text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation), L119, 4.5.2016.

text: Regulation (EU) 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: , L 295, 21.11.2018 Proposal for a Directive of the European Parliament and of the Council on consumer credits, 30.6.2021, 2021/0171 (COD). See at page 3 of the Explanatory Memorandum. Directive 2008/48 of the European Parliament and of the Council of 23 April 2008 on credit agreements for consumers and repealing

text: Council Directive 87/102/EEC

text: , L133, 22.5.2008. See at page 1 of the Explanatory Memorandum. Impact Assessment report accompanying the Proposal, SWD(2021) 170 final, at page 3. BEUC, Review of the Consumer Credit Directive - BEUC Position, April 2019, p. 15, available at: https://www.beuc.eu/publications/beuc-x-2019-019_review_of_the_consumer_credit_directive.pdf. Automation bias is the propensity for humans to favor suggestions from automated decision-making systems and to ignore contradictory information made without automation. See among others Cummings, Mary (2004). "Automation Bias in Intelligent Time Critical Decision Support Systems": “Automation bias occurs in decision-making because humans have a tendency to disregard or not search for contradictory information in light of a computer-generated solution that is accepted as correct and can be exacerbated in time critical domains.” See EDPS “Preliminary Opinion of the European Data Protection Supervisor Privacy and competitiveness in the age of big data: The interplay between data protection, competition law and consumer protection in the Digital Economy”, March 2014, available at: https://edps.europa.eu/sites/edp/files/publication/14-03-26_competitition_law_big_data_en.pdf; Opinion 7/2015, “Meeting the challenges of big data. A call for transparency, user control, data protection by design and accountability”, available at: https://edps.europa.eu/sites/edp/files/publication/15-11-19_big_data_en.pdf; and Opinion 8/2016, “Opinion on coherent enforcement of fundamental rights in the age of big data”, available at: https://edps.europa.eu/sites/edp/files/publication/16-09-23_bigdata_opinion_en.pdf. The EDPS Strategy 2020-2024, Shaping a Safer Digital Future: a New Strategy for a New Decade, available at: https://edps.europa.eu/press-publications/publications/strategy/shaping-safer-digital-future_en European Banking Authority Guidelines on loan origination and monitoring

text: , 29 May 2020, at page 71, Annex 2, available at: https://www.eba.europa.eu/regulation-and-policy/credit-risk/guidelines-on-loan-origination-and-monitoring. For an example of personal data deemed inappropriate to describe solvency, see for example the decision of the Finnish Office of the Data Protection Ombudsman summarised at: https://edpb.europa.eu/news/national-news/2019/data-protection-ombudsman-ordered-svea-ekonomi-correct-itspractices_en. See also the EBA report on big data and advanced analytics, January 2020, automated credit scoring, at page 20, “The most common ML methods used to assess credit applications are regression, decision trees and statistical analysis to generate a credit score using limited amounts of structured data. However, due to the increased availability of data, institutions are increasingly turning to additional data sources, unstructured and semi-structured, including on social media activity, mobile phone use and text message activity, to capture a more accurate view of creditworthiness.” The report is available at: https://www.eba.europa.eu/sites/default/documents/files/document_library/Final%20Report%20on%20Big%20Data%2 0and%20Advanced%20Analytics.pdf Commission Staff Working Document, Evaluation of Directive

text: on credit agreement for consumers, SWD(2020) 254 final, at page 37. See also at pages 62-63: “The European Consumer Organisation BEUC and the Financial Services User Group (FSUG), for instance, have expressed concerns about the new types of personal data (e.g. digital footprints or social network data) collected online (notably by new types of providers such as certain fintech providing online credit or crowdfunding platforms) for verifying the creditworthiness of consumers and the impact this could have on vulnerable consumers in particular and their access to credit.” See also Nikita Aggarwal, ‘The norms of algorithmic credit scoring’, (2021) 80(1) Cambridge Law Journal 42-73 (available at: https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3569083), calling for substantive restrictions on the processing of personal data by credit providers, and supporting the prohibition of the collection and processing of certain types of personal data, such as health related and social media data, that are intrinsic to the person’s identity

text: and autonomy. At page 13, the author notes that “Algorithmic credit scoring, and the wider ecosystem of data-driven, algorithmic decision-making in which it is situated, present a growing threat to consumer privacy and therefore consumer autonomy. First, due to the increased scope for ‘objective’ harm — for example, where consumers’ data are hacked and used to coerce them, inter alia through identity theft [..]. Second, due to the increased scope for ‘subjective’ harm caused by the chilling effects of constant surveillance and behavioural profiling, and consumers’ reduced ability to understand and control how data relating to them are used to shape their (financial) identities.” Commission Staff Working Document, Evaluation of Directive

text: on credit agreement for consumers, SWD(2020) 254 final, at page 36:“The obligations to ensure that, before the conclusion of the credit agreement, the creditor assesses the consumer’s creditworthiness on the basis of “sufficient information” has been implemented differently across the EU. Although

text: Article 8

text: has been fully transposed, its practical implementation varies significantly between Member States, leading to a diverse regulatory landscape, as shown by a mapping of national approaches in relation to creditworthiness assessment (CWA) carried out by the Commission. The majority of Member States defined more detailed information to be taken into account in the CWA. In a number of them the consultation of databases is compulsory for creditors. This implies, that, depending on the Member States, the amount and categories of data collected by creditors, as well as the techniques to do so, differ greatly.” In this regard, see also

text: Case 9/56

text: , Meroni & Co., Industrie Metallurgiche, SpA v High Authority of the European Coal and Steel Community, ECLI:EU:C:1958:7, ruling on the possible extent of delegation of powers. Proposal for Regulation of the European Parliament and of the Council laying down harmonized rules on artificial intelligence (Artificial Intelligence Act) and amending certain Union legislative acts, COM(2021) 206 final. See EDPB, Guidelines on Automated individual decision-making and Profiling for the purposes of Regulation 2016/679 specify, at page 27, stating that “Human intervention is a key element. Any review must be carried out by someone who has the appropriate authority and capability to change the decision. The reviewer should undertake a thorough assessment of all relevant data, including any additional information provided by the data subject.” See also at page 32, referring, as good practice recommendation, to “agreed timescales for the review”. See paragraph 21, at page 9 of the EDPB-EDPS Joint Opinion on the Artificial Intelligence Act. See paragraph 21, at page of the EDPB-EDPS Joint Opinion on the Artificial Intelligence Act, adding that “[e]ven if the initial risk assessment by the provider does not indicate that the AI system is “high-risk”" under the Proposal, this should not exclude a subsequent (more granular) assessment (data protection impact assessment (‘DPIA’) under Article 35 of the GDPR, Article 39 of EUDPR or under Article 27 of the LED) that should be made by the user of the system, considering the context of use and the specific use cases”. The EDPB Guidelines on automated individual decision-making and profiling for the purposes of Regulation 2016/679 specify at page 22 that “Automated decision-making that results in differential pricing based on personal data or personal characteristics could also have a significant effect if, for example, prohibitively high prices effectively bar someone from certain goods or services.” Another example of decisions having a significant effect concerns “decisions that affect someone’s financial circumstances, such as their eligibility to credit”. Article 19 of the Proposal: “1. Each Member State shall in the case of cross-border credit ensure access for creditors and providers of crowdfunding credit services from other Member States to databases used in that Member State for assessing the creditworthiness of consumers. The conditions for access to such databases shall be non-discriminatory. 2. Paragraph 1 shall apply both to public and private databases. 3. The databases referred to in paragraph 1 shall hold at least information on consumers’ arrears in payment. 4. Where the credit application is rejected on the basis of a consultation of a database referred to in paragraph 1, Member States shall require that the creditor or the provider of crowdfunding credit services informs the consumer immediately and free of charge of the result of such consultation and of the details of the database consulted.” “(49) To assess the credit status of a consumer, the creditor or the provider of crowdfunding credit services should also consult credit databases. The legal and actual circumstances may require that such consultations vary in scope. To prevent any distortion of competition among creditors or providers of crowdfunding credit services, they should have access to private or public credit databases concerning consumers in a Member State where they are not established under nondiscriminatory conditions compared with creditors or providers of crowdfunding credit services established in that Member State. Member States should facilitate the cross-border access to private or public databases, in compliance with the

