Cybersecurity Policy Report, Recommendations on Personal Data Use in Credit Assessments Offered in France, (May 8, 2026)
By Tony Foley
The French data protection authority, the Commission nationale de l’informatique et des libertés (CNIL), has offered recommendation for private organizations that grant loans regarding personal data processing in the context of making an assessment of creditworthiness.
The recommendation, published yesterday, aims to strengthen transparency and accountability in the context of increasing use of algorithms in decisions made by financial institutions. CNIL noted that the granting of credit involved the assessment of the applicant’s ability to repay (scoring), which often is partially or fully automated and involves the use of artificial intelligence (AI). Recent judgments of the Court of Justice of the European Union (CJEU) have confirmed that a specific scoring is an automated decision when it plays a decisive role in the granting of credit, enshrining the right to an explanation of the functioning of the mechanism leading to the decision.
Aimed at loan organizations and intermediaries in banking operations and payment services, the recommendation concerns consumer loans and real estate loans governed by the Consumer Code. It recalls the legal obligations under the European Union’s General Data Protection Regulation (GDPR) as follows:
Identifying the data that may be processed to assess the borrower’s ability to repay in accordance with the GDPR data minimization principle;
Providing a framework for the use of past contractual breaches (e.g., repayment incidents concerning previous loans);
Specifying retention periods for data collected in a loan application as well as the data relating to past contractual breaches by an applicant that is already a customer; and
Specifying the conditions under which a credit decision may be based fully on automated processing and the associated safeguards (transparency, human intervention, and explainability) of the decision for the persons concerned.
CNIL also offers a checklist of points to check by loan organizations and intermediaries, including data protection officers (DPOs) and legal teams. Finally, the agency outlines the information gleaned from the public consultation, from which CNIL adopted a variety of clarifications and changes to its original draft of the recommendation. In the coming months, CNIL plans to support the professional associations of the banking "compliance club" through a webinar designed to assist professionals in the best possible ownership of the rules and guarantees specified in the recommendation and to be able to implement the necessary measures to ensure their effective compliance.
The full text of the recommendation and the checklist may be downloaded from the link provided above but are available only in French.
News: InternationalLegislation DataPrivacy GDPR AINews