On 16 March 2023, an Advocate General Opinion (the "Opinion") established that automated credit-scoring for the purpose of obtaining a loan constitutes 'profiling'.
The Advocate General (the "AG") considered three key points raised by the Administrative Court of Wiesbaden and concluded that:
1) Automated decision making about the ability of a person to service a loan is prohibited under the EU General Data Protection Regulation (the "GDPR") and constitutes profiling;
2) The storage of data by a private credit information agency cannot be lawful, once the personal data concerning insolvency have been erased from public registers; and
3) EU National Courts must be able to exercise a full judicial review over any legally binding decision of a supervisory authority of the GDPR.
The first opinion submitted by the AG was that, under the GDPR, the person concerned has a right not to be subject to a decision based solely on automated processing, including profiling. This opinion was submitted in response to a question that was referred to the European Court of Justice ("ECJ") (Case C-634/21).
Case C-634/21 dealt with a German credit-scoring company who had used a customer's data to automatically generate an unsatisfactory credit score, which resulted in her being refused a loan. The data subject lodged a complaint with the Hesse Commissioner for Data Protection and Freedom of Information ("HBDI") requesting that they order the credit-scoring company to provide her with access and erasure of her personal data. The credit-scoring company claimed that the information constituted 'trade secrets' and, as such, HBDI refused to trigger an investigation thus denying the data subject's request.
The AG concluded that: (i) the procedure at issue constituted 'profiling', (ii) the decision produced legal effects concerning the person concerned or similarly significantly affected him or her; and (iii) the decision was based solely on automated processing.
The Advocate General found that upon arriving at such a conclusion, the person concerned is entitled to opt out of the credit-scoring, and obtain "meaningful information about the logic involved", as well as information surrounding the significance and the envisaged consequences of such processing from the controller.
The Administrative Court of Wiesbaden brought forward two additional requests for preliminary rulings concerning the GDPR (Joined Cases C-26/22 and C-64/22), and these produced opinions relating to data protection authority ("DPA") decisions, and the boundaries of data retention for private credit agencies.
The first question dealt with the extent to which the national court can reassess a decision made by the DPA. The Court asked whether their role was limited to assessing the procedural steps taken by the DPA to confirm whether a complaint was sufficiently investigated, or whether the national court could go as far as to overturn the substantive elements of the decision altogether. The Advocate General determined that a legally binding decision of a DPA is in fact subject to a full substantive judicial review on the merits of the case, and to suggest otherwise may allow for decisions which are not compliant with the GDPR to escape through the gaps.
The second question dealt with the lawfulness and limitations that apply to the storage of personal data from public registers by credit agencies. The Advocate General adopted the view that the continued retention of data by a private credit information agency cannot be lawful, once the personal data concerning insolvency has been erased from public registers after six months. The Advocate General determined that, in this scenario, the economic impact on the person concerned that may arise from storing the data beyond six months would override the commercial interest of the privacy agency. Thus, the opinion established that the data subject has the right to obtain the erasure of personal data without undue delay, however it would be for the referring court to examine if there are exceptional overriding legitimate grounds.
The opinions of the Advocate General are not binding, and the ECJ is yet to give their ruling on the questions discussed.
Find the Advocate General Opinion for Case C-634/21 here.
Find the Advocate General Opinion for Joined Cases C-26/22 and C-64/22 here.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.