Le moderne tecniche di credit scoring tra GDPR, disciplina di settore e AI Act

The subprime mortgage crisis has confirmed the centrality of the 'creditworthiness' assessment in banking. This activity, based on the collection and processing of data, has not been fully regulated by the legislator, so that the rules and principles of the GDPR assume a central role. The latter, however, does not effectively resolve certain issues, mainly related to the use of the new AI-based credit scoring systems. Although these issues appear to have been more effectively addressed by the CCD II and the AI Act, the challenge of establishing a suitable legal basis for the use of innovative credit scoring systems in compliance with Article 22 of the GDPR remains unresolved. Questions persist as to whether automated decision-making processes can legitimately be employed by relying on the data subject’s explicit consent or invoking the necessity of the processing for the conclusion or performance of a contract. In this context, it seems essential to enact specific legislation that expressly authorises the use of these systems and lays down suitable measures to safeguard the data subject’s rights, their freedoms and legitimate interests