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council. To enhance reciprocity, credit databases should as a minimum hold information on consumers’ arrears in payment, in accordance with Union and national law. (50) Where a decision to reject an application for credit is based on the consultation of a credit database, the creditor or the provider of crowdfunding credit services should inform the consumer of this fact and of the information about him or her hold in the database consulted.” In the same sense, see EDPS Opinion on credit agreements relating to residential property, 25 July 2011, at paragraph 14: (emphasis added): “The EDPS therefore suggests some modifications to the text of the Directive with the purpose of addressing the shortcomings identified above. Any access to the database should be subject to the following conditions, which should be introduced in the text of

text: Article 16

text: : (i) definition of the criteria on the basis of which creditors or credit intermediaries can have access to the database and, in particular, clarification of whether only creditors or credit intermediaries who concluded a contract with a consumer or are required by the consumer to take steps to conclude a contractual relationship with him can have access to his or her data; (ii) obligation to communicate in advance to the

text: consumer that a certain creditor or credit intermediary has the intention to access his or her personal data 16

text: in the database; (iii) obligation to contemporaneously communicate to the consumer of his or her rights to access, rectify, block or erase the data contained in the database pursuant to the principles of Directive

text: .” The Opinion is available at: https://edps.europa.eu/sites/default/files/publication/11-07-25_credit_agreements_en.pdf The Mortgage Directive (Directive

text: of the European Parliament and of the Council of 4 February 2014 on credit agreements for consumers relating to residential immovable property and amending Directives

text: and

text: and

text: Regulation (EU) No 1093/2010

text: , OJ L 60, 28.2.2014, p. 34–85, under

text: Article 18(5)

text: (b), lays down: “[Member States shall ensure that:] (b) in accordance with

text: Article 10 of Directive 95/46/EC

text: , the creditor informs the consumer in

text: advance that a database is to be consulted”.

text: See Commission Staff Working Document, Evaluation of Directive

text: on credit agreement for consumers, SWD(2020) 254 final, at pages 39 and 40 in particular: “Although only a few Member States reported different requirements for foreign providers, industry representatives specifically referenced the different requirements to access

text: credit databases in other Member States or the differences in the content of such databases as one of the main

text: obstacles to accessing the information needed to conduct creditworthiness assessments for foreign consumers. Since the Directive did not establish the nature, coverage, type and breadth of the data contained in the databases, these differ extensively between Member States, obstructing the effective exchange of data across Member States. This lack of uniformity in the data can also give an incomplete picture of the consumer that can prevent credit providers from carrying out a sound creditworthiness assessment. Indeed these databases can include only negative data (such as in France, where the public register only includes data about arrears on repayment or application to the over-indebtedness commissions) or, most frequently, both negative and positive (such as ongoing financial commitments) data. There is also a growing push from certain credit providers and credit registers to include “non-traditional data” (such as data from GPS, social media, web-browsing) in these database. However the added value of such data, its proportionality and compliance with data protection rules is challenged, for instance by consumer organisations (see EQ4).” Article 12 of the Proposal: “Member States shall ensure that creditors and, where applicable, credit intermediaries and providers of crowdfunding credit services are required to provide adequate explanations to the consumer on the proposed credit agreements or crowdfunding credit services and any ancillary services that make it possible for the consumer to assess whether the proposed credit agreements or crowdfunding credit services and ancillary services are adapted to his or her needs and financial situation. The explanations shall include the following elements: (a) the information referred to in Article

text: and

text: ; (b) the essential characteristics of the credit agreement, crowdfunding credit services or ancillary services proposed; (c) the specific effects that the credit agreement, crowdfunding credit services or ancillary services proposed may have on the consumer, including the consequences of payment default or late payment by the consumer; (d) where ancillary services are bundled with a credit agreement or crowdfunding credit services, whether each component of the bundle can be terminated separately and the implications for the consumer of such termination. 2. Member States may adapt the requirement referred to in paragraph 1 with regard to the manner in which the explanations shall be given and the extent to which they shall be given to the following: (a) the circumstances of the situation in which the credit is offered; (b) the person to whom the credit is offered; (c) the nature of the credit offered.” See the WP29 (endorsed by EDPB) Guidelines on Automated individual decision-making and Profiling for the purposes of Regulation 2016/679, at page 25, on the obligation for the controller (in this case, the creditor) to provide meaningful information about the logic involved (in the processing of personal data): “The growth and complexity of machine-learning can make it challenging to understand how an automated decision-making process or profiling works. The controller should find simple ways to tell the data subject about the rationale behind, or the criteria relied on in reaching the decision. The GDPR requires the controller to provide meaningful information about the logic involved, not

text: necessarily a complex explanation of the algorithms used or disclosure of the full algorithm. The information

text: provided should, however, be sufficiently comprehensive for the data subject to understand the reasons for the decision. Example: A controller uses credit scoring to assess and reject an individual’s loan application. The score may have been provided by a credit reference agency, or calculated directly based on information held by the controller. Regardless of the source (and information on the source must be provided to the data subject under

text: Article 14 (2)

text: (f) where the personal data have not been obtained from the data subject), if the controller is reliant upon this score it must be able to explain it and the rationale, to the data subject. The controller explains that this process helps them make fair and responsible lending

text: decisions. It provides details of the main characteristics considered in reaching the decision, the source of this

text: information and the relevance. This may include, for example: the information provided by the data subject on the application form; information about previous account conduct, including any payment arrears; and official public records information such as fraud record information and insolvency records. The controller also includes information to advise the data subject that the credit scoring methods used are regularly tested to ensure they remain fair, effective and unbiased. The controller provides contact details for the data subject to request that any declined decision is reconsidered, in line with the provisions of

text: Article 22(3)

text: .” (emphasis added) It is worth also recalling that the EDPB Guidelines on automated individual decision-making and profiling further highlight the importance of transparency (intertwined with the fairness principle) towards the data subject referring among others to payday (short term high cost) loans: “Processing also has to be fair, as well as 17

text: transparent. Profiling may be unfair and create discrimination, for example by denying people access to employment opportunities, credit or insurance, or targeting them with excessively risky or costly financial products. The following example, which would not meet the requirements of

text: Article 5(1)

text: (a), illustrates how unfair profiling can lead to some consumers being offered less attractive deals than others. Example: A data broker sells consumer profiles to financial companies without consumer permission or knowledge of the underlying data. The profiles define consumers into categories (carrying titles such as “Rural and Barely Making It,” “Ethnic Second-City Strugglers,” “Tough Start: Young Single Parents,”) or “score” them, focusing on consumers’ financial vulnerability. The financial companies offer these consumers payday loans and other “non-traditional” financial services (high-cost loans and other financially risky products).” On automated decision-making in the context of Artificial Intelligence Systems and transparency, see, among others: Ostmann, F., and Dorobantu C., (2021), “AI in financial services. The Alan Turing Institute”, available at: https://doi.org/10.5281/zenodo.4916041 Recital (25): “This Directive respects fundamental rights and observes the principles recognised in particular by the Charter of Fundamental Rights of the European Union (‘the Charter’). In particular, this Directive fully respects the rights to the protection of personal data, to property, to non-discrimination, to protection of family and professional life, and to consumer protection pursuant to the Charter.” See WP29 (endorsed by EDPB) Guidelines on Data Protection Impact Assessment (DPIA) and determining whether processing is “likely to result in a high risk” for the purposes of Regulation 2016/679,

text: WP 248

text: rev.01, referring at page 9 to “evaluation or scoring” as one of the nine criteria for determining the qualification as “likely to result in a high risk” processing operations and providing in this regard the following example: “a financial institution that screens its customers against a credit reference database”. Proposal for a Regulation of the European Parliament and of the Council laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) and amending certain Union legislative acts, 2021/0106 (COD). See Annex III, 5.(b) of the Artificial Intelligence Act. The clarification of the relationship between the Proposal and the Artificial Intelligence Act is also necessary due to the broad definition of ‘Artificial Intelligence System’ under

