5 ms·

On another note, does GDPR mean you can request credit report agencies to delete all their data on you?

Grollicus 8y ago
Of course, but the result will propably be like an american who has never used a credit card: You can't get credit anywhere.
lmkg 8y ago
It does mean you can request it. It doesn't necessarily mean they have to delete said data. The Right to Erasure is not absolute, if the data controller can state an 'overriding legitimate interest' for the preservation of the data. I don't have a good idea idea how legitimate a credit agency's legitimate interest really is. I might set aside some popcorn for seeing how this particular issue gets resolved.
PeterisP 8y ago
"Credit reporting agencies" in the USA sense aren't really a thing in EU, there are similar but substantially different (and nation-specific, not EU-wide) mechanisms of verifying the creditworthiness of customers, often with specific national laws regulating the usage this data which would override GDPR. Furthermore "please delete my data" doesn't really mean "delete all my data", it means something like "I revoke whatever consent I gave and delete all my data that you now have no right to use" - so the company is allowed to keep all the data for which the GDPR gives them a right to use without your consent.
- giobox 8y ago
  I'm curious, in what sense do you mean "Credit reporting agencies" in the USA sense aren't really a thing in EU"? I've lived in both the UK and USA and used credit products in each, and your access to such credit appears to me almost entirely determined by a handful of credit reporting agencies "scores" in both countries in a pretty similar way. Heck it's even often the same company - Equifax (one of the largest) operate in the UK as well.
  - PeterisP 8y ago
    There are many differences; it's hard to generalize because each EU country is different (there's no harmonization for this, and there are major differences especially along the "ex-Warsaw-Pact" border; half of EU had their whole financial system [re]built in 1990s), but you'll often see the following differences: 1) There's no "EU score", each lending market is somewhat separate. Past history in one location may or may not influence your score in another location. 2) Instead of a general/universal "credit score" calculated by an agency, there's often a concept of "credit history" which (depending on the country) may or may not list the amounts of existing loans, of previous loans, and history of late payments. The difference being that instead of lenders getting a score calculated by some agency, the lenders get the data and make their own decision, with possibly very different opinions on which factors are important. Not everywhere, of course, some countries (e.g. UK or Nordics) are more like USA. 3) The process tends to be highly regulated. If you're providing factual data as opposed to an opaque score, each item better be correct - distributing to all lenders "Bob defaulted on a loan in 1999" is libel if it's not true; the dispute process tends to be more consumer-friendly than USA - e.g. a requirement to remove the disputed items immediately and return them only if the debtor can prove its validity), maybe a requirement to expire entries of missed payments within x years, etc. 4) In some countries, that agency is run by the gov't, i.e. purely a central official registry of loans and/or bad loans, which is somewhat sufficient to verify creditworthiness. In others, it's like Equifax. 5) There often is a principle that the credit reporting agencies can't give/sell that data to anyone - you must give explicit permission for every company before they can gain access to that data. 6) In many countries there's no concept of "building credit" - where there only information provided is about negative events (e.g. defaults or missed payments), so having never taken a loan combined with good income gets a perfect rating, as it's not distinguishable from a long credit history and having never missed a payment. So it's quite tricky - similar but different.
jdietrich 8y ago
No. The right to erasure is conditional. Credit reference agencies have a lawful justification to collect, retain and share certain types of personal information without the consent of the data subject. https://gdpr-info.eu/art-17-gdpr/ https://gdpr-info.eu/art-17-gdpr/

Of course, but the result will propably be like an american who has never used a credit card: You can't get credit anywhere.

lmkg 8y ago

It does mean you can request it. It doesn't necessarily mean they have to delete said data. The Right to Erasure is not absolute, if the data controller can state an 'overriding legitimate interest' for the preservation of the data. I don't have a good idea idea how legitimate a credit agency's legitimate interest really is. I might set aside some popcorn for seeing how this particular issue gets resolved.

PeterisP 8y ago

"Credit reporting agencies" in the USA sense aren't really a thing in EU, there are similar but substantially different (and nation-specific, not EU-wide) mechanisms of verifying the creditworthiness of customers, often with specific national laws regulating the usage this data which would override GDPR. Furthermore "please delete my data" doesn't really mean "delete all my data", it means something like "I revoke whatever consent I gave and delete all my data that you now have no right to use" - so the company is allowed to keep all the data for which the GDPR gives them a right to use without your consent.

giobox 8y ago
I'm curious, in what sense do you mean "Credit reporting agencies" in the USA sense aren't really a thing in EU"? I've lived in both the UK and USA and used credit products in each, and your access to such credit appears to me almost entirely determined by a handful of credit reporting agencies "scores" in both countries in a pretty similar way. Heck it's even often the same company - Equifax (one of the largest) operate in the UK as well.
- PeterisP 8y ago
  There are many differences; it's hard to generalize because each EU country is different (there's no harmonization for this, and there are major differences especially along the "ex-Warsaw-Pact" border; half of EU had their whole financial system [re]built in 1990s), but you'll often see the following differences: 1) There's no "EU score", each lending market is somewhat separate. Past history in one location may or may not influence your score in another location. 2) Instead of a general/universal "credit score" calculated by an agency, there's often a concept of "credit history" which (depending on the country) may or may not list the amounts of existing loans, of previous loans, and history of late payments. The difference being that instead of lenders getting a score calculated by some agency, the lenders get the data and make their own decision, with possibly very different opinions on which factors are important. Not everywhere, of course, some countries (e.g. UK or Nordics) are more like USA. 3) The process tends to be highly regulated. If you're providing factual data as opposed to an opaque score, each item better be correct - distributing to all lenders "Bob defaulted on a loan in 1999" is libel if it's not true; the dispute process tends to be more consumer-friendly than USA - e.g. a requirement to remove the disputed items immediately and return them only if the debtor can prove its validity), maybe a requirement to expire entries of missed payments within x years, etc. 4) In some countries, that agency is run by the gov't, i.e. purely a central official registry of loans and/or bad loans, which is somewhat sufficient to verify creditworthiness. In others, it's like Equifax. 5) There often is a principle that the credit reporting agencies can't give/sell that data to anyone - you must give explicit permission for every company before they can gain access to that data. 6) In many countries there's no concept of "building credit" - where there only information provided is about negative events (e.g. defaults or missed payments), so having never taken a loan combined with good income gets a perfect rating, as it's not distinguishable from a long credit history and having never missed a payment. So it's quite tricky - similar but different.

jdietrich 8y ago

No. The right to erasure is conditional. Credit reference agencies have a lawful justification to collect, retain and share certain types of personal information without the consent of the data subject. https://gdpr-info.eu/art-17-gdpr/ https://gdpr-info.eu/art-17-gdpr/