CJEU considers approach to retention of personal data from public debt registers

The CJEU found that this longer retention of personal data infringed the GDPR and accordingly that Schufa could not rely on the legitimate interests basis under Article 6(1)(f) GDPR as its lawful basis for processing the insolvency data. This processing was therefore unlawful under GDPR. In making this finding the CJEU held that a discharge from bankruptcy was of existential importance for a data subject and this personal data should not be stored by a credit reference agency for any longer than the German legislation on public registries allowed for. 

Concerning the right to erasure, the CJEU also ruled that Article 17(1)(d) of the GDPR must be interpreted as meaning that the controller is required to erase unlawfully processed personal data as soon as possible. This therefore sets a wider implication that all credit reference agencies will be obliged to delete personal data held in these specific circumstances. 

The CJEU did not make a finding whether or not the parallel storage of this data in the databases of credit information agencies was permissible before the expiry of the (statutory) six-month period. This issue has been passed back to the referring court to rule on.  The CJEU also found that if the referring court were to conclude that this processing complied with Article 6(1)(f) of the GDPR, Article 17(1)(c) of GDPR would apply. The CJEU found that this meant that the data subject has the right to obtain the erasure where he or she objects to the processing pursuant to Article 21(1) GDPR and there are no overriding legitimate grounds capable of justifying, exceptionally, the processing in question. The referring court would also consider these overriding grounds, if the case proceeded in this direction. 
The CJEU also emphasized national courts' authority to fully review supervisory authority decisions.