text: Article 3

text: , letter (a) of the Artificial Intelligence Act: “‘artificial intelligence system’ (AI system) means software that is developed with one or more of the techniques and approaches listed in Annex I and can, for a given set of human-defined objectives, generate outputs such as content, predictions, recommendations, or decisions influencing the environments they interact with.” Such broad definition would in fact apply to most cases of ‘algorithmic scoring’, including creditworthiness assessments. EDPB-EDPS Joint Opinion 5/2021 on the proposal for a Regulation of the European Parliament and of the Council laying down harmonised rules on artificial intelligence (Artificial Intelligence Act), 18 June 2021, available at: https://edpb.europa.eu/system/files/2021-06/edpb-edps_joint_opinion_ai_regulation_en.pdf See at paragraph 23 of the EDPB-EDPS Joint Opinion 5/2021: “[..] the compliance with legal obligations arising from Union legislation (including on the personal data protection) should be precondition to being allowed to enter the European market as CE marked product. To this end, the EDPB and the EDPS recommend including in Chapter 2 of Title III of the Proposal the requirement to ensure compliance with the GDPR and the EUDPR. These requirements shall be audited (by third party audit) before the CE marking in line with the accountability principle.” See also paragraphs 36-37 of the EDPB-EDPS Joint Opinion 5/2021. See at paragraphs 36-37 of the EDPB-EDPS Joint Opinion 5/2021. See at paragraph 76 of the EDPB-EDPS Joint Opinion 5/2021: “The Proposal is missing a clear relation to the data protection law as well as other EU and Member States law applicable to each ‘area’ of high-risk AI system listed in Annex III. In particular, the proposal should include the principles of data minimization and data protection by design as one of the aspects to take into consideration before obtaining the CE marking, given the possible high level of interference of the high-risk AI systems with the fundamental rights to privacy and to the protection of personal data, and the need to ensure a high level of trust in the AI system. Therefore, the EDPB and the EDPS recommend amending the Proposal so as to clarify the relationship between certificates issued under the said Regulation and data protection certifications, seals and marks. Lastly, the data protection authorities should be involved in the preparation and establishment of harmonized standards and common specifications.” See also the Executive Summary, at page 3: “The certification system outlined in the Proposal is missing a clear relation to the EU data protection law as well as to other EU and Member States’ law applicable to each ‘area’ of high-risk AI system and is not taking into account the principles of data minimization and data protection by design as one of the aspects to take into consideration before obtaining the CE marking. Therefore, the EDPB and the EDPS recommend amending the Proposal as to clarify the relationship between certificates issued under the said Regulation and data protection certifications, seals and marks. Lastly, the DPAs should be involved in the preparation and establishment of harmonized standards and common specifications.”

identifier: EDPS yttrande 11/2021

amnesord:
Consumers
Finance & Economy

publisher: Europeiska datatillsynsmannen

sprak: en

title: EDPS Opinion on the Proposal for a Directive on consumer credits

serie: yttranden

text: 26 August 2021

type: rubrik

text: Opinion 11/2021

text: on the Proposal for a Directive on consumer credits

type: stycke

text: The European Data Protection Supervisor (EDPS) is an independent EU authority, responsible under under

text: Article 52(2) of Regulation (EU) No 2018/1725

text: ‘[w]ith respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under

text: Article 52(3)

text: thereof ‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’. Under

text: Article 58(3)

text: (c) of Regulation 2018/1725, the EDPS shall have the power ‘to issue on his or her own initiative or on request, opinions to Union institutions and bodies and to the public on any issue related to the protection of personal data’.

text: Wojciech Wiewiorówski was appointed as Supervisor on 5 December 2019 for a term of five years. Under

text: Article 42(1) of Regulation (EU) No 2018/1725

text: , the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to

text: Article 218

text: TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’ and under

text: Article 57(1)

text: (g), the EDPS shall ‘advise on his or her own initiative or on request, all Union institutions and bodies on legislative and administrative measures relating to the protection of natural persons’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the EDPS’ mission to advise the EU institutions on coherently and consistently applying the EU data protection principles. This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Article 58 of Regulation (EU) 2018/1725

text: Executive Summary

text: The European Commission adopted on 30 June 2021 a Proposal for a Directive on consumer credits. The Proposal aims to replace Directive

text: on credit agreements for consumers and to adapt the current rules to the ongoing digitalisation of the market and other trends (new operators, such as peer-to-peer lending platforms and new forms of consumer credit, such as shortterm high-cost loans).

text: The EDPS welcomes the aim of strengthening consumer protection and recalls the relationship of complementarity between consumer and data protection. The Proposal has a clear impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data, in particular in light of the provisions concerning creditworthiness assessment, personalised offers on the basis of automated processing and the use of personal data in the context of advisory and other activities.

text: To promote fair access to credit and data protection, the EDPS recommends clearly delineating the categories and sources of personal data that may be used for the purpose of creditworthiness assessment. In particular, the EDPS invites the legislator to strive for increased consumer protection and harmonisation by clearly specifying the categories of data that should and should not be processed. The EDPS also recommends explicitly prohibiting the use of any special categories of personal data under Article 9 of the GDPR.

text: Taking into account the possible adverse consequences for the persons concerned, the EDPS considers that the requirements, role and responsibilities of credit databases or third parties providing ‘credit scores’ should be addressed. Further clarifications should also be provided regarding the situations where consultation of external sources is necessary and proportionate.

text: Consumers should always receive meaningful prior information whenever their creditworthiness assessment is based on automated processing. Where the creditworthiness assessment involves the use of profiling or other automated processing of personal data, consumers should be able to request and obtain a human assessment.

text: As regards personalised offers on the basis of automated processing, the EDPS recommends introducing the obligation for the creditor to provide clear, meaningful and uniform information about the parameters used to determine the price. Moreover, the EDPS encourages the legislator to clearly delineate the categories of personal data that may be used as parameters to draw up a personalised offer.

text: The EDPS recommends explicitly confirming the full applicability of Regulation 2016/679 (‘GDPR’) to any processing of personal data falling within the scope of the Proposal. Having regard to the Proposal for an Artificial Intelligence Act, the EDPS recommends ensuring that the relevant consumer credit and data protection rules are integrated as part of the (third-party) conformity assessment process prior to CE marking.

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union, and in particular

text: Article 16

text: thereof,

text: Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles

text: and

text: thereof,

text: Having regard to

text: Regulation (EU) 2016/679

text: (the General Data Protection Regulation) ,

text: Having regard to

text: Regulation (EU) No 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1 Background

text: 1. The European Commission adopted on 30 June 2021 a Proposal for a Directive on consumer credits (the “Proposal”) . The Proposal aims to modernise consumer credit rules in order to address changes brought about by digitalisation and to repeal Directive

text: on credit agreements for consumers .

text: 2. The Proposal follows a REFIT evaluation, which found that the objectives of Directive

text: , namely ensuring high standards of consumer protection and fostering the development of an internal market for credit, are still relevant. At the same time, it found that the regulatory landscape remains significantly fragmented across the EU and that the imprecise wording of some provisions of the Directive leads to legal uncertainty, which both hamper the smooth functioning of the internal market for consumer credit and does not guarantee a consistently high level of consumer protection .

text: 3. Against this background, the Proposal aims to strengthen consumer protection by addressing shortcomings regarding the scope of application of Directive

text: , enhancing and harmonising the obligation to provide adequate information and explanations to consumers, establishing safeguards related, among others, to interest rates and the cost of the credit, and promoting financial education.

text: 4. The EDPS remarks that the Proposal will have a clear impact on data protection, in particular in light of its provisions concerning: advertising and marketing of credit agreements (

text: Article 7

text: ); personalised offers on the basis of automated processing (

text: Article 13

text: ); the obligation to assess the creditworthiness of the consumer (

text: Article 18

text: ), which may require the consultation of the relevant databases (

text: Article 18(9)

text: ), also hosted in a Member State other than the one of the creditor in case of cross-border credit services (

text: Article 19

text: ); advisory services (

text: Article 16

text: ); activities listed under letters from (a) to (e) of

text: Article 32(1)

text: . 4

text: 5. On 1 July 2021, the European Commission requested the EDPS to issue an opinion on the Proposal, in accordance with

text: Article 42(1) of Regulation (EU) 2018/1725

text: . These comments are limited to the provisions of the Proposal that are relevant from a data protection perspective.

text: 2 General comments

text: 6. The EDPS welcomes the objective of the Proposal, which aims to strengthen consumer protection, taking into account the increased digitalisation in the consumer credit sector. The Impact Assessment accompanying the Proposal identifies a number of important developments which entail the need for additional protection, including: - the emergence of new actors such as peer-to-peer lending platforms; - the increased use of online sales channels; - the placing on the market of new products such as short-term high-cost loans, that can lead to significant costs for the borrower; - the increased use of automated decision-making for credit scoring and the use of personal data not directly provided by consumers for assessing their creditworthiness; - the increased financial vulnerability of many households in the European Union due to the COVID-19 crisis. These trends, as noted in the Impact Assessment, “raise questions in terms of consumer and data protection and potential discrimination from decisions based on opaque algorithms” .

text: 7. An additional serious concern, not sufficiently addressed in the current Proposal, exists in relation to what types and sources of data are used by lenders to assess consumers’ creditworthiness and how artificial intelligence algorithms and interpret those data. Some lenders and lending platforms have started using consumer data from external, non-traditional sources to build credit scores (e.g. social media data or consumer browsing history) . Leaving it up to lenders to define which types of data are relevant for creditworthiness assessment might not only be contrary to the principle of data minimisation, but also leads to unfair commercial practices. The absence of clear and specific rules, as to the amount and type of personal data that creditors may process in the context of creditworthiness assessments, entails significant risks of excessive and unfair data processing. These risks are further increased in light of automation bias in case of algorithmic decision-making.

text: 8. Against this background, the EDPS recalls the relationship of complementarity between consumer and data protection . In the context of consumer credit, the use of personal data has a determinative impact on the on the ability of individuals to obtain fair access to credit. While objectively assessing the creditworthiness of consumers is clearly necessary, both in the interest of creditors and consumers, appropriate safeguards must be in place to ensure that individual consumers are sufficiently protected as regards the processing of their personal data. In this sense, data protection also means consumer (financial) protection.

text: 9. The EDPS notes and welcomes the measures contained in the Proposal that seek to address these issues, notably those specifying the type of information that should be used during a creditworthiness assessment, as well as consumers’ rights and procedures to be implemented in case of automated decision-making to conduct the creditworthiness assessment. At the same time, the EDPS formulates a number of recommendations to further strengthen the protection of personal data, and ultimately consumers’ protection.

text: 10. The overall aim of these recommendations is, consistently with the EDPS Strategy 2020- 2024 , to ensure a digital economy that provides adequate protection to individuals, especially 5 the most vulnerable ones. This means in practice addressing the information and power asymmetries in the digital economy (in this case, between lenders and borrowers, in consumer credit markets) by ensuring clear obligations for providers of financial services to provide meaningful information and ensure transparency (on the databases consulted, on profiling and automated decision-making, on price personalisation and the logic involved). It also means limiting ex ante the types of personal data that can be used for creditworthiness assessment, and consumer lending more broadly, to what is necessary and proportionate (for instance, by excluding for instance social media activity or online search queries, online browsing data, health data such as cancer data, as well as any special category of personal data under Article 9 of the GDPR). Ensuring compliance with the principle of proportionality in the processing of personal data would also help protect consumers from being targeted at moments of vulnerability with unfair credit offers (for instance, highcost payday loans).

text: 3 Specific comments

text: 3.1 Information and sources of information for the assessment of creditworthiness

text: 11. Article 18(2) of the Proposal specifies that the assessment of creditworthiness shall be carried out on the basis of “relevant and accurate information on the consumer’s income and expenses and other financial and economic circumstances which is necessary and proportionate” (emphasis added). Examples provided include evidence of income or other sources of repayment, information on financial assets and liabilities, or information on other financial commitments.

text: 12. In terms of sources of information, the Proposal specifies that the information shall be obtained from relevant internal or external sources, including the consumer and, where necessary, on the basis of a consultation of a database referred to in

text: Article 19

text: . The information obtained in accordance with this paragraph shall be appropriately verified, where necessary through reference to independently verifiable documentation.

text: 13. Recital 47 of the Proposal provides further indications on the types of information that should be used to assess creditworthiness, referring to information on the financial and economic situation, including income and expenses of the consumer. Reference is also made to the European Banking Authority’s Guidelines on loan origination and monitoring (

text: ), which contain guidelines on what categories of data may be used for the processing of personal data for creditworthiness purposes. Those Guidelines refer a.o. to evidence of income or other sources of repayment, information on financial assets and liabilities, or information on other financial commitments .

text: 14. Recital 47 of the Proposal also offers indications on the types of information which should not be used to assess creditworthiness. It states in particular that “[p]ersonal data, such as

text: personal data found on social media platforms or health data, including cancer data, should not be used when conducting a creditworthiness assessment.” (emphasis added)

text: 15. The EDPS considers the aforesaid clarifications important and directly related to the principle of data minimisation established under

text: Article 5(1)

text: (c) of the GDPR, according to which personal data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed. This means in practice that data for the creditworthiness assessment should have a clear relationship with the borrower’s ability to repay the loan and not have a disproportionate or unexpected impact on the fundamental rights to privacy and to the protection of personal data of the person concerned. 6

text: 16. As indicated above, digitalisation has increased the number and categories of data about consumers generated online, also impacting creditworthiness assessment practices by financial companies relying, among other sources, upon the use of social media data . However, as noted in the Commission Staff Working Document, Evaluation of Directive

text: on credit agreement for consumers, “[s]uch novel techniques are presented by the industry as a way to help consumers with a thin credit profile to obtain a loan which they would, under more traditional CWA [creditworthiness assessment] practices, not be able to receive. However, they raise questions in terms of their actual added value compared to more traditional techniques. These practices, which are often directed at vulnerable consumers, can indeed circumvent the need for a solid credit history and sound financial situation, but it is unclear their accuracy and robustness on the assessment of the ability of the consumers to reimburse the credit. They also raise questions in

text: terms of respect of data protection legislation, in particular the principles of transparency, fairness, data minimisation and purpose limitation.”

text: 17. The EDPS therefore welcomes the specification under recital 47 that personal data found on social media platforms or health data, including cancer data, should not be used when conducting a creditworthiness assessment. However, the EDPS recommends explicitly extending the prohibition to all special categories of data under Article 9 of Regulation 2016/679, and not just health data. Along the same lines, the EDPS considers that inferring consumers’ credit risk from data such as search query data or online browsing activities cannot be reconciled with the principles of purpose limitation, fairness and transparency, as well as relevance, adequacy or proportionality of data processing. Therefore, the EDPS recommends explicitly extending the prohibition to search query data or online browsing activities.

text: 18. To ensure harmonisation , as well as promote fair access to credit and a higher level of data protection, the EDPS recommends further specifying the categories of data to be processed for creditworthiness assessment in the operative part of the Proposal. The Proposal itself should include a clear overview of the categories of personal data that can be processed (e.g., information concerning financial assets and liabilities, evidence of income etc.), rather than referring to guidance alone. Specifying the categories of data which can be used for creditworthiness assessment by financial actors would improve legal certainty and should be developed in a manner that promotes compliance with the principles of data minimisation, proportionality and fairness.

text: 19. In addition, the EDPS considers that the Proposal should provide a clear and comprehensive indication of which external sources should be deemed as “relevant” in the context of creditworthiness assessment. In particular, taking into account the possible adverse consequences to the persons concerned, the requirements, role and responsibilities of credit databases or third parties providing ‘credit scores’ should also be explicitly regulated by the Proposal. The EDPS also recommends providing further clarifications regarding the situations where consultation of such external sources is necessary and proportionate, recalling that the aforementioned prohibitions regarding certain categories of data should in any event remain applicable.

