I. Peer-to-Peer Lending

P2P lending is the most popular form of alternative finance by amount of capital raised. ^{Footnote 4} It is part of the broader lending based crowdfunding market, an umbrella term used to make general reference to digital business models that connect those who can lend or invest money directly with those who need financing. ^{Footnote 5}

As a new model of organization alternative to traditional banking, in P2P lending a legal person in the form of a digital platform collects and pools separate amounts of funds from individuals or businesses in a crowd to finance collectively a larger loan to other needing individuals in their capacity of consumers or small entrepreneurs. Essentially, depending on the business model, it is lending and borrowing between private parties through the intermediation of a for profit online platform that matches lenders with borrowers. ^{Footnote 6}

This business model is made possible by the advancement of technological innovation in the financial services sector. As analyzed further below in this Article, Fintech and big data are changing the way financial solutions are delivered to customers. ^{Footnote 7} To be clear, the primary roles and functions in financial services remain the same, but the way they are undertaken is changing—payments still need to be made, loans granted, savings and investments made, etc. Those specific activities still need to be undertaken as ever and do not change. What changes is how these activities are carried out and the roles undertaken by the providers.

The dealings among the three parties of a P2P lending transaction define the private law relationships. In its basic unsecured form, the borrower makes an inquiry or application to the platform indicating the amount and maturity of the sought loan. Next, the platform makes an assessment of the credit risk involved and sets the related interest rate to be published to potential lenders subject to the borrower’s agreement of the platform’s terms and conditions, including the obligation to repay the capital with interests in the agreed timeline and penalties for delays. In turn, the creditors or investors, also known as lenders, undertake a contract with the platform, which includes a contract for the benefit of a third party, and place their offers. After this, the loan is originated and the platform channels the funds from the lenders to the borrowers. ^{Footnote 8}

Crucially, there is no direct contract between the lenders and the borrower. Actually, the lenders and the borrowers remain anonymous to each other. In most models it is the platform that matches the lenders with the borrowers. In other models, though, the lenders may choose the borrowers in a pool by their characteristics or profile made by the platform. In these processes, the creditors or investors have access to limited information about the borrower, normally including the loan size, maturity, a basic risk scoring or rating, interest-rates, and return on investment. ^{Footnote 9}

Importantly, therefore, unlike traditional lenders that bear the credits on their balance sheet as well as eventual losses from non-repayment, the P2P lending platforms do not take risks through their contractual standing. They do not require capital, and they decentralize all financial risks, leaving them instead to the individual lenders. The lenders themselves bear the risk of credit, in particular that of the debtor’s insolvency or any failure to repay the loan. ^{Footnote 10} Likewise, they bear the risk of the platform’s insolvency or a shutdown of its operations.

Distinctive cost-saving features of the whole process are the standardization and the automatization of user interfaces and assessments. The lower transaction costs vis-à-vis traditional lenders motivate the users of P2P lending alongside other distinct advantages including: a reduced time lag; minimal bureaucracy and documentation requirements for the borrowers; and higher returns on the invested capital for the lenders. ^{Footnote 11}

By contrast, the extent to which negative factors—such as borrowers’ poor credit history and high credit risk—motivate the use of the of P2P lending by the parties is unclear. In principle, on the one hand, borrowers access credit that otherwise they would not have. On the other hand, lenders would obtain higher returns by investing higher risk capital.

According to some, however, the borrowers’ lack of access to mainstream loans plays a minor role. This is due to an analysis of data that compares the non-performing loan rates of the traditional banks with those of the platforms. The results do not seem to validate the segmentation between low and high credit risk and a different allocation of borrowers. ^{Footnote 12}

By contrast, other studies provide empirical suggestions that P2P lending platforms explicitly target high-risk borrowers who do not otherwise have access to mainstream traditional credit channels, thus segmenting the market. ^{Footnote 13}

It appears that there is neither clarity nor certainty of the extent to which the assessment tools used in P2P lending could in fact be used to identify and target vulnerable consumers with high-cost or unsuitable products. ^{Footnote 14}

This debate is important and deserves more attention to provide more conclusive evidence, in particular to inform consumer protection policies and law. What is certainly noteworthy for this study is the method employed to make the relevant assessments of the debtors and the ensuing consequences.

In fact, when a platform conducts a credit risk assessment of a borrower for its users, it is confronted with the same problems of credit risk analysis as traditional lenders—though the latter conduct the credit risk assessment in their own interest. Moreover, as is analyzed in the next section, traditional lenders should conduct by law a creditworthiness assessment in the interest of borrowers.

In principle, the creditworthiness and credit risk assessments are particularly important in retail finance. These assesments are important for the debtors to be able to borrow responsibly, obtain affordable credit services they need, and help prevent risks of over-indebtedness. They are also important for lenders in order to minimize losses in their own interest and in the interest of financial stability.

However, as will be shown further below, the P2P platforms’ methods of assessments are different from the already imperfect methods of traditional lenders and contain the significant additional feature that, unlike the latter, the former do not take any credit risks that, repetita iuvant, remain on the platforms’ users. Moreover, the application of credit laws to the platforms is questionable.

II. Credit Laws and the Creditworthiness Assessment

As noted, the relationship between the three parties of a P2P transaction is regulated by the contracts with the platforms. Thus, national contract and agency laws provide for the applicable regulatory framework. In addition, where the borrower is a consumer, relevant EU law applies, which mandates obligations in the area of credit to consumers.

The central pieces of applicable EU legislation are the Consumer Credit Directive ^{Footnote 15} (“CCD”) and the Mortgage Credit Directive (“MCD”). ^{Footnote 16} Both pieces of legislation apply to creditors who grant or promise to grant credit in the course of their trade, business, or profession. ^{Footnote 17} An important feature of these credit laws is the creditor’s duty to assess the creditworthiness of the borrowers.

Under the first limb of Article 8 CCD, creditors have to assess the consumer’s creditworthiness on the basis of “sufficient information” obtained from the consumer.Footnote ¹⁸ According to the interpretation of the Court of Justice of the European Union (“CJEU”), this provision leaves to creditors a broad margin of discretion in the determination of the information to be used.Footnote ¹⁹ In fact, the sufficient nature of the information may vary depending on the circumstances in which the credit contract was concluded, the personal situation of the borrower, or the amount covered by the agreement. In light of such interpretation, the CJEU declared that Article 8(1) CCD permits lenders to assess the creditworthiness of consumers solely on the basis of information supplied by them, on the condition that such information is sufficient and accompanied by supporting evidence, but not requiring a systematic verification by the creditor. ^{Footnote 20}

Only where it is “necessary” do financial institutions have to make such assessment on the basis of a consultation of the relevant database. ^{Footnote 21} Such circumstances occur in Member States whose legislation mandates them to consult databases, which is usually a requirement imposed by central banks for purposes of financial stability or by some national banking acts.

In Article 9 the CCD is concerned that, for competition purposes, access is ensured on a non-discriminatory basis for creditors from other Member States to databases used in another Member State for assessing the creditworthiness of consumers.

The creditworthiness assessment of consumers is also featured in the MCD as the most reliable tool capable of fostering responsible lending. The EU legislature believes that imposing such a duty will enable lenders to determine the ability of consumers to meet their obligations under the credit agreement, and thus function as a tool to detect or prevent over-indebted consumers. After the lesson learned from the financial crisis, the MCD requires that creditors take appropriate account of a number of relevant factors, thus, requiring financial institutions to obtain information directly from the consumer with the addition of relevant internal or external sources, but without mandating or explicating what these necessary external sources are. What the law explicates is that relevant factors include income, savings, assets, expenses, features of the loan of offer, et cetera. Credit data is one of many possible sources of information for the creditworthiness assessment. ^{Footnote 22}

Like the CCD, the MCD looks at the competition side of the market and it provides for the non-discriminatory access of creditors to the databases used in another Member State via the exchange of information among the competing creditors, specifying that such databases comprise databases operated by private information providers as well as public registers. ^{Footnote 23}

Article 18(5) MCD introduces a nominal “duty to deny credit,” but the nature of this provision appears unclear or open to different readings. According to the norm, the creditor makes the credit available to the consumer only when the result of the creditworthiness assessment indicates that the obligations resulting from the credit agreement are likely to be met in the manner required under that agreement. ^{Footnote 24} Therefore, if the outcome of the assessment is negative, indicating that the consumer is not likely to be able to repay his loan, the creditor should not grant the credit. ^{Footnote 25} Moreover, should this situation arise, creditors must also be able to invoke the specific indications they took into account for the assessment of the consumer’s ability to repay the loan. ^{Footnote 26} Under this interpretation, the intention of the European legislator is to impose on the Member States the introduction of a duty to deny and intervene in the freedom of the contractual parties, which could have opted to proceed to the conclusion of the credit agreement despite the negative assessment. ^{Footnote 27}

On a reverse reading of such a duty, the establishment of such an obligation should not mean that a positive creditworthiness assessment obliges lenders to provide the credit. This is expressly provided for in the relevant recital of the MCD. ^{Footnote 28} This seems to be explained by the legislator’s intervention in the general principle of the freedom of contracts, which requires an express legislative provision justified by reasons of superior public interest. ^{Footnote 29}

Questions arise as to the public or a private nature of the obligation, as well as of the resulting sanctions and issues of enforcement. All that the MCD does is reference to sanctions to be set up by the Member States individually. There is an argument among scholars about the legal nature of the lender’s obligation to carry out a creditworthiness assessment. Until recently, it was the majority’s opinion that this obligation is a public law duty only. ^{Footnote 30} As a result, a breach of such a duty could only trigger remedies laid down in the underlying sanctioning system of the national law providing for it. By contrast, the view of what until recently was seen as a minority is that the duty to carry out the creditworthiness assessment is a duty owed to the debtor; it is by nature either a private law duty or a duty with both public and private law character. ^{Footnote 31} According to this view, breach of this duty entitles the debtor to damages. As a result, the creditor would have to put the debtor in the situation he would have been in had the duty not been breached. The debtor could claim that, had the creditor properly carried out the creditworthiness assessment, either the creditor or the debtor would not have entered into the loan agreement. Accordingly, the creditor would have to pay for every loss suffered by the debtor as a result of having entered into the contract. This does not only include costs and interest but can also extend to the loan itself. Additionally, if the debtor became insolvent as a consequence of taking out the loan the creditor would have to pay for any loss resulting from the insolvency. ^{Footnote 32} What, in any event, appears doubtful is the extent to which the provision is capable of tackling the problem of over-indebtedness as its violation cannot lead to a debt cancellation without immediate repayment of the lent capital.

III. The Guidelines of the European Banking Authority (“EBA”) ^{Footnote 33}

To ensure that the provisions of the MCD on responsible lending are implemented and supervised consistently across the Member States, the EBA has issued guidelines on the way in which the creditworthiness assessment should be conducted. ^{Footnote 34}

According to the EBA’s guidelines, the creditor—when verifying a consumer’s prospect to meet his obligations under a credit agreement as referred to in Article 18 MCD:

However, according to Ferretti and Livada:

Moreover, under the EBA guidelines, the creditor should take into account relevant factors that could influence the consumer’s ability to meet his/her obligations. The factors may include other servicing obligations, their interest rates, the outstanding principal on such debt, evidence of any missed payments, and directly relevant taxes and insurance. ^{Footnote 37}

Importantly, the creditor should establish sound processes to assess the borrowers’ ability to meet their obligations under the credit agreement and maintain up-to-date records of those procedures, reviewing them at regular intervals. ^{Footnote 38}

Equally, to ensure that the high-level provisions on arrears and foreclosure will be implemented and supervised consistently across Member States and in support of their transposition into Member State domestic law, the EBA has issued a consultation on draft guidelines that aims at providing in greater detail how lenders should give effect to the provisions of Article 28 MCD. ^{Footnote 39}

These guidelines request that lenders establish policies and procedures to detect and handle consumers in financial difficulty, actively engage with consumers, and provide an undefined form of support alongside basic information as to the status of payments, consequences of failure to repay, and the existence of public schemes or support. As it concerns the resolution process, the guidelines contain a limited obligation on the creditor having to take into account the individual circumstances of the consumer and his interests—including the ability to repay—when deciding on which steps or forbearance measures to take. The listed concessions to the consumer include a total or partial refinancing of a credit agreement and/or a modification of the previous terms and conditions of a credit agreement, such as: extension of the term of the mortgage, change of the type of the mortgage, deferral of payment of all or part of the instalment repayment for a period, change of the interest rate, or offer of a payment holiday. ^{Footnote 40}

The EBA has further deepened the concept of the creditworthiness assessment by setting general requirements in its area of competence. In new draft guidelines, it finally recognizes that the creditworthiness assessment should aim to verify not only the borrowers’ ability and prospect to meet their obligations under the specific loan agreement, but also to provide an accurate single customer view that enables the assessment of the borrower’s ability to service and repay all its financial commitments.Footnote ⁴¹

The distinction between credit risk management and creditworthiness assessment eventually found recognition where the EBA demands that the verification of “the borrower’s profile is in line with the institutions’ and creditors’ credit risk appetite, policies and limits.”Footnote ⁴²

In so doing, lenders should use relevant information, which has to cover, at a minimum, an assessment of the borrower’s income, disposable income, financial situation, and source of repayment capacity to meet contractual obligations.Footnote ⁴³ Accordingly, lenders need to carry out the assessment of the borrowers’ creditworthiness before the conclusion of the loan agreement. When verifying borrowers’ prospects to meet their obligations, creditors should make reasonable enquiries to the borrower or third parties—for example, employer, public authorities, credit registers or credit bureaus—and take reasonable steps to verify the information and data collected. Where creditors make enquiries regarding borrowers’ personal data, “they need to ensure that they inform and seek permission from the borrower” in accordance with the General Data Protection Regulation.Footnote ⁴⁴

Importantly, when assessing borrowers’ ability to meet their obligations, lenders should consider potential negative scenarios in the future, including, for example, a reduction of income and an increase in interest rates.Footnote ⁴⁵

I. The Traditional Use of Personal Data in Credit Markets

The methods of assessment undertaken in the P2P lending process require a contextualization with the traditional use of personal data in the underwriting of financial agreements. Arguably, the state of affairs already presents a number of unresolved economic, policy, and legal complexities that for many aspects remain controversial, at least in the EU. Reference is made to the diverse uses of personal data for a variety of different purposes in the area of retail credit markets, not all of them univocal or universally recognized or accepted.

It is already a common feature that lenders process and share a growing amount of personal financial data about their customers to underwrite credit decisions. Lenders access databases managed by third-party providers, known as Credit Registries or Credit Bureaus, in order to evaluate a consumer’s application, the risks involved in the transaction and their management, or—controversially—the prospective customer’s creditworthiness. ^{Footnote 46}

Traditional credit data is personal data relating to debt payments and financial accounts with lenders. Examples include previous and existing accounts—which normally include mortgages—bank accounts, store cards, charge cards, credit cards, loan accounts, and in many jurisdictions even mail order accounts as well as telecom and other utilities accounts. The level of credit product coverage in the databases differs from country to country. This is also determined by the type of lenders taking part in the data exchange system. The detail of the type of information collected and disseminated within the financial services industry also varies considerably at national level. ^{Footnote 47}

In financial circles, the virtues of data sharing are usually portrayed in terms of more efficient processes and decision-making or for a better management of financial risks or fraud situations. Most of the time, the benefits for consumers have been highlighted in terms of products/services better tailored to their needs, better quality, or cost-efficiency. ^{Footnote 48} Moreover, the extensive use of credit data has been promoted to achieve a number of policy objectives. Examples include the facilitation of the access to a more affordable and better quality credit for consumers, ^{Footnote 49} the prevention of consumer over-indebtedness by limiting irresponsible/predatory lending, ^{Footnote 50} and the contribution to financial stability by limiting banks’ credit loss risks. ^{Footnote 51} Under certain national systems, consumer financial data can even be part of a broader information centralization system managed by national central banks for the purpose of oversight of the financial system as a whole—meaning they are an instrument for the prudential supervision of the banking system. ^{Footnote 52}

In its thrust towards the creation of a true European market for retail financial services, the European Commission has identified the twofold issue of whether, and what type, of credit data should be necessary for the creditworthiness assessment. They question whether further action is needed to facilitate provision of services or ensure consumer protection. ^{Footnote 53} The concern arises from the provisions of the CCD and MCD where creditors have the right to consult credit databases in other Member States on a non-discriminatory basis to assess the creditworthiness of potential customers. ^{Footnote 54} However, financial institutions still face problems when attempting to use data as the techniques for their collection, distribution, and use are still very diverse across the EU, and opinions vary on what type of data are relevant for creditworthiness assessments. This means that accessing and using these data from lenders in other Member States is problematic, and they are unable to provide their services cross-borders competitively.

The latter aspect raises the issue about the absence of a standardized EU-wide information infrastructure for univocal and defined objectives. This situation not only exposes a jeopardized EU single market in the area. The arrangements and function of data infrastructures in the national jurisdictions, the differences in volume and variety of the datasets and data sources, as well as the depth and breadth of the data in use—including differences in the meanings attributed to equivalent data—show that very different practices exist across the EU. ^{Footnote 55}

The portrayed diversity among the Member States raises the question of whether data processing practice works better to achieve well-defined and univocal objectives, especially as it concerns the creditworthiness assessment and without forgetting data protection legislation. For example, both the CCD and the MCD state that the provisions mentioning the use of credit data are without prejudice to the application of the EU data protection law on the protection of individuals, specifically, with regard to the processing of personal data and the free movement of such data. Those provisions must be respected, particularly as far as the requirements of “necessity” and “proportionality” of the processing are concerned. ^{Footnote 56}

Within the EU’s scattered framework, the question is whether practices in one Member State are more appropriate than those in the others. There is no study or evidence that may offer such a suggestion. That is why, arguably, the fragmentation in the Member States questions the reliability and proportionality of the practices in use in the national system. There are no uniquely accepted criteria or standards on the use of data—that is, there is no accepted/shared acceptance of what data are relevant to achieve defined objectives, especially when it comes to policy goals such as the creditworthiness assessment of borrowers or the provision of suitable loans to consumers.

Despite the questions that credit data pose for the integration of the EU single market in retail finance and the safeguard of its citizens, so far the policy and regulatory responses have been uncoordinated and equivocal—exposing the absence of common, harmonized, and/or appropriately resourced strategies at EU level. ^{Footnote 57}

II. Credit Scoring

Credit scoring is a systematic method used by lenders for evaluating the credit risk of each credit applicant. This provides an automatic analysis of the factors that have been predetermined to cause or affect the level of risk in lending. When used to assess consumers, it is essentially a way of recognizing different groups in a population according to certain features expressed by a combination of personal credit data and other non-personal information, and differentiating them on grounds of parameters and classifications set a priori from statistics for a predictive purpose. It is an analysis of customer behavior, with the objective to classify them in groups based on a predictive outcome associated with each customer. The probability of given events, for example a default in the repayment of a loan, is assumed to depend on a number of characteristics of the individuals. ^{Footnote 58} The factors relevant for such a classification purpose are usually determined through an analysis of consumers’ past payment history together with other descriptive information provided in the credit application form and other data from public sources.

In technical terms, scoring models are mathematical algorithms or statistical programs that determine the probable repayment of debts by consumers, assigning a score to an individual based on the information processed from traditional financial data and categorizing credit applicants according to risk classes. It is a classification method where the input characteristics are the answers to the application form questions and the result of a check with databases, and the output is the division between “good” and “bad” or something in between. ^{Footnote 59} In such a process, to avoid a selection bias, account has to be taken of not only the characteristics of borrowers who were granted credit, but also of those who were denied it. ^{Footnote 60}

Computer scientists believe that the reasons for the poor judgmental capabilities of humans are: (i) the subjectivity and the large grey area where the decision is up to the officers; (ii) humans being prone to bias, for instance in presence of a physical or emotional condition which may affect the decision-making process; (iii) personal acquaintances with applicants distorting the decision-making process; (iv) humans considering the evidence sequentially rather than simultaneously; and (v) the difficulty for humans of discovering useful relationships or patterns from data and the knowledge hidden in the same data. ^{Footnote 61} Moreover, humans are deemed to be costly and time consuming and thus replaceable by more efficient machines. ^{Footnote 62}

Clearly, no scoring system, even the better ones, may predict with certainty any individual repayment performance. ^{Footnote 63}

III. Fintech: Artificial Intelligence, Algorithms, and Big Data

It is within the above described complex and controversial scenario that the P2P lending assessments undertaken by the platforms should be contextualized. As anticipated, in fact, platforms use the tools of big data analytics as a substitute to the assessment tools and standards of bank credit analysis, resulting in incomparable credit assessment quality.

Broadly conceived, the term “Fintech” abbreviates “financial technologies” to deliver financial solutions. ^{Footnote 64} Many Fintech developments are based on proprietary artificial intelligence systems (AI) and associated innovative uses of data. AI embraces different forms of computer systems that are able to learn from the data and their own experiences to solve complex problems or uncover patterns to predict future data or perform decision-making tasks—also known as machine-learning powered by mathematical algorithms able to create further algorithms based on accumulated data. ^{Footnote 65} There is no single methodology to design such systems and they are likely to differ one from the other, closely guarded as trade secrets. ^{Footnote 66}

The rise of big data—large data collection and processing obtained from diverse and unrelated sources—has created vast digital catalogues of personal information that can be continually analyzed and categorized with AI.

Fintech should not be understood to refer to a specific scene of start-up legal entities disrupting finance with innovation. More comprehensively, it focuses on the financial services offered to end-users, and is therefore activity- or services-based. It is finance enabled by, or provided via, new technologies where the value chain increasingly includes alternative providers such as P2P platforms to the traditional ones. ^{Footnote 67}

IV. The Rationale for Innovation

As noted earlier, in mature financial markets, the common approach to risk has been that past behavior is predictive of future behavior. As a result, assessment tools that make use of data about previous or existing credit lines—such as credit data taken from traditional sources—have been developed on a large scale and in an increasingly automated way. The idea that data about the past is predictive of the future represents an early correlation, and is in many ways the ancestor of big data correlations.

As credit underwriting and technologies evolve, and standards and appetite for credit adapt to changing economic cycles and shifting demographics, a wider array of new data are now available in the credit risk analysis of lenders. These so-called “non-traditional” or “alternative” data are classified as big data gathered from diverse sources outside the standard credit reports that lenders use to evaluate consumer borrowers. Their volume is greater than that of the traditional sources as they are usually taken from several data points mined from consumers’ offline and online activities. Big data can now assemble data from where consumers shop, internet browsing, social media, digital data brokers, and other online trails to mathematically determine the creditworthiness or credit-risk of consumers. In this fashion, even if such big data is not intuitively related to creditworthiness or credit risk, all data becomes credit data with an open nature as to their sources. ^{Footnote 68}

These innovative techniques are capable of reshaping business models, underwriting criteria, and customer experiences. Their innovations associate the commoditization of big data analytics with an understanding of demographic changes, borrower needs, and how to connect to borrowers through new technological channels. ^{Footnote 69} Reportedly, the 2008 financial crisis has also played an accelerating role marking the impetus and arrival of new market players pushing for competition over innovation to lower costs and gain market share. ^{Footnote 70}

These new business models are the first ones to recognize the limits of traditional credit data. As credit underwriting and technologies evolve and credit adapts to changing economic cycles and demographics, lenders themselves want to target customers that may habitually have no or short credit history in the traditional sense—borrowers who may be termed the “invisible” or “unscorable.” A limit of traditional data is that they are largely of historical nature. As they make use of a limited number of categories of data relating to payment and debt histories to pursue new credit, they do not provide a reliable picture of the many factors that can lead someone to fall short of payments or high debt levels. ^{Footnote 71}

Again, the traditional model requires borrowers to take on debt before obtaining a credit score, leaving a large number of potentially creditworthy or profitable individuals unscorable by the traditional system. Such individuals may include the growing ranks of consumers who have migrated from other countries. In the EU there are nationals of other Member States who take advantage of EU free movement provisions but who are unknown in the host Member State. As seen earlier, traditional data is siloed in individual Member States. As such, the “unknown” issue can be more markedly the case for non-EU migrants. Moreover, traditional credit risk analysis and assessment methods are less effective in those economies where past data are not available, and especially where there are large segments of low-income or unbanked consumers. ^{Footnote 72} Traditional data portrays how reliable someone may be at spending with debt, presupposing that this person is a frequent debtor, incentivizing the building of a credit history. ^{Footnote 73} Therefore, these kinds of customer profiling remain incomplete.

Another case is that of young generations. They are users of new technologies and are connected in social media. Although they have not yet amassed wealth and have little to no credit history, they represent an important market segment. Moreover, the generational effects of the economic downturn that erupted in the last decade combined with high levels of youth unemployment may have delayed major purchases, thus prolonging the time it takes for young generations to establish a credit history. ^{Footnote 74}

Other significant market segments exist which traditional data are unable to serve. These are not only the unbanked or under banked consumers. Many households may have temporarily impaired financial capabilities. For example, consumers with otherwise immaculate or sufficient credit histories may experience hardship associated with the economic downturn. ^{Footnote 75}

All these examples show how traditional data sources are an imperfect indicator of credit risk analysis or creditworthiness assessment. From their side, the Fintech industry considers that traditional data may easily fail in identifying large segments of consumers, in detecting isolated versus recurring credit issues, or in providing more insight into consumer behavior. Thus, the overarching idea of big data, large datasets obtained from diverse unrelated sources, where Fintech makes the correlations. P2P lenders are able to source alternative data to target not only traditional customers with the added value of a more accurate profiling, but also customers that may habitually have no credit or short credit histories. Big data offers a more accurate profiling and are more predictive. ^{Footnote 76}

Illustrations of non-traditional data are emerging daily. The explosion of social media and professional networks provide unprecedented amounts of information that can be used to support decisions about an applicant’s credit risk. People post large amounts of personal information that can be captured. For example, to establish an estimated earning potential for borrowers with short job histories, lenders may consider information such as the education history, student loans, and the majors studied. In addition, if those “socially” or “professionally” connected with an applicant are responsible borrowers with stable employment and good credit histories, this may support the probability that the applicant him/herself is also a responsible borrower. The age of their social media accounts and the volume of activity within them can indicate an applicant’s interconnectedness and stability with their network. Some lenders apply similar concepts to an applicant’s professional networks. The individual’s job and the jobs their connections hold may provide insights into the strength of the applicant’s job stability. ^{Footnote 77} Analyzing social networks may allow lenders to understand other information such as race, socioeconomic status, and their comparative customer loyalty. ^{Footnote 78}

New data sources that can be included in the assessment of a borrower can contain phone and utilities bills. Customers can be asked to sign over permission to access personal emails, bank accounts, social media accounts, shipping data, their monthly cash flow over bank accounts, and online financial accounts such as Paypal, Amazon, or Ebay, