19.06.2024
19. June 2024: The Bundeskartellamt has today presented the final report on its sector inquiry “Scoring in the online retail sector” focussing on consumer rights. It has reached the conclusion that online retailers, payment service providers and credit bureaus do not always comply with the applicable consumer law provisions. The report describes the context and procedures of credit scoring in the online retail sector, provides a preliminary legal assessment, and recommends actions for businesses and policymakers.
Online retailers or payment service providers acting on their behalf often check the credit standing of customers shopping online to minimise the risk of possible payment defaults. For this purpose, companies may use their own customer data and/or so-called credit scores, which are created by credit bureaus based on other personal data. If the result of the credit check is unfavourable, customers are often denied the option of paying by invoice or in instalments.
Andreas Mundt, President of the Bundeskartellamt: “Credit checks are standard practice when it comes to online shopping. They are often carried out in the background without customers being aware of this. In many cases, the process is not very transparent and no information is provided. Retailers and payment service providers must offer clear and timely information about the credit checks that are carried out so that consumers can make a truly informed choice. In practice, this is often not the case, or such information is hidden and unclear.”
From a purely economic point of view, credit checks and credit scoring are useful practices. Predicting a customer’s likelihood to pay as accurately as possible is not just in the interest of online retailers and payment service providers. Online shoppers can also benefit from a limited number of overall payment defaults, which ultimately has a positive effect on prices.
Credit scoring is carried out automatically in the background when ordering online, largely unnoticed by consumers. However, the processing of personal data in the context of credit scoring is only lawful if it complies, in particular, with the applicable rules under data protection and fair trading law relating to transparency, the data used and the lawfulness of the data processing. In the Bundeskartellamt’s view, there are indications of consumer law violations and a need for improvement in these areas.
Improving transparency
The Bundeskartellamt’s inquiry has shown that, in many cases, the fact that consumers’ credit scores are being checked is not made as transparent as required. Information about these checks is often not provided or is difficult to find in the general terms and conditions, and, in some cases, it is only provided after the credit check has been carried out, leaving the customer with no way to prevent it.
Reviewing the legitimacy of data processing
Processing data in the context of credit scoring is permitted only if it is justified under data protection rules. For example, the processing of data for the sole purpose of storing data is not usually considered a legitimate business interest.
Andreas Mundt: “When companies do not have an overriding legitimate interest in processing data, the customer’s consent must be obtained in cases of doubt. These rules should be consistently applied and enforced.”
Weighing the impact of data processing rules
The inquiry has shown that online retailers, payment service providers and credit bureaus exchange and process large amounts of customer data. Credit checks often include not only a customer’s payment history, but also their address, age or, in some cases, even information on how often they have moved or when they have placed an order. Businesses have a stake in ensuring that the credit scoring models produce highly accurate predictions, which in the case of credit bureaus are also verified in scientific reports commissioned by the companies themselves. However, the data protection principle of data minimisation must also be observed. According to the results reached in the inquiry, it is, however, questionable in some cases whether the processing of certain data is necessary.
In the context of the current amendment to the Federal Data Protection Act (BDSG), it is being discussed whether, in addition to the mathematical and statistical correctness of credit scoring, stronger protection against discrimination should be enshrined in law. According to the government’s bill, the processing of address data, for example, should no longer be allowed to protect individuals from receiving a lower credit score simply because of where they live. The Bundeskartellamt holds that when discussing the permissibility of scoring criteria, it is also necessary to consider and weigh up their impact on the accuracy of predictions and the consequences for both the consumers and the companies involved.
The Bundeskartellamt initiated the inquiry in March 2022 under its consumer protection powers, which it has held since mid-2017 (see press release of 31 March 2022). The Bundeskartellamt cannot take action against individual companies to put an end to violations of consumer law because, unlike in the area of competition law, the authority does not have any corresponding enforcement powers in the area of consumer protection. In connection with possible amendments to the German Competition Act (GWB), there are discussions about strengthening the Bundeskartellamt’s competences in the public enforcement of consumer laws. According to the federal government’s coalition agreement, it is to be examined what powers the Bundeskartellamt can be given, in analogy to its powers under the GWB, to investigate and put an end to substantial, permanent and repeated infringements of economic consumer law.