European Union: Reached Council and Parliament agreement Directive on consumer credit outlining data protection measures

On 2 December 2022, the European Council and European Parliament reached a provisional agreement on a Directive that repeals and replaces the 2008 directive on consumer credit agreements. The provisional agreement on the Directive outlines the data that covered entities, including creditors, credit intermediaries and providers of crowdfunding credit services, are allowed to process in the creditworthiness assessment process. In particular, the covered entities will be able to process only personal data related to the individual's financial and economic situation, such as financial, income, repayment, financial assets and liabilities data. The personal data of individuals posted on social media platforms and health data will not be allowed to be processed to determine the individual's creditworthiness. Finally, under the provisional agreement on the Directive, the Member States will have to require covered entities to inform consumers if they provide personalised offers based on profiling or other types of automated personal data processing systems.