GDPR for Fintech: Credit Scoring, Art. 22 and AEPD Fines

Yes. The CJEU confirmed in the Schufa case (C-634/21, 7 December 2023) that credit scoring constitutes an automated decision under Art. 22 GDPR. This means data subjects have the right not to be subject to a decision based solely on automated processing that produces legal effects or significantly affects them, unless an exception applies: necessary for a contract, legal authorisation, or explicit consent, with additional safeguards.

Common bases are: legitimate interest (Art. 6(1)(f)) for credit risk assessment; contract (Art. 6(1)(b)) when scoring is necessary to execute a loan contract; legal obligation (Art. 6(1)(c)) for anti-money laundering. The choice depends on the context. The AEPD has published a legal report on credit information systems clarifying the use of Art. 6(1)(f).

LOPDGDD Art. 20 regulates solvency and credit files. It establishes: (1) data must be accurate and up to date; (2) negative data may be retained for 6 years; (3) the data subject has the right of access to their solvency data; (4) solvency data may only be processed for credit assessment purposes. The AEPD supervises compliance with this article.

The DPIA (Art. 35 GDPR) is mandatory for high-risk processing, including: systematic and extensive evaluation of personal aspects (credit scoring), large-scale processing of special categories of data, and systematic large-scale monitoring. In fintech, systematic and extensive credit scoring requires a DPIA. It must document the risk analysis, mitigation measures and residual assessment.

The AEPD has imposed significant fines in the financial sector: CaixaBank, €6,000,000 (2021) for breach of Arts. 6, 13 and 14 GDPR in data processing for profiling; BBVA, €5,000,000 (2020) for breach of Arts. 6 and 13 GDPR. These fines illustrate the AEPD's active supervision in the sector and the importance of compliance with legal bases and transparency.

Not per se. Financial data (income, expenses, balance, credit history) are not special categories under Art. 9 GDPR. However, they may become special categories if used as a proxy for sensitive data: if financial data reveal information about health, biometrics, religion, ethnicity or other special data, Art. 9 applies and a specific legal basis is required (explicit consent, etc.).

If your fintech uses cloud providers outside the EEA (AWS, GCP, Azure), it must comply with international transfer rules (Arts. 44-49): adequacy decision (EU-US Framework 2023), Standard Contractual Clauses (SCCs 2021), Binding Corporate Rules (BCRs), or codes of conduct/certifications. In addition, a Transfer Impact Assessment (TIA) must be carried out to verify that the country offers an essentially equivalent level of protection (EDPB Recommendations 01/2020).

The AEPD (Spanish Data Protection Agency) is the competent supervisory authority in Spain. At European level, the EDPB (European Data Protection Board) coordinates enforcement between Member States through the one-stop-shop mechanism (Art. 56). The AEPD has published a legal report on credit information systems and guidance on GDPR compliance for AI processing.