text: 20. To enhance transparency regarding the processing of personal data by ‘third parties’ (that is, other than the creditor and the borrower), the EDPS recommends specifying in the Proposal that Member States shall require the creditor to provide information in advance to the loan applicant about the external sources that will be consulted and about his or her data subjects rights having regard to these sources. 7 3.2 Procedures for creditworthiness assessment

text: 21. Article 18(3) of the Proposal states that Member States shall require that the creditor or, where applicable, the provider of crowdfunding credit services, establishes procedures for the creditworthiness assessment and that the creditor or the provider of crowdfunding credit services documents and maintains such procedures. Member States shall also require that the creditor or the provider of crowdfunding credit services documents and maintains the information referred to in Article 18(2) of the Proposal.

text: 22. The EDPS notes that the financial decision triggered by creditworthiness assessment might have significant impact on the persons affected. It is therefore essential that the creditors have data quality control mechanisms in place providing the highest possible level of accuracy of the information processed for the purpose of creditworthiness assessment.

text: 23. Hence, the EDPS recommends adding to

text: Article 18(3)

text: that the procedures for creditworthiness assessment shall include data quality control mechanism (in particular, periodic reviews of data to ensure that data are accurate and updated) ensuring the highest possible data quality, in compliance with the principle of accuracy under

text: Article 5(1)

text: (d) of the GDPR. The documentation of such procedures, to be integrated with the data quality aspect, shall allow the controller (the creditor, in this case) to demonstrate data protection compliance according to the accountability principle (Article 5(2) of the GDPR).

text: 24. The EDPS also notes that Article 18(3) of the Proposal does not provide any indication as to how long the data may or should be retained. It also does not differentiate between the situation where the request for credit has been granted or rejected. In accordance with the principle of storage limitation, personal data shall be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed (

text: Article 5(1)

text: (e) of the GDPR). To increase legal certainty and promote harmonisation, the EDPS recommends specifying the maximum period for which the data may be retained by the creditor or provider, taking into account whether the request for credit has been granted or rejected. In case of rejection, data about the loan applicant should in principle be retained for less time than in case the loan is granted, according to a maximum retention period starting from the rejection of the application to the loan (taking into account also the right of the applicant to contest the decision). 3.3 Consumer rights regarding creditworthiness assessment

text: Article 18(6)

text: states that where the creditworthiness assessment involves the use of profiling or other automated processing of personal data, Member States shall ensure that the consumer has the right to: (a) request and obtain human intervention on the part of the creditor or the provider of crowdfunding credit services to review the decision; (b) request and obtain from the creditor or the provider of crowdfunding credit services a clear explanation of the assessment of creditworthiness, including on the logic and risks involved in the automated processing of personal data as well as its significance and effects on the decision; (c) express his or her point of view and contest the assessment of the creditworthiness and the decision.

text: 26. Recital 48 of the Proposal recalls that the Proposal for Regulation laying down harmonized rules on artificial intelligence (Artificial Intelligence Act) , specifies that AI systems used to 8 evaluate the credit score or creditworthiness of natural persons should be classified as high-risk AI systems, since they determine those persons’ access to financial resources or essential services such as housing, electricity, and telecommunication services. Recital 48 further states that “[i]n view of those high stakes, whenever the creditworthiness

text: assessment involves automated processing, the consumer should have a right to obtain

text: human intervention on the part of the creditor or providers of crowdfunding credit services. The consumer should also have the right to obtain a meaningful explanation of the assessment made and of the functioning of the automated processing used, including among others the main variables, the logic and risks involved, as well as a right to express his or her point of view and to contest the assessment of the creditworthiness and the decision.”

text: 27. The EDPS welcomes the inclusion of these rights, which are similar in substance to those provided by Article 22 of the GDPR in cases involving automated decision-making. Indeed, this specification enhances legal certainty, harmonisation (a ‘level playing field’ for creditors) and ultimately consumer protection in case of consumer credit assessment involving automated processing, including, but without being limited to, cases involving profiling and/or automated decision-making within the meaning of

text: Article 22

text: GDPR.

text: 28. However, the EDPS recommends replacing the term ‘intervention’ with ‘assessment’ under

text: Article 18(6)

text: and recital 48. Indeed, given the high risk for consumers, as well as the increased automation bias, the EDPS considers that the term “assessment”, implying a thorough human review at the point the automated decision is delivered (accompanied by timescale and named contact point for queries by consumers) , is better suited to address or mitigate the risk of financial exclusion triggered by the decision on the applicant’s eligibility to the loan.

text: 29. The EDPS also recalls the EDPB-EDPS Joint Opinion on the Artificial Intelligence Act, stating that the classification of an AI system as high-risk triggers a presumption of high-risk under the GDPR to the extent that personal data is processed . The user of the AI system should therefore carry out a data protection impact assessment under Article 35 of the GDPR before the system is used .

text: 30. The EDPS also notes that

text: Article 18(7)

text: provides that “Member States shall ensure that where the credit application is rejected the creditor or the provider of crowdfunding credit services is required to inform the consumer without delay of the rejection and, where applicable, of the fact

text: that the assessment of creditworthiness is based on automated processing of data.”

text: (emphasis added)

text: 31. In this regard, the EDPS recalls that the data subject (in this case, the consumer/borrower) shall be informed about profiling and automated decision-making concerning him or her and be provided with meaningful information about the logic involved, the significance and the consequences of the processing, pursuant to Articles 13 and 14 of the GDPR, in all cases of decisions significantly affecting the data subject (that is, not only in case of rejection of the credit application, since a credit may still be granted to the borrower, but - as indicated at Section 3.5 of this Opinion - at an excessive or ‘unfair’ price ).

text: 32. In the interest of clarity and legal certainty, the EDPS recommends amending Article 18(7) of the Proposal to clarify that the information shall be provided regardless of whether the application is rejected or granted. To enhance consumer protection, the EDPS also recommends specifying that individuals should be explicitly informed of their rights under Article 18(6) of the Proposal at the moment where the application is rejected or granted. 9

text: 33. Finally, the EDPS recalls the risk of bias inherent to algorithmic decision-making. In order to avoid discrimination based on bias, the creditor should, also on the basis of a data protection impact assessment, take adequate organisational and technical measures to address this risk. 3.4 Consultation of relevant databases in the context of the creditworthiness assessment

text: 34. Article 18(9) of the Proposal states that “[m]ember States whose legislation requires creditors or providers of crowdfunding credit services to assess the creditworthiness of consumers on the basis of a consultation of the relevant database may retain this requirement.” Moreover,

text: Article 19

text: specifies the possibility of cross-border access to databases in case of cross-border credit services . The provisions under Articles

text: and

text: are further specified under recitals 49 and 50 of the Proposal .

text: Article 10(3)

text: , letter (r) and

text: Article 11(2)

text: , letter (l) of the Proposal provide that the pre-contractual information must specify “the consumer’s right to be informed immediately and free of charge, pursuant to

text: Article 19(2)

text: , of the result of a database consultation carried out for the purposes of assessing his or her creditworthiness.”

text: 36. In this regard, the EDPS recommends adding to the information to be provided to consumers pursuant to Articles 10 and 11 of the Proposal “the indication of the relevant databases that may be consulted by the creditor or provider of crowdfunding service, of her or his data subject rights in relation to such sources and of a named contact point for the exercise of those rights”. The EDPS stresses that this information should be provided before the consultation of the database takes place, together with a reference to data subjects’ rights and to a named contact point for the exercise of those rights.

text: 37. Providing ex ante information to consumers about the databases that may be consulted and of her or his data subject rights in relation to such sources would provide the data subject (consumers applying for the loan) the possibility to effectively and usefully exercise his or her data subject’s rights (for instance, the right to rectification under Article 16 of the GDPR), thus enhancing data quality .

text: 38. The EDPS also recommends harmonising the categories of information that can be contained in the databases for creditworthiness assessment. Such harmonisation would in fact be beneficial in particular to cross-border database consultation, leading to more accurate creditworthiness assessments . Furthermore, the EDPS recommends including in the Proposal clear indicators to specify when the relevant databases might be consulted by creditors, specifying the term ‘where necessary’ in

text: Article 18(2)

text: . In particular, the Proposal should specify the criteria on the basis of which creditors can have access to the database and, in particular, clarify whether only creditors who are requested by the consumer to take steps to conclude a contractual relationship with him or her can have access to his or her data. 3.5 Consumer rights having regard to the personalised offer (loan pricing)

text: Article 13

text: provides that Member States shall require that creditors, credit intermediaries and providers of crowdfunding credit services inform consumers when they are presented with a personalised offer that is based on profiling or other types of automated processing of personal data. Recital 40 further states that creditors, credit intermediaries and providers of crowdfunding credit services should be allowed to personalise the price of their offers for specific consumers or specific categories of consumer based on automated decision-making and profiling of consumer behaviour allowing them to assess the consumer’s purchasing 10 power. Consumers should therefore be clearly informed when the price presented to them is personalised on the basis of automated processing, so that they can take into account the potential risks in their purchasing decision.

text: Article 10(3)

text: , letter (t) and

text: Article 11(2)

text: , letter (m) also refer to the obligation of the creditor to provide the consumer “where applicable, an indication that the price was personalised on the basis of automated processing, including profiling”. Finally,

text: Article 12

text: lays down the obligation for creditors to provide “adequate explanations”, including the elements of letters (a)-(d) of paragraph 1 .

text: 40. In this regard, the EDPS notes that

text: Article 13

text: contains a transparency obligation, but it does not provide as such a lawful legal basis for the processing of personal data within the meaning of the GDPR. As result, any personalised pricing of consumer credit still requires a valid legal basis under Article 6 of the GDPR, as well as compliance with other data protection principles, including the principles of fairness and purpose limitation.

text: 41. While the Proposal’s aim to increase transparency is welcome, the EDPS is concerned that

text: Article 13

text: might be seen as implicitly legitimating personalised processing in ways that exacerbate existing information and power asymmetries between consumers and providers. For this reason, the EDPS recommends to revise recital 40, further regulating the use of personalised offers in consumer credit arrangements and clearly delineating the categories of personal data that may be used as parameters to draw up a personalised offer. In addition, the EDPS recommends expanding the information obligation contained in Article 13 of the Proposal, which should require the provision by the creditor of clear, meaningful and uniform information about the logic and the parameters used to determine the price . 3.6 Advertising and marketing of credit agreements; advisory and other services

text: 42. The EDPS recalls the need to ensure full respect of the principles of data minimisation and purpose limitation, also having regard in particular to the following activities: advertising and marketing of credit agreements pursuant to

text: Article 7

text: ; advisory services pursuant to

text: Article 16

text: and the activities listed under Article 32(1) of the Proposal.

text: 43. Having regard to advertising and marketing of credit agreements pursuant to

text: Article 7

text: , the EDPS recommends specifying in the Proposal that the use of data collected and processed in the context of creditworthiness assessment for advertising or marketing purposes should not be allowed.

text: 44. Having regard to the advisory services referred to under

text: Article 16

text: , the EDPS recommends further delineating in the Proposal which information regarding the consumer’s financial situation, preferences and objectives related to the credit agreement or crowdfunding services may be considered as “strictly necessary” for the purpose of providing advisory services and the activities listed under Article 32(1) of the Proposal. 3.7 Relationship to existing Union legislation on personal data protection

text: 45. The EDPS observes that recital 25 of the Proposal refers to respect for “the rights to the protection of personal data, to property, to non-discrimination, to protection of family and professional life, and to consumer protection”. Recital 49 also refers to compliance with the GDPR when referring to cross-border access to private or public databases.

text: 46. The EDPS notes that entities covered by the Proposal will deploy a wide range of activities involving the processing of personal data. This means that the requirements of the GDPR will 11 need to be taken into account, in particular the requirements concerning purpose limitation, storage limitation, data protection by design and by default, data minimisation, as well as the obligations related to security of personal data and data protection impact assessment and prior consultation.

text: 47. The EDPS considers that it should be made evident in the Proposal that all entities covered by the Proposal should act in compliance with existing Union legislation on personal data protection when carrying out any of the activities covered by the Proposal which involve the processing of personal data. The EDPS therefore recommends explicitly clarifying in the operative part of the Proposal that the Union’s legislation for the protection of personal data, in particular the GDPR, shall apply to any processing of personal data falling within the scope of the Proposal.

text: 48. A corresponding recital should equally clarify that the Proposal does not seek to affect the application of existing EU laws governing the processing of personal data, including the tasks and powers of the independent supervisory authorities competent to monitor compliance with those instruments. 3.8 Interaction with the proposed Artificial Intelligence Act

text: 49. The EDPS notes that the Proposal includes several references to the Proposal for a Regulation laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) . In particular, recital 40 refers to price personalisation as outcome of automated decision-making and profiling and to the potential risks stemming from such personalisation. In addition, recital 48 recalls that AI systems intended to be used to evaluate the creditworthiness of natural persons or establish their credit score (determining access to financial resources or essential services such as housing, electricity, and telecommunication services) are considered “highrisk” AI systems under the Artificial Intelligence Act .

text: 50. In this regard, the EDPS considers that the requirements laid down in the Proposal concerning creditworthiness assessments and price personalisation should be integrated into the requirements under Chapter 2 of Title III of the Artificial Intelligence Act. Chapter 2 of Title III determines the requirements on the basis of which the provider of the AI system shall draw up an EU declaration of conformity and affix the CE marking pursuant to Article 19 of the Artificial Intelligence Act.

text: 51. Absent the aforesaid integration (which could be achieved for instance introducing a crossreference to the Proposal in aforesaid Chapter 2 of Title III), the assessment of conformity of AI systems assessing creditworthiness would not take into account the rules established by the Proposal to enhance consumer and data protection (e.g., restrictions regarding the use of data from social media or health data) .

text: 52. In light of the above, the EDPS recalls the recommendations made in the Joint EDPB-EDPS Opinion to include data protection requirements, as well requirements stemming from sectoral legislation, in this case consumer credit, applicable Union legislation under the requirements for declaration of conformity of the AI system . In the absence of this inclusion, the loan applicant’s consumer and data protection rights might in practice be jeopardised by the (high-risk) creditworthiness AI system.

text: 53. The EDPS also recalls that the Joint EDPB-EDPS Opinion recommended that the Artificial Intelligence Act prohibits any type of social scoring. Such a ‘horizontal’ prohibition of social scoring in the Artificial Intelligence Act would be beneficial not only having regard for 12 instance to decisions on eligibility to mortgages or insurance products (possibly relying on such “social scoring”), but also having regard to the assessment of creditworthiness. The EDPS recommends including in the Proposal a cross-reference to the proposed Artificial Intelligence Act in respect of the prohibition of social scoring, in accordance with the recommendations provided in the Joint EDPB-EDPS Opinion.

text: 54. The EDPS also recommends providing for ex ante verification of the creditworthiness AI system, including verification of compliance with the Proposal’s requirements, with the involvement of the competent authority having specific expertise on consumer loans established pursuant to Article 41 of the Proposal .

text: 55. Finally, the EDPS recalls the need for integration of the requirements under data protection law (for instance, data minimisation, privacy by design and by default) in the requirements under the Artificial Intelligence Act, in particular in the context of the certification of the AI creditworthiness system . The integration of this requirement would be crucially beneficial to individuals’ rights, both as data subject and consumer.

