AI-based creditworthiness evaluation and scoring

• Applicant: Professorin Dr. Katja Langenbucher
• Subject Area: Private Law
• Term: since 2021
• Project identifier: Deutsche Forschungsgemeinschaft (DFG) - Project number 467157950

This grant proposal suggests continuing an earlier project on “fair credit scoring” that runs until 31st July 2025. That earlier project has focused on the regulation of algorithmic credit scoring, a building block of creditworthiness evaluation. Three recent developments have led to a fundamental re-adjustment of European and German law in that area. Some of this has been addressed in the context of the current project, however, the broad implications of the reforms cannot be adequately worked out in the remaining time. First, the second EU Consumer Credit Directive (EU) 2023/2225 has entered into force. It reframes large parts of the existing rules on creditworthiness evaluation of consumers. With this comes the need to build a coherent framework of overlapping rules stemming from consumer credit, data privacy, and banking supervisory laws. Furthermore, the Directive, for the first time in Europe, has introduced a prohibition of discriminatory lending practices. One of the focus themes of the current project, algorithmic discrimination, now falls under an explicit rule. The new project aims to tackle questions around the unusual definition of discrimination stipulated in that Directive, the available business justifications for statistical discrimination, and the sanctions open to Member States. Second, an ECJ-decision of October 2023 has framed credit scoring not only as “profiling” but, unexpected by most, as “automated decision-making”. This has triggered the GDPR’s baseline prohibition, coupled with the need to provide justificatory reasons. Additionally, important consumer information rights apply. The German legislator has reacted to the decision with a novel rule (§ 37a BDSG-draft), making use of the discretion that the GDPR offers. That new rule stipulates requirements that credit scoring agencies have to follow, along with certain information rights for consumers. The proposed project would delve deeper into the “data input controls” this rule requires, into consumer information rights, and into business secrecy protections for credit scoring agencies. Third, the EU AI-Act 2024/1689 has entered into force. The Act explicitly addresses AI-based credit scoring, the core of the current project, as well as creditworthiness evaluations. The Act frames both as “high-risk-AI-systems”. This suggests for the new grant proposal to go beyond credit scoring and more generally cover scoring and creditworthiness evaluations. There is the precise definition of “high-risk-AI” to work out, board member duties of banks and credit scoring agencies to explore, and the impact of the business judgment rule on using AI to enhance board decision-making to understand. Additional work will go into the jurisdiction of financial authorities. This is an especially salient topic: Under the AI Act, financial institutions, but not credit scoring agencies, will be supervised by financial authorities, entailing the risk of inconsistent interpretations of the Act.

• DFG Programme: Research Grants