The association None of Your Business (noyb) has issued a formal notice to the credit rating agency SCHUFA regarding the retention and use of personal data in a "ghost database".

Media investigations have revealed that SCHUFA retains data that should have been deleted, merely labeling them as "masked." This information, potentially concerning 69 million people, is reportedly used in the background for "credit score validations" for third parties. The company refuses to disclose this historical data in response to access requests made under Article 15 of the GDPR, arguing that it is not of interest to the data subjects. The Hesse Data Protection Authority (HBDI), although informed of the situation since spring 2025, has taken no action.

noyb has formally demanded that SCHUFA cease retaining data beyond the prescribed periods, provide complete information during access requests, and ensure transparency of its processing activities. In case of refusal, the association will initiate a cessation action to legally prohibit these practices. noyb's president emphasized the need for legal action by a public interest association in response to what is perceived as a weakening of data protection authorities in Germany.

Furthermore, noyb is considering a class action for individuals who have suffered moral damage, particularly those who received incomplete responses to their access requests. The damage is estimated at approximately €500 per person. An online interest list has been opened for affected individuals wishing to be informed of a potential legal action. Other organizations, such as Veille des Algorithmes, have launched a petition demanding the deletion of the database and the imposition of the maximum fine on SCHUFA.