+++ FEDERAL COURT OF JUSTICE: SCHUFA REQUIRED TO PROVIDE INFORMATION ON CREDIT SCORES +++
The Federal Court of Justice has clarified the requirements for claims for access against SCHUFA concerning the calculation of credit scores. The generation of a score may constitute automated decision-making within the meaning of Art. 22 GDPR and give rise to a right of access under Art. 15 (1) (h) GDPR. This requires that a company's decision whether to enter into or terminate a contract depends significantly on the score transmitted. Data subjects must, in principle, prove this, although substantial evidentiary relief should be available to them. In particular, if an adverse contractual decision is made shortly after a score has been transmitted, its decisive influence may be presumed. The court set aside four judgments of the Higher Regional Court of Dresden and referred the cases back because there were insufficient findings as to whether the respective contractual decisions had significantly affected the plaintiffs. If a right of access exists, the information SCHUFA has provided to date is, in any event, insufficient.
To the press release of the BGH (dated 21 October 2026, I ZR 227/25 et al., in German)
+++ REGIONAL COURT OF FRANKFURT AM MAIN: 3D AERIAL IMAGES OF ENCLOSED PROPERTIES REQUIRE CONSENT +++
The Regional Court of Frankfurt am Main has ruled that property owners may generally prohibit the publication of three-dimensional aerial images of their enclosed property without their consent. The case concerned the depiction of the plaintiff's home and property as an interactive 3D model in Google Earth and Google Maps. The models were based on aerial and satellite images that also showed parts of the property not visible from the street. The plaintiff sought injunctive relief and deletion of the relevant depictions. The court upheld the claim. The right to privacy covered the entire enclosed property insofar as it was shielded from public view. Particular weight was attached to the fact that the images had been obtained during unannounced flyovers. The affected data subject was effectively unable to protect their property from such recording. Moreover, the collected data could be linked with other sources, allowing conclusions to be drawn about lifestyle and security aspects.
To the judgment of the Regional Court of Frankfurt am Main (dated 24 September 2026, 2-03 O 388/25, in German)
+++ REGIONAL COURT OF COLOGNE: SNAPCHAT MAY NOT USE AI CHATBOT DATA FOR ADVERTISING WITHOUT CONSENT +++
The Regional Court of Cologne has decided that Snapchat may not use user data entered into its AI chatbot "My AI" for advertising purposes without explicit consent. The Federation of German Consumer Organizations ("Verbraucherzentrale Bundesverband") had filed a lawsuit against Snap Group Limited, London. According to the court, the use of the chatbot typically involves the processing of sensitive personal data within the meaning of Art. 9 (1) GDPR, as users are expressly encouraged to share personal information. Art. 9 GDPR applies regardless of whether the controller specifically intends to collect sensitive data. Since no explicit consent had been obtained and no other exception applied, the data processing was unlawful. Moreover, the pre-ticked boxes for advertising preferences did not meet the requirements for valid consent, while the pre-selection of the "Alcohol" and "Gambling" categories for underage users also violated youth protection and gambling regulations.
To the judgment of the Regional Court of Cologne (dated
17 September 2026, 33 O 120/24, in German)
+++ ADMINISTRATIVE COURT OF BERLIN: RIGHT OF ACCESS MAY ALSO COVER HANDWRITTEN NOTES +++
The Administrative Court of Berlin has ruled that handwritten notes may also constitute personal data. In the underlying case, the plaintiff, a lawyer, challenged a notice issued by the defendant data protection authority. She had taken handwritten notes on a case in the course of her legal work and had responded to the data subject's access request under Art. 15 GDPR only after the one-month deadline had expired. She argued that the notes had not been digitized and were therefore not subject to a duty to provide access. The court clarified, however, that handwritten information may constitute personal data if it can be attributed to an identifiable person. An explicit mention of a name is not required for this. The court therefore upheld the notice issued by the Berlin data protection authority because of the delayed response to the access request. However, the court did not address whether the notes also met the requirements of Art. 2 (1) GDPR. Under that provision, non-automated processing of personal data is subject to the GDPR only if the data forms part of a filing system or is intended to form part of one.
To the judgment of the Administrative Court of Berlin (dated
29 June 2026, 42 K 24/25, in German)
