CJEU, judgment of 7 December 2023, C-26/22 and C-64/22, SCHUFA Holding (Libération de reliquat de dette)

1 Overview

Two data subjects had gone through the procedure for the discharge of residual debt in Germany. The corresponding entry was removed from the public insolvency register after six months had elapsed. SCHUFA stored the information for considerably longer, namely for three years. The data subjects requested erasure. The Wiesbaden Administrative Court (VG Wiesbaden) referred questions to the CJEU on the interpretation of Article 6(1)(f) GDPR and on the scope of the right to object and the right to erasure.

2 Headnotes

The storage of information from public registers by a credit information agency is processing within the meaning of Article 6(1)(f) GDPR. It requires the cumulative fulfillment of the three stages: the existence of a legitimate interest, the necessity of the processing, and a balancing exercise that comes out in favor of the controller (para. 75).

The assessment of creditworthiness by information agencies is in principle a legitimate interest; it benefits not only the controller, but also its contractual partners and the credit sector as a whole (para. 83).

Necessity is to be examined narrowly, in the sense of "strictly necessary"; the processing must not go beyond what is absolutely necessary (para. 88). Storage beyond the period provided for by law for storage in the public register is incompatible with the principles of data minimization and storage limitation (para. 92).

Where the data subject objects under Article 21(1) GDPR, the controller must demonstrate compelling legitimate grounds which override the interests of the data subject (para. 111). If that showing does not succeed, the data must be erased under Article 17(1)(c) GDPR (para. 112).

3 Significance

The decision is one of the key judgments on the interpretation of Article 6(1)(f) GDPR: it sharpens the standard of necessity, establishes the parallel examination of the right to object and the right to erasure, and makes clear that the burden of proof in objection proceedings lies with the controller. For information agencies, it has considerably shortened the storage period.