May 7, 2026 | Outline Adoption | Data Governance

On 7 May 2026, the French National Commission on Informatics and Liberty adopted a recommendation on the assessment of creditworthiness in the context of granting credit. The recommendation sets out guidance on how lenders and intermediaries should apply data protection rules when assessing an individual’s creditworthiness, including in cases where credit scoring and automated decision-making systems, such as AI-based tools, are used. It replaces the previous authorisation framework under the General Data Protection Regulation (GDPR) with updated guidance on compliance obligations. It confirms that creditworthiness assessments may be based on the legal obligation set out in the Consumer Code, while reaffirming general GDPR principles, including data minimisation and purpose limitation. The recommendation also identifies categories of data that may be processed, specifying that only data that is relevant and necessary for the assessment should be used. In addition, it provides clarification on the consideration of past repayment incidents, indicating that such information should be objective, proportionate, and communicated to applicants in a way that allows them to understand its role in the decision-making process. It also outlines expectations regarding data retention, distinguishing between data used for applications and data relating to previous contractual breaches, and allowing for limited retention for evidentiary purposes where appropriate.