text: 4 Conclusions

text: In light of the above, the EDPS:

text:  welcomes the aim pursued by the Proposal of strengthening consumer protection to address the risks posed by digitalisation of consumer credit;  recalls the relationship of complementarity between consumer and data protection, and the important role that can be played by the latter also in terms of consumer empowerment;

text:  recommends further delineating the categories of data that may or may not be used for the purpose of creditworthiness assessment and to explicitly prohibit the use of any special categories of personal data under Article 9 of the GDPR in the operative part of the Proposal;

text:  recommends providing a clearer indication of which external sources may be deemed as “relevant” in the context of creditworthiness assessment;

text:  recommends addressing the requirements, role and responsibilities of credit databases or third parties providing ‘credit scores’, together with further clarifications regarding the situations where consultation of such external sources is necessary and proportionate;

text:  recommends adding under Article 18(3) of the Proposal that the procedures for creditworthiness assessment shall include data quality control procedure;

text:  recommends replacing the term [human] “intervention” with “assessment” in

text: Article 18(6)

text: and recital 48 of the Proposal. Moreover, the EDPS recommends ensuring the consumer is informed where the creditworthiness assessment is based on automated processing in all cases (that is, not only in case of rejection of the application for the loan);

text:  welcomes the obligation to inform consumers that they are presented with a personalised offer. However, the EDPS recommends adding an obligation to provide clear, meaningful and uniform information about the parameters used to determine the price and to clearly delineate the categories of personal data that may be used as parameters to draw up a personalised offer;

text:  welcomes the consumer’s right to be informed of the result of a database consultation carried out for the purpose of assessing his or her creditworthiness. However, the EDPS recommends providing for the obligation to inform the applicant in advance of such consultation. The EDPS also recommends harmonising the categories of information which can be contained in the databases for creditworthiness assessment;

text:  recommends specifying in the Proposal that the use of data collected and processed in the context of creditworthiness assessment for advertising and marketing purposes should not be allowed;

text:  recommends further delineating in the Proposal which information regarding the consumer’s financial situation, preferences and objectives related to the credit agreement or crowdfunding services may be considered as “strictly necessary” for the purpose of providing advisory services and the activities listed under Article 32(1) of the Proposal;

text:  recommends including a provision and a corresponding recital on the applicability of the GDPR in the context of the Proposal, and notably to the processing of personal data by creditors and providers of crowdfunding services;

text:  recalls the need for integrating the requirements under data protection law and consumer credit legislation into the requirements under the proposed Artificial Intelligence Act, in particular in the context the certification of AI systems used for creditworthiness assessment, notably as part of the (third-party) conformity assessment process prior to CE marking.

text: Brussels, 26 August 2021

text: p.o. Leonardo CERVERA NAVAS - Director

text: Wojciech Rafał WIEWIÓROWSKI

text: [e-signed]

text: Notes


text: OJ L 295, 21.11.2018, p. 39.

text: COM(2022) 207 final and COM(2022) 208 final.

text: See the Explanatory Memorandum of both Proposals, p. 2.

text: Idem. 4

text: For further details see the EDPS Guidelines on assessing the proportionality of measures that limit the fundamental rights to privacy and to the protection of personal data, issued on 19 December 2019, https://edps.europa.eu/sites/edp/files/publication/19-12-

text: See Judgments of the Court of Justice of 8 April 2014 in Joined Cases

text: and

text: , DRI, paragraph 52; of 16 December 2008 in

text: Case C‑73/07

text: Satakunnan Markkinapörssi and Satamedia, paragraph 56; of 9 November 2010 in Joined Cases

text: and

text: Volker und Markus Schecke and Eifert, paragraphs 77 and 86.

text: EDPS Opinion 1/2020 on the negotiating mandate to conclude an international agreement on the exchange of personal data between Europol and New Zealand law enforcement authorities, issued on 31 January 2020 https://edps.europa.eu/sites/default/files/publication/20-01-31_opinion_recommendation_europol_en.docx.pdf

text: EDPS Opinion 2/2018 on eight negotiating mandates to conclude international agreements allowing the exchange of data between Europol and third countries, issued on 14 March 2018, https://edps.europa.eu/sites/edp/files/publication/18-03-

text: See the Annex to the Proposals for Council Decisions, pages 17 and 18.

text: Regulation (EU) 2016/794

text: of the European Parliament and of the Council of 11 May 2016 on the European Union Agency for Law Enforcement Cooperation (Europol) and replacing and repealing Council Decisions 2009/371/JHA, 2009/934/JHA, 2009/935/JHA,

text: 2009/936/JHA and 2009/968/JHA (OJ L 135, 24.5.2016, p. 53)

text: COM(2020) 796 final

text: See the agreed text at https://www.consilium.europa.eu/en/press/press-releases/2022/05/24/europol-le-conseil-adopte-une-legislation-

text: See Judgment of the Court of Justice of 1 October 2015,

text: Case C‑201/14

text: , Smaranda Bara and Others, ECLI:EU:C:2015:638, in particular para. 32 and 33 where the Court found that “the requirement to inform the data subjects about the processing of their personal data is all the more important since it affects the exercise by the data subjects of their right of access to, and right to rectify, the data being processed, and their right to object to the processing of those data”. 7

identifier: EDPS yttrande 11/2022

title: Opinion on the Proposal for Council Decisions on the signing and conclusion of the Agreement between the European Union and New Zealand on the exchange of personal data between Europol and the authorities of New Zealand competent for fighting crime

text: 10 June 2022

text: Opinion 11/2022

text: on the Proposal for Council Decisions on the signing and conclusion of the Agreement between the European Union, of the one part, and New Zealand, of the other part, on the exchange of personal data between Europol and the authorities of New Zealand competent for fighting serious crime and terrorism

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

text: This Opinion relates to the Commission Proposals forCouncil Decisions on the signing and conclusion of the Agreement between the European Union, of the one part, and New Zealand, of the other part, on the exchange of personal data between Europol and the authorities of New Zealand competent for fighting serious crime and terrorism.

text: This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to

text: Regulation (EU) 2018/1725

text: . This Opinion is limited to the provisions of the draft Proposal that are relevant from a data protection perspective.

text: Executive Summary

text: On 13 May 2022, the European Commission issued two Proposals for Council Decisions on the signing and on the conclusion, on behalf of the European Union, of the Agreement between the European Union, of the one part, and New Zealand, of the other part, on the exchange of personal data between Europol and the authorities of New Zealand competent for fighting serious crime and terrorism. The objective of the Agreement is to allow the transfer of personal data between Europol and the competent authorities of New Zealand, while ensuring appropriate safeguards with respect to the human rights and fundamental freedoms of individuals, including privacy and data protection.

text: The EDPS has already had the opportunity to comment on the exchange of personal data between Europol and the law enforcement authorities of New Zealand in his Opinion 1/2020 on the negotiating mandate for the present Agreement. There the EDPS noted the existence in New Zealand of a well-established national data protection legislation and an independent data protection authority, competent to supervise the law enforcement authorities. At the same time, the EDPS made several additional recommendations in order to clarify and, where necessary, further develop the safeguards and controls with respect to protection of personal data, related in particular to the scope of the Agreement, the principle of storage limitation and the provision of information to data subjects.

text: The EDPS notes with satisfaction that his recommendations have been taken into account during the negotiations and have been subsequently reflected in the final text of the Agreement, in Annex I,

text: Article 13

text: and

text: Article 26

text: , respectively.

text: In light of the above, the EDPS considers that the presented Agreement between the European Union and New Zealand on the exchange of personal data between Europol and the authorities of New Zealand competent for fighting serious crime and terrorism adduces adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals. Moreover, it may also be used as a model for future agreements on the exchange of personal data for law enforcement purposes.

text: At the same time, the EDPS recalls the recently agreed amendments to the Europol Regulation, which will have an impact, inter alia, on the data protection framework applicable to Europol. In this regard, the EDPS underlines that Europol will have to apply the Agreement on the exchange of personal data with the competent authorities of New Zealand in full compliance with its updated legal framework, and specifically with the legal safeguards for the protection of individuals with regard to the processing of their personal data, contained in Chapter IX of EUDPR and in the amended Europol Regulation.

text: In particular, the obligation of Europol pursuant to Article 26 of the envisaged Agreement to make publicly available a document setting out in an intelligible form the provisions regarding the processing of personal data transferred under the Agreement, including the means available for the exercise of the rights of data subjects, should be interpreted and applied in the light of Article 79 of EUDPR and the obligation of the Agency as a data controller to make available or give to the data subject specific information.

