The data protection conference (DSK) could not have been any clearer: the behavior of credit agencies and mobile phone companies is “inadmissible”, it judges in a decision that affects millions of Germans. Specifically, it is about the question of whether the companies are allowed to pass on certain contract data to credit agencies without the consent of the customer and whether they are allowed to store them. Germany’s most important data protection committee agreed in a decision from September 2021: This has been inadmissible since 2018. The practice would “collect and process large amounts of data about normal everyday processes in economic life” – and without any reason. As a consequence, it could have been the end for the practice. But it probably wasn’t.
Because according to information from NDR and Suddeutscher Zeitung However, the mobile phone companies are apparently resisting this decision and continue to send the contract data to the credit bureaus. And they even want to fight for this right in court. At the same time, the Federal Association of Consumer Organizations (VZBV) itself is taking legal action against the clauses on data transfer and consumer advocates are already preparing injunctive proceedings against individual companies. The dispute, which affects many millions of Germans, threatens to escalate. But why actually?
In detail, this Zoff is about one question: Under what circumstances are mobile phone companies allowed to send the contract data to credit agencies such as Schufa or Crif Bürgel, even though the customers are not guilty of anything? In fact, they need consumer consent to do this.
Until 2018 it was also easy to get. But then the General Data Protection Regulation (GDPR) came into force. It places stricter requirements on when the customer’s consent can be deemed to have been given. As a result, credit agencies and mobile phone companies no longer obtained this consent. Instead, they simply referred to a “legitimate interest” that they had in the data – and happily continued to collect.
What influence does the data have on other important decisions in everyday life?
Some credit bureaus even went a step further. They apparently not only saved the data, but also used it for so-called scores. These decide on important questions in the everyday life of millions of people, for example whether and on what terms consumers can get a loan from the bank. Consumer advocates believe that if the additional data flows in, it may affect the result of the test. It is therefore important to decide under what circumstances mobile phone companies and credit bureaus may actually use the data from these contracts.
On request, the mobile phone association VATM states that the decision of the data protection conference represents a legal opinion of the supervisory authority that they do not share. And: The previous handling of the contract data is “still useful and necessary”. They also want to enforce this in court. “We are currently examining – together with the credit bureaus and the association of business information agencies – the possibilities of having the decision of the data protection conference legally reviewed,” said the association, which includes O2 and Vodafone. Deutsche Telekom, on the other hand, does not want to sue against the decision of the data protection officers. She is not part of the association.
The consumer advocates, on the other hand, share the assessment of the DSK. They see a risk of discrimination in data sharing. Heiko Dünkel, head of the legal enforcement team at VZBV, therefore wants to defend the DSK’s decision. “We are already taking legal action against what we consider to be far too broad data disclosure clauses. Parts of our association family are also currently preparing similar injunctive relief proceedings,” says Dünkel.
Now the Federal Data Protection Commissioner, Ulrich Kelber, is also getting involved in the dispute. He first wants to talk to the mobile phone providers. He should also make his opinion clear to the companies: In his opinion, the decision of the data protection conference is clear that there is no legal basis for the storage of contract data from mobile phones. The mobile phone companies shouldn’t like to hear that.