EU's data protection supervisor recommends that personal data such as search queries and browsing history should not be used for the assessment of credit scores
The European Union's lead data protection supervisor has recommended on Thursday that personal data such as search queries … Tweets: @carnage4life , @cubicleapril , @hypervisible , and @campuscodi Tweets: Dare Obasanjo / @carnage4life : The EU data protection supervisor has recommended that companies should not use browser & search history to determine credit source. Not sure which idea's worse, deciding how much you can loan me based on my searches or stealing my search history to do so https://therecord.media/... April King / @cubicleapril : Fintech companies being so shamelessly rapacious that the EU needs to say this makes me want to launch all their computers into the sun. https://therecord.media/... Hypervisible Dot Pdf / @hypervisible : This was a response to an IMF rec “which was universally panned and considered downright creepy, [but] showed, however, the underlying fear of most of the banking sector—that they are losing ground to tech companies like Amazon, Facebook, and Google.” https://therecord.media/... Catalin Cimpanu / @campuscodi : The EDPS recommendation somewhat comes as a response to that creepy IMF blog post from last year where IMF researchers argued that credit scores would be more accurate with nonfinancial data points such as browsing and search history. https://blogs.imf.org/...
Context & Ripple Effects
The European Data Protection Supervisor's opinion lands against a backdrop where credit-scoring inputs have been quietly expanding: Equifax and FICO's Data Decision Cloud already packaged consumer-score data into offerings aimed at financial companies and marketers, and fintech adoption of behavioral signals like search and browsing history was the natural next step the supervisor is now trying to foreclose.
It also fits a running argument about whether Europe's privacy machinery has teeth — critics have questioned the Irish Data Protection Commission's willingness to crack down on tech firms, so a non-binding supervisor recommendation puts the burden back on national enforcers to convert principle into practice.
First-order effects
- Fintech lenders and scoring vendors building models on search queries or browsing history face an authoritative signal that such inputs are off-limits under EU data protection law, forcing product and model reviews now.
- Data brokers and credit bureaus aggregating web-behavioral data for financial customers lose a would-be growth market inside the EU at the pitch stage, before products mature.
Second-order effects
- Enforcement pressure shifts to national authorities such as the Irish DPC, whose past reluctance toward aggressive action determines whether the recommendation changes behavior or stays advisory.
- Vendors pivot toward consented or transactional data sources for credit assessment, tightening supply of alternative-data inputs and raising their price relative to freely harvested behavioral signals.
Third-order effects
- If the pattern holds alongside the CJEU's later scrutiny of sensitive-personal-data tracking in the Lithuanian case, Europe is heading toward a tiered permission structure: broad behavioral data acceptable for advertising, but walled off from high-stakes decisions like lending.
- Credit assessment converges on explicitly sourced, auditable data — favoring incumbents with compliant data pipelines over startups built on scraped signals.
The trend: EU regulators are drawing an explicit line between behavioral data used for advertising and its use in consequential financial decisions, with credit scoring as the test case.