Art. 82 GDPR: the claim and who is liable
Art. 82(1) GDPR gives every person who suffers material or non-material damage through a breach of the Regulation a direct claim against the controller. Under Art. 82(3) GDPR the controller remains liable unless it proves that it is not in any way responsible for the event giving rise to the damage.
The burden of proof therefore lies with the other side.
Two parties may be the defendant. The reporting body, that is the bank, telecommunications provider or debt collection agency, is responsible for transmitting the incorrect data; Schufa is responsible for storage and scoring.
On 7 December 2023 the CJEU held that the automated probability value produced by a credit reference agency can be an automated decision within the meaning of Art. 22(1) GDPR where a third party’s decision to enter into a contractual relationship depends on it (C-634/21).
Joint and several liability under Art. 82(4) GDPR, by contrast, applies only where both parties were involved in the same processing operation and are responsible for the same damage.
What counts as material and non-material damage
Art. 82(1) GDPR names material and non-material damage side by side. Material damage is any measurable financial disadvantage: the interest difference on a more expensive loan, the higher insurance premium, the cost of alternative financing.
Non-material damage covers impairment that has no monetary value. On 4 May 2023 the CJEU held that Art. 82(1) GDPR precludes a national rule or practice that makes compensation conditional on damage reaching a particular degree of severity (C-300/21). This does not remove the need to prove the damage. You must set out what consequences the entry had for you.
Typical cases and how the damage is assessed
Schufa damages claims arise in recurring situations. The level of compensation depends on the nature and duration of the entry and on the consequences you can prove. We quantify the material element from your documents and argue the non-material element from the concrete course of events.
Credit refused because of an incorrect Schufa entry
The bank refuses credit because of a negative entry that is factually wrong or long since settled but not deleted. Those affected fall back on more expensive offers or abandon the financing altogether. The material damage lies in the interest difference or the lost benefit.
You prove the non-material element through the course of events: the refusal letter, its timing, further enquiries with other banks. Keep every piece of correspondence.
Rejected tenancy applications and higher insurance costs
Landlords and insurers check creditworthiness as a matter of routine. An incorrect or outdated entry leads to a rejected tenancy application or a higher premium. The material damage lies in the difference from the cheaper alternative, that is the higher rent or the higher premium.
Document every rejection in writing and ask for the reason to be stated. Without this evidence, the link between the entry and the disadvantage is missing.
Enforcement and costs
Enforcement follows a fixed sequence: documentation, deletion request, formal demand with a deadline, litigation. The ordinary limitation period under the BGB applies to the claim under Art. 82 GDPR.
It runs for three years under § 195 BGB and begins, under § 199(1) BGB, at the end of the year in which the claim arose and you knew, or without gross negligence should have known, of the breach, the damage and the debtor.
From the deletion request to litigation
The deletion request is based on Art. 17(1) GDPR, which requires erasure among other things where processing was unlawful. We submit the request to Schufa and to the reporting body. Under Art. 12(3) GDPR the controller must inform you of the measures taken within one month of receiving the request.
If no reply is received or deletion is refused, we demand the damages, quantified and with a deadline. Litigation follows after that.
Costs, legal expenses insurance and litigation funding
Whether legal expenses insurance covers the costs depends on the agreed terms, usually the contract law or data protection law modules. We obtain confirmation of cover before accepting the instruction.
Without legal expenses insurance, the costs follow the value in dispute: court fees under § 3 GKG, the lawyer’s fees under § 13 RVG. For high claims, litigation funding is an option, where a funder bears the cost risk and receives an agreed share in the event of success.
Further information
These topics may also interest you:
This information does not constitute legal advice in an individual case.
