Hacker News Reader

Comment by mstaoru | Hacker News Reader

I don't quite understand GDPR though as it theoretically let's me remove my personal data from benign websites, but doesn't let me remove my data where I would really want it removed, e.g. (my personal nemesis) SCHUFA, CRIF, Boniversum - which are all private companies.

SCHUFA is especially bad. They gather some strange data, and then "based on statistical analysis" give you a rating that is completely disconnected from reality. It's borderline necessary to rent an apartment, but if you're a new expat, have 2 credit cards, NOT (!) paying a mortgage, or you like to move apartments often, or try buying something with installments and get rejected (...via SCHUFA check...), then you're in a shitlist without any recourse.

View on HN

While you might hate them, you don’t want your data to be removed from their systems. If you’re having a hard time accessing credit with them, imagine what happens when you try to access credit as a ghost.

Right. The problem is, I do not need credit, but in Germany most landlords ask for this SCHUFA report to consider a rental application. They get 100s of applications (there is housing shortage), so not having any report is not working. And if you are a new expat without a permanent address, or you didn't know and tried to check how much something would be with installments (which triggers the application procedure and the rejection - all in one click often), or you just didn't like your first apartment and moved, or you didn't like your first bank, didn't close your credit card, and opened another bank with another credit card - your score is going to go down the drain. Thankfully now at least they have a report on "why" you have a low score. Before Sep 2025 it was just "low" and no explanation. You can check here https://www.schufa.de/en/scoring-data/new-score/index.jsp

I’m not here to defend credit agencies but I will point out that the GDPR does put the onus on them to make sure the information is accurate. This is a net positive.

The power to delete your data with them would actually result in exactly the situation you described, likely without the requester knowing that’s what’ll happen!

Reply on news.ycombinator.com