This is particularly relevant for new borrowers or those with limited current credit activity, where historical patterns can offer crucial insights.

The "Shadow Database" Controversy: A Deeper Dive

The term "shadow database" itself carries a negative connotation, implying a clandestine or illegitimate operation. However, Schufa maintains that this secondary collection is not a secret archive but rather a repository for data that has reached the end of its statutory retention period for primary use but is still deemed valuable for specific analytical purposes. These purposes, according to Birkholz, primarily revolve around the validation and improvement of their scoring models.

The data contained within this "shadow database" can include a wide range of financial history:

• Past Credit Default Records: Information on loans that were not repaid on time or defaulted.
• Seizure Information: Details regarding the seizure of assets or wages due to outstanding debts.
• Private Insolvency Records: Data related to individuals who have declared personal bankruptcy.
• Settled Debts: Information on obligations that have been fully paid off, sometimes years prior.

The concern raised by NOYB and other privacy advocates is that retaining data on settled debts can unfairly penalize individuals. For instance, a past default, even if fully resolved, could continue to impact a person’s credit score for an extended period, potentially hindering their ability to obtain new loans, mortgages, or even rental agreements. This raises questions about proportionality and the right to a "clean slate" after fulfilling financial obligations.

Timeline of Events and Legal Actions

The public discourse surrounding Schufa’s data practices has been building for some time, but it reached a critical juncture in mid-July 2023 with the investigative reports from NDR and Süddeutsche Zeitung. These reports brought the existence of the "shadow database" to widespread public attention.

• Mid-July 2023: NDR and Süddeutsche Zeitung publish investigative reports detailing Schufa’s secondary data repository, dubbing it a "shadow database."
• Late July 2023: The European data protection organization NOYB announces its intention to take legal action against Schufa.
• Early August 2023: NOYB officially files a class-action lawsuit and an injunction against Schufa, demanding the deletion of historical data from the "shadow database."
• Wednesday (Date of Article): Tanja Birkholz, CEO of Schufa, speaks at the Handelsblatt Banking Summit, defending the use of historical data and outlining Schufa’s legal strategy.

This chronology highlights the rapid escalation of the controversy from investigative journalism to formal legal proceedings.

Supporting Data and Context: The Role of Credit Bureaus

Credit bureaus like Schufa play a pivotal role in modern economies. They collect and process vast amounts of data on individuals’ financial behavior to generate credit scores. These scores are then used by lenders (banks, credit card companies, etc.) to assess the risk associated with lending money. A higher score generally indicates a lower risk, leading to more favorable loan terms, while a lower score can result in loan denial or higher interest rates.

In Germany, Schufa is the dominant credit bureau, holding data on approximately 68 million people. The information it collects includes details on bank accounts, credit cards, loans, payment history, and even information from utility companies and telecommunication providers. The accuracy and fairness of this data collection and scoring process are crucial for both consumers and the financial system.

The debate over "shadow databases" touches upon several key aspects of data privacy and consumer rights:

• Data Minimization: A core principle of data protection is to collect and retain only the data that is strictly necessary for a specific purpose. The continued retention of data on settled debts raises questions about whether this principle is being adhered to.
• Purpose Limitation: Data collected for one purpose should not be used for another without consent. While Schufa argues the historical data is for model validation, critics question if this purpose is sufficiently distinct from primary credit assessment.
• Right to Erasure (Right to be Forgotten): Under data protection regulations like the GDPR, individuals have the right to have their personal data erased under certain conditions, such as when the data is no longer necessary for the purpose for which it was collected.

Reactions and Broader Implications

While the article directly quotes Tanja Birkholz, other stakeholders have expressed concerns. Data protection authorities and consumer advocacy groups have been vocal critics of broad data retention practices. NOYB, in particular, has a track record of challenging large corporations on data privacy issues. Their involvement signals a significant legal and regulatory challenge for Schufa.

The implications of this legal battle are far-reaching:

• Consumer Rights: A favorable ruling for NOYB could significantly strengthen consumer rights in Germany and potentially across the EU, leading to greater control over personal financial data and clearer pathways for data erasure.
• Credit Scoring Practices: If Schufa is forced to delete historical data, it could necessitate a re-evaluation of credit scoring methodologies. This might lead to a greater reliance on more recent financial behavior or the development of new predictive models that are less dependent on extensive historical archives.
• The Future of Data Bureaus: The outcome could set a precedent for how credit bureaus operate, potentially leading to more stringent regulations regarding data retention periods and the transparency of their operations.
• Financial Inclusion: While the intention of credit scoring is to facilitate access to credit, an overly punitive system based on outdated data could inadvertently exclude individuals who have demonstrated improved financial responsibility.

Schufa’s Stance: A Matter of Legal Interpretation

Birkholz’s reference to the Hesse data protection law suggests that Schufa believes its practices are legally permissible under specific interpretations. This legal gray area is precisely what NOYB aims to challenge. The dispute hinges on whether the use of historical data for model validation constitutes a legitimate purpose that overrides the right to erasure, especially for data pertaining to settled obligations.

The statement that "consumers are often only interested in the current creditworthiness assessment" further underscores Schufa’s perspective that the current score is the primary concern for consumers, implying that the underlying historical data, even if old, is merely a technical tool to arrive at that score. However, privacy advocates argue that the process by which that score is derived is equally important and that individuals have a right to understand and control all aspects of their financial data.

The willingness of Schufa to take the case to the highest court indicates a strong belief in the legality and necessity of their current data handling procedures. This suggests that the legal arguments will likely delve into complex interpretations of data protection laws and the fundamental principles of credit reporting.

As the legal proceedings unfold, the public and the financial industry will be watching closely. The outcome of this "shadow database" controversy will undoubtedly shape the future of credit reporting and data privacy in Germany and beyond. The debate is not merely about technical data storage but about balancing the needs of the financial system with the fundamental rights of individuals in an increasingly data-driven world.