text: Contents

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union,

text: Having regard to

text: Regulation (EU) No 2018/1725

text: of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular

text: Article 42(1)

text: thereof,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. Introduction

text: 1. On 13 May 2022 the European Commission issued two Proposals for Council Decisions on the signing and on the conclusion, on behalf of the European Union, of the Agreement between the European Union, of the one part, and New Zealand, of the other part, on the exchange of personal data between the European Union Agency for Law Enforcement Cooperation (Europol) and the authorities of New Zealand competent for fighting serious crime and terrorism (‘the Proposals’) .

text: 2. The objective of the Agreement is to allow the transfer of personal data between Europol and the competent authorities of New Zealand, in order to support and strengthen the action by the authorities of the Member States of the European Union and those of New Zealand, as well as their mutual cooperation in preventing and fighting criminal offences, including serious crime and terrorism, while ensuring appropriate safeguards with respect to the human rights and fundamental freedoms of individuals, including privacy and data protection .

text: 3. The negotiations between the Commission and New Zealand on the Agreement were carried out between April and November 2021 in accordance with negotiation directives adopted by the Council on 13 May 2020, further to Commission Recommendation of 30 October 2019 .

text: 4. The envisaged Agreement builds upon already existing close partnership between the European Union and New Zealand. In this regard, it should be noted that in the EU-New Zealand Partnership Agreement on Relations and Cooperation, signed on 5 October 2016, the Parties commit to cooperate in the areas of law enforcement, prevention and combating of organised crime and corruption, drugs, cybercrime, money laundering, terrorism and terrorist financing.

text: 5. The present Opinion of the EDPS is issued in response to the consultations by the European Commission of 13 May 2022, pursuant to Article 42(1) of EUDPR, on the Proposals for Council Decisions on the signing and on the conclusion of the Agreement. However, bearing in mind that both Proposals concern the same Agreement, the present Opinion covers both of them.

text: 2. General remarks

text: 6. Transfers of personal data gathered in the context of criminal investigations, envisaged under the Agreement, are liable to have a significant impact on the lives of the individuals concerned, as the personal data may potentially be used in prosecution cases in the receiving country under its national law.

text: 7. As transfers of personal data to third countries constitute an interference with individuals’ rights to privacy and data protection guaranteed by Articles 7 and 8 of the Charter, requirements of necessity and proportionality of the envisaged processing need to be assessed in accordance with Article 52(1) of the Charter . Consequently, the international agreement must ensure that the limitations to rights to privacy and data protection in relation to the fight against serious crime and terrorism apply only in so far as is strictly necessary .

text: 8. The EDPS has already had the opportunity to comment on the exchange of personal data between Europol and the law enforcement authorities of New Zealand in his Opinion 1/2020 on the negotiating mandate for the present Agreement . There the EDPS noted the existence in New Zealand of a well-established national data protection legislation and an independent data protection authority, competent to supervise the law enforcement authorities. Moreover, he welcomed the fact that Commission had incorporated into the proposed negotiating mandate with New Zealand a number of the specific recommendations made previously by the EDPS in his Opinion 2/2018 on eight negotiating mandates to conclude international agreements allowing the exchange of data between Europol and third countries .

text: 9. In his Opinion 1/2020, the EDPS provided several additional recommendations in order to clarify and, where necessary, further develop the safeguards and controls with respect to protection of personal data, taking into consideration the specific context of New Zealand, in particular: 5 - in line with the principle of purpose limitation, the envisaged Agreement should explicitly lay down the list of the criminal offences regarding which personal data could be exchanged; - in view of the practical implementation of the principle of storage limitation, the future Agreement should specifically provide for periodic review of the need for storage of the transferred personal data; - given the importance of the right to information for the exercise of the other data protection rights, the Agreement should include clear and detailed rules regarding the information that should be provided to the data subjects.

text: 10. The EDPS notes with satisfaction that these three recommendations have been taken into account during the negotiations and are subsequently reflected in the final text of the Agreement, as follows: - Annex I ‘Areas of Crime’ to the Agreement lays down an exhaustive list of criminal offences, thus providing legal certainty about its material scope ; - according to

text: Article 13

text: ‘Storage, review, correction and deletion of personal data’, the Contracting Parties should provide for appropriate time limits to be established for the storage of personal data received under this Agreement or for a periodic review of the need for the storage of such data (emphasis added), so that data are stored only as long as is necessary for the purpose for which they are transferred; - pursuant to

text: Article 26

text: ‘Notification of implementation’, each Contracting Party has to make publicly available a document setting out in an intelligible form the provisions regarding the processing of personal data transferred under the Agreement including the means available for the exercise of the rights of data subjects.

text: 11. As a result, it could be concluded that the presented Agreement between the Union and New Zealand on the exchange of personal data between Europol and the authorities of New Zealand competent for fighting serious crime and terrorism adduces adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals.

text: 12. At the same time, the EDPS considers that there is an additional factor, which will have a direct impact on the implementation of the Agreement and therefore has to be taken into account - the recently agreed amendments to the Europol Regulation . 6

text: 3. The impact of the amended Europol Regulation

text: 13. On 9 December 2020, the European Commission adopted a Proposal for a Regulation of the European Parliament and of the Council amending

text: Regulation (EU) 2016/794

text: , as regards Europol’s cooperation with private parties, the processing of personal data by Europol in support of criminal investigations, and Europol’s role on research and innovation . The EDPS provided his comments and recommendations in Opinion 4/2021 on the Proposal for Amendment of the Europol Regulation , as well as in the subsequent remarks to the colegislator .

text: 14. The EU legislators reached an agreement on the amended Europol Regulation in May 2022 . The Regulation is supposed to enter into force on the day following that of its publication in the Official Journal of the European Union, which most probably will precede the entry into force and the subsequent application of the Agreement with New Zealand.

text: 15. The reform of Europol concerns also the data protection framework of Europol and will lead in particular to the direct application of the horizontal rules in Chapter IX of EUDPR to the operational data processing by Europol. It is also an important step towards a comprehensive alignment of the data protection framework for all EU institutions, bodies and agencies, for which the EDPS has repeatedly called for.

text: 16. Consequently, Europol will have to apply the Agreement on the exchange of personal data with the competent authorities of New Zealand in full compliance with its updated legal framework, including with the enhanced legal safeguards for the protection of individuals with regard to the processing of their personal data, contained in Chapter IX of EUDPR and in the amended Europol Regulation.

text: 17. In this context, the EDPS specifically recalls the importance of the right to information as it allows the exercise of the other data protection rights, including the right to remedies, and ensures fair processing of the data . It is even more relevant in the context of Europol, having in mind that data subjects usually have no knowledge of the fact that their data are processed and transferred for law enforcement purposes.

text: 18. In particular, the EDPS underlines that the obligation of Europol pursuant to Article 26 of the envisaged Agreement “to make publicly available a document setting out in an intelligible form the provisions regarding the processing of personal data transferred under the Agreement including the means available for the exercise of the rights of data subjects” should be interpreted and applied in the light of Article 79 of EUDPR and the obligation of Europol as a data controller to make available or give to the data subject specific information.

text: 4. Conclusions

text: 19. In light of the above, the EDPS makes the following comments and recommendations: (1) The presented Agreement between the Union and New Zealand on the exchange of personal data between Europol and the authorities of New Zealand competent for fighting serious crime and terrorism adduces adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals. In this regard, it may also be used as a model for future agreements on the exchange of personal data for law enforcement purposes. (2) The obligation of Europol pursuant to Article 26 of the envisaged Agreement to make publicly available a document setting out in an intelligible form the provisions regarding the processing of personal data transferred under the Agreement including the means available for the exercise of the rights of data subjects should be interpreted and applied in the light of Article 79 of EUDPR and the obligation of Europol as a data controller to make available or give to the data subject specific information. Brussels, 10 June 2022 Wojciech Rafał WIEWIÓROWSKI [e-signed] 8

type: vagledning

utgivare: edps