ACCIS

…8 February 2024 REPORT ON THE GENERAL DATA PROTECTION REGULATION OUR RESPONSE TO THE EUROPEAN COMMISSION’S CALL FOR EVIDENCE Ref. Ares(2024)971213 - 08/02/2024 ACCIS | Rue du Luxembourg 22-24, 1000 Brussels, Belgium | Tel : +32 2 761 66 93 | www.accis.eu | EU Transparency Register: 21868711871-63 1 A. EXECUTIVE SUMMARY Ensuring responsible lending practices is paramount in safeguarding consumers from undue financial strain. The pivotal role of credit information in facilitating affordable finance and mitigating over-indebtedness cannot be overstated. However, challenges arise from inconsistencies in the interpretation and enforcement of the General Data Protection Regulation (GDPR) by national Data Protection Authorities (DPAs) across European Union (EU) Member States.

Regulation (GDPR) by national Data Protection Authorities (DPAs) across European Union (EU) Member States. These disparities, coupled with the disproportionate application of GDPR provisions and a lack of unified guidance, impede the establishment of a level playing field for privacy practices. This situation not only poses a risk of increased consumer over-indebtedness but also hinders innovations within the credit information system. Variations in the interpretation and enforcement of key articles related to data subjects' rights contribute to uncertainties within the Single Market. The processing of publicly available data in credit databases has, until recently, been subject to discrepancies, further complicating matters.

…available data in credit databases has, until recently, been subject to discrepancies, further complicating matters. Credit Reporting Agencies (CRAs) express concerns about perceived imbalances in GDPR enforcement, particularly regarding data subjects’ rights such as erasure or the right to object. These concerns extend to instances involving credit inquiries that do not result in credit granting or the verification of payment default information. The absence of clear guidance exacerbates the situation, especially in cases where the GDPR falls short in providing necessary clarity. A notable example is the lack of consistent guidance on the use of legitimate interest as a lawful ground for data processing in credit referencing activities. Compounded by the European Data Protection Board's (EDPB) delays in issuing guidelines, this creates a challenging environment for industry players.

Protection Board's (EDPB) delays in issuing guidelines, this creates a challenging environment for industry players. Members of ACCIS assert that the GDPR has not streamlined the adoption of new technologies and methods. Despite claims to the contrary, the GDPR presents challenges for business units to explore, implement, and service emerging opportunities. Additionally, sectoral legislation often complicates matters by either complementing consumer rights recognised in the GDPR or mirroring its provisions with adaptations, leading to duplication of compliance burdens and potential contradictions. In light of these challenges, we urge the European Commission to ensure consistent application of the GDPR, specifically in the context of credit markets.

…the European Commission to ensure consistent application of the GDPR, specifically in the context of credit markets. We stand prepared to collaborate towards this objective, aiming to create a regulatory environment that benefits and protects the rights of citizens involved in credit transactions. B. INTRODUCTION ACCIS is the voice of organisations responsibly managing data to assess the financial credibility of consumers and businesses. Established as an association in 1990, ACCIS brings together more than 50 members from countries all over Europe as well as associates and affiliates across the globe. Responsible lending is vital to prevent consumers from becoming over-indebted. Credit information is central to this process, enabling access to affordable finance and reducing over-indebtedness.

Credit information is central to this process, enabling access to affordable finance and reducing over-indebtedness. Credit reference agencies (CRAs) provide crucial data to credit providers, including credit repayment records, financial data, and publicly available information. CRAs validate, aggregate, and sell comprehensive credit reports to creditors. They also offer services to individuals’ consumers and businesses. More than five years after the GDPR's implementation deadline, CRAs have realised that, although the design of the GDPR works in principle, the very general regulations do not always do justice to the different sector- specific requirements.

…in principle, the very general regulations do not always do justice to the different sector- specific requirements. Against the backdrop of the European Commission’s Call for Evidence to prepare its GDPR report, ACCIS members are concerned about three types of issues: • Inconsistencies in the interpretation and enforcement of the GDPR by national DPAs across EU Member States • Disproportionate interpretation and enforcement of GDPR provisions by the said authorities • Lack of consistent guidance These problems hinder the establishment of a level playing field for privacy practices and a common understanding of privacy regulations across national credit information markets. Furthermore, these problems negatively affect the credit information system, increasing the risk of consumer over-indebtedness and hindering innovations.

…affect the credit information system, increasing the risk of consumer over-indebtedness and hindering innovations. ACCIS members would like to also share additional reflections with regards the intersection between GDPR and innovation. ACCIS is prepared to collaborate with the European Commission to ensure consistent GDPR application for the benefit of citizens involved in credit markets. C. INCONSISTENCIES IN INTERPRETATION AND ENFORCEMENT ACCIS members report several instances of lack of consistency among national DPAs in the interpretation and enforcement of GDPR provisions, in particular in connection to data subjects' rights. The facilitation of those rights by CRAs can be challenging due to the operation of the credit information market. This is particularly true when a weighing of interests is required.

…to the operation of the credit information market. This is particularly true when a weighing of interests is required. CRAs do not possess any client information underlying a registration in a credit database made by a database participant. Collecting all the necessary information to assess the data subject's request is a laborious process. Moreover, the question arises whether receiving such information (which often concerns personal data) is desirable in the context of data minimization. There is also the question of whether the above information is always accurate and up to date, a fact which can hardly be checked. Ultimately, it is up to database contributors to provide CRAs with the necessary information. Among the inconsistencies encountered, we would like to note: 1. Inconsistency in the application of Article 14(5)(b) GDPR.

…the inconsistencies encountered, we would like to note: 1. Inconsistency in the application of Article 14(5)(b) GDPR. DPAs across different countries apply Article 14(5)(b) differently. For instance, the Norwegian DPA allows data controllers to inform data subjects through their websites when using publicly available personal data. In contrast, the Polish DPA does not accept websites as a valid means of providing information notice. The Hellenic DPA allows the local CRA to inform data subjects through press notifications. Additionally, the Italian DPA has recognised various communication methods, including website privacy notices and digital methods, as acceptable ways to comply with this regulation, especially in the context of the 2019 Italian Code of Conduct for credit reporting systems.

…with this regulation, especially in the context of the 2019 Italian Code of Conduct for credit reporting systems. Establishing a consistent balancing test under Article 14(5)(b) across the European Economic Area (EEA) would be beneficial. This test would help data controllers compare the cost and ACCIS | Rue du Luxembourg 22-24, 1000 Brussels, Belgium | Tel : +32 2 761 66 93 | www.accis.eu | EU Transparency Register: 21868711871-63 1 effort associated with fulfilling their information obligations through traditional means like letters with the potential disadvantages to data subjects when providing information on the data controller's website. In any case, the rapid development of technology during the years that have already passed since 2018, when the Regulation came into force, must be taken into account.

…during the years that have already passed since 2018, when the Regulation came into force, must be taken into account. Consistency in this regard would ensure that data controllers across the EEA make decisions in a manner aligned with their counterparts. 2. Inconsistencies in the application of Article 15. DPAs apply Article 15 differently1. Some DPAs interpret that Article 15(1)(h) only applies if a decision falls within the meaning of Article 22 of the GDPR. However, other DPAs apply this article to all cases of purely automated processing, extending its scope beyond Article 22 of the GDPR. This inconsistency has led to varying approaches in different jurisdictions regarding data subjects' rights in automated processing scenarios. In the case VG Wiesbaden - 6 K 788/20.WI, a German CRA was found to have acted correctly by the DPA.

45 → 12

originalus šaltinis (PDF) ↗