Germany plans to regulate automated credit scoring
Germany is in the process of revising its Federal Data Protection Act (BDSG) to allow automatic credit scoring, a practice widely accepted in the EU but currently facing legal challenges. This revision aims to clarify that while certain data types are excluded from credit scoring, they are illegal for agencies to use, according to expert opinions. Johannes Müller from the consumer protection organization vzbv suggests that finalization of the revision is imminent and likely to be approved, which would establish clearer guidelines for automated credit assessments.
Under the General Data Protection Regulation (GDPR), automated decisions that significantly impact individuals are prohibited. The Court of Justice of the EU (CJEU) previously ruled that generating reports used in credit decisions can be considered illegal automation, placing third-party scoring providers in a challenging position. The German revision seeks to allow credit scoring under specific transparency and data usage conditions, potentially improving consumer understanding of how their data affects their credit scores.
Despite support for the revision, some experts argue it merely reiterates existing legal protections. Marco Blocher, a data protection lawyer, points out that much of the data excluded from processing should already be illegal to use. The GDPR allows for data processing under “legitimate interest,” but there are concerns that the proposed changes could enable companies to collect more personal data while neglecting user rights. Müller counters this by stating that the revision could actually minimize problematic data use by adhering to GDPR provisions.
The landscape for automatic credit scoring is uneven across Europe, with varying legal interpretations among member states. Credit agencies often rely on a broad dataset to generate scores but face challenges due to limited payment failure data in Germany. As calls for harmonizing European data protection rules grow, industry representatives agree that consistent enforcement is essential. The European Commission’s review of GDPR implementation has highlighted these enforcement issues, emphasizing the need for a unified approach rather than a complete overhaul of the regulation.
Source: Germany posed to regulate automated credit scoring
