GermanyBundesdatenschutzgesetz (BDSG), Section 30(6) and (7), Human Review of Automated Creditworthiness Assessments
Bundesdatenschutzgesetz (BDSG), § 30 Abs. 6 und 7
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure
- Audit expectation
- none
What it requires
- This law takes effect on (Article 16(1) of the Act of ), so the duties below do not bind before that day.
- If your creditworthiness assessment for a general consumer loan involves automated processing of personal data, let the borrower demand human intervention by you, including a clear explanation of the assessment with its logic and risks, a statement of their own point of view and a review of the assessment and of the loan decision, and inform them of these rights once the automated processing is complete (section 30(6)).
- If you refuse a consumer loan on the strength of information from a credit information database, tell the consumer promptly of the refusal, the information received, the database consulted and the data categories taken into account; if you refuse on an automated assessment, say so and, for general consumer loans, tell the borrower of the right to review by a person and of the procedure for contesting your decision (section 30(7)).
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
- As of
- Open questions
- Does 'Beinhaltet ... die Kreditwürdigkeitsprüfung eine automatisierte Verarbeitung personenbezogener Daten' in section 30(6) cover an assessment in which a person decides on the basis of an automated score, or only an assessment carried out by automated means alone?
What record it asks for
Logging duty
Section 30(6) and (7) set human-review, explanation and notice duties; none requires anyone to keep or produce a log or record.
- Kind
- None
- As of
What this law does
Article 3, point 2, of the Act of replaces paragraph 2 of section 30 of the Bundesdatenschutzgesetz with new paragraphs 2 to 9, and the Act takes effect on . The Act of was issued in Federal Law Gazette part I number 139 on . Under the new paragraph 6, where the creditworthiness assessment for a general consumer loan involves automated processing of personal data, the borrower may demand human intervention by the lender.
That right includes clear and understandable explanations of the assessment, the borrower's own statement of position and a review of the assessment and of the loan decision. After the automated processing is complete, the lender must inform the borrower of the rights under the first two sentences of paragraph 6.
Under the new paragraph 7, a lender that refuses a consumer loan agreement as a result of information from a credit information body must promptly tell the consumer of the refusal, of the information received, of the details of the database consulted and of the data categories taken into account.
Where the refusal rests on an automated creditworthiness assessment, the lender must tell the borrower so and, for general consumer loans, of the borrower's right to review by a person and of the procedure for contesting the lender's decision.
When LexLint raises it
When your app profile says your app makes credit decisions.
Back to the example · Lint your app
Page updated .