Summary of the Opinion of the European Data Protection Supervisor on the Proposal for a Directive on consumer credits

(The full text of this Opinion can be found in English, French and German on the EDPS website www.edps.europa.eu)

(2021/C 403/05)

The European Commission adopted on 30 June 2021 a Proposal for a Directive on consumer credits. The Proposal aims to replace Directive 2008/48/EC on credit agreements for consumers and to adapt the current rules to the ongoing digitalisation of the market and other trends (new operators, such as peer-to-peer lending platforms and new forms of consumer credit, such as short-term high-cost loans).

The EDPS welcomes the aim of strengthening consumer protection and recalls the relationship of complementarity between consumer and data protection. The Proposal has a clear impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data, in particular in light of the provisions concerning creditworthiness assessment, personalised offers on the basis of automated processing and the use of personal data in the context of advisory and other activities.

To promote fair access to credit and data protection, the EDPS recommends clearly delineating the categories and sources of personal data that may be used for the purpose of creditworthiness assessment. In particular, the EDPS invites the legislator to strive for increased consumer protection and harmonisation by clearly specifying the categories of data that should and should not be processed. The EDPS also recommends explicitly prohibiting the use of any special categories of personal data under Article 9 of the GDPR.

Taking into account the possible adverse consequences for the persons concerned, the EDPS considers that the requirements, role and responsibilities of credit databases or third parties providing ‘credit scores’ should be addressed. Further clarifications should also be provided regarding the situations where consultation of external sources is necessary and proportionate.

Consumers should always receive meaningful prior information whenever their creditworthiness assessment is based on automated processing. Where the creditworthiness assessment involves the use of profiling or other automated processing of personal data, consumers should be able to request and obtain a human assessment.

As regards personalised offers on the basis of automated processing, the EDPS recommends introducing the obligation for the creditor to provide clear, meaningful and uniform information about the parameters used to determine the price. Moreover, the EDPS encourages the legislator to clearly delineate the categories of personal data that may be used as parameters to draw up a personalised offer.

The EDPS recommends explicitly confirming the full applicability of Regulation 2016/679 (‘GDPR’) to any processing of personal data falling within the scope of the Proposal. Having regard to the Proposal for an Artificial Intelligence Act, the EDPS recommends ensuring that the relevant consumer credit and data protection rules are integrated as part of the (third-party) conformity assessment process prior to CE marking.

1. Background

1. The European Commission adopted on 30 June 2021 a Proposal for a Directive on consumer credits (the ‘Proposal’) ( 1 ) . The Proposal aims to modernise consumer credit rules in order to address changes brought about by digitalisation ( 2 ) and to repeal Directive 2008/48/EC on credit agreements for consumers ( 3 )

2. The Proposal follows a REFIT evaluation, which found that the objectives of Directive 2008/48/EC, namely ensuring high standards of consumer protection and fostering the development of an internal market for credit, are still relevant. At the same time, it found that the regulatory landscape remains significantly fragmented across the EU and that the imprecise wording of some provisions of the Directive leads to legal uncertainty, which both hamper the smooth functioning of the internal market for consumer credit and does not guarantee a consistently high level of consumer protection ( 4 )

3. Against this background, the Proposal aims to strengthen consumer protection by addressing shortcomings regarding the scope of application of Directive 2008/48/EC, enhancing and harmonising the obligation to provide adequate information and explanations to consumers, establishing safeguards related, among others, to interest rates and the cost of the credit, and promoting financial education.

4. The EDPS remarks that the Proposal will have a clear impact on data protection, in particular in light of its provisions concerning: advertising and marketing of credit agreements (Article 7); personalised offers on the basis of automated processing (Article 13); the obligation to assess the creditworthiness of the consumer (Article 18), which may require the consultation of the relevant databases (Article 18(9)), also hosted in a Member State other than the one of the creditor in case of cross-border credit services (Article 19); advisory services (Article 16); activities listed under letters from (a) to (e) of Article 32(1).

5. On 1 July 2021, the European Commission requested the EDPS to issue an opinion on the Proposal, in accordance with Article 42(1) of Regulation (EU) 2018/1725. These comments are limited to the provisions of the Proposal that are relevant from a data protection perspective.

4. Conclusions

In light of the above, the EDPS:

— welcomes the aim pursued by the Proposal of strengthening consumer protection to address the risks posed by digitalisation of consumer credit;

— recalls the relationship of complementarity between consumer and data protection, and the important role that can be played by the latter also in terms of consumer empowerment;

— recommends further delineating the categories of data that may or may not be used for the purpose of creditworthiness assessment and to explicitly prohibit the use of any special categories of personal data under Article 9 of the GDPR in the operative part of the Proposal;

— recommends providing a clearer indication of which external sources may be deemed as ‘relevant’ in the context of creditworthiness assessment;

— recommends addressing the requirements, role and responsibilities of credit databases or third parties providing ‘credit scores’, together with further clarifications regarding the situations where consultation of such external sources is necessary and proportionate;

— recommends adding under Article 18(3) of the Proposal that the procedures for creditworthiness assessment shall include data quality control procedure;

— recommends replacing the term [human] ‘intervention’ with ‘assessment’ in Article 18(6) and recital 48 of the Proposal. Moreover, the EDPS recommends ensuring the consumer is informed where the creditworthiness assessment is based on automated processing in all cases (that is, not only in case of rejection of the application for the loan);

— welcomes the obligation to inform consumers that they are presented with a personalised offer. However, the EDPS recommends adding an obligation to provide clear, meaningful and uniform information about the parameters used to determine the price and to clearly delineate the categories of personal data that may be used as parameters to draw up a personalised offer;

— welcomes the consumer’s right to be informed of the result of a database consultation carried out for the purpose of assessing his or her creditworthiness. However, the EDPS recommends providing for the obligation to inform the applicant in advance of such consultation. The EDPS also recommends harmonising the categories of information which can be contained in the databases for creditworthiness assessment;

— recommends specifying in the Proposal that the use of data collected and processed in the context of creditworthiness assessment for advertising and marketing purposes should not be allowed;

— recommends further delineating in the Proposal which information regarding the consumer’s financial situation, preferences and objectives related to the credit agreement or crowdfunding services may be considered as ‘strictly necessary’ for the purpose of providing advisory services and the activities listed under Article 32(1) of the Proposal;

— recommends including a provision and a corresponding recital on the applicability of the GDPR in the context of the Proposal, and notably to the processing of personal data by creditors and providers of crowdfunding services;

— recalls the need for integrating the requirements under data protection law and consumer credit legislation into the requirements under the proposed Artificial Intelligence Act, in particular in the context the certification of AI systems used for creditworthiness assessment, notably as part of the (third-party) conformity assessment process prior to CE marking.

Brussels, 26 August 2021. p.o. Leonardo CERVERA NAVAS Director Wojciech Rafał WIEWIÓROWSKI

(1) Proposal for a Directive of the European Parliament and of the Council on consumer credits, 30 June 2021, 2021/0171 (COD).

(2) See at page 3 of the Explanatory Memorandum.

(3) Directive 2008/48/EC of the European Parliament and of the Council of 23 April 2008 on credit agreements for consumers and repealing Council Directive 87/102/EEC (OJ L 133, 22.5.2008, p. 66).

(4) See at page 1 of the Explanatory Memorandum.