How Automated Credit Decisions Impact Consumer Protection: Legal Responsibilities for Credit Providers
Automated Decision Making in Consumer Credit: Legal Obligations of Credit Providers and Credit Scoring Institutions
(article by M. Katsioti – Associate and Κ. Κaranikolas – Senior Associate published on Lexology, December 20, 2024)
The use of new technologies, in particular of Artificial Intelligence (AI), in the
financial sector results in the automation of many processes, including (a) the
assessment of consumers’ creditworthiness through automated processing of
their financial data and (b) the decision making as to the granting or denial of
credit by credit institutions through an automated assessment of the customers’
positive or negative rating in combination with other data.
Credit scoring is usually carried out by the credit institutions themselves or by
third party credit risk or scoring institutions (such as Tiresias in Greece) that
have access to consumer financial databases, including their income, expenses,
as well as their financial obligations. The outcome of this scoring often plays a
decisive role in the decision to grant credit.
These processes are crucial for consumers’ access to finance and other
essential services . Therefore, when such processes are carried out
automatically and without human intervention, Credit Providers and Credit
Scoring Institutions must comply with a set of legal obligations stemming from,
among others, the GDPR, Directive 2023/2225 on credit agreements for
consumers, the AI ACT and the DOR A Act.
The concept of automated decision making: Is the automated assessment
of a consumer’s creditworthiness considered automated decision
making producing legal or similarly significant effects under article 22 of
the GDPR?
For the implementation of article 22 of the GDPR establishing the data subject’s
right not to be subject to a decision based solely on automated processing ,
three conditions must be cumulatively met : a) the existence of a decision, b)
such decision ’s footing solely on automated processing and c) the production
of legal or similarly significant effects by this decision
Read the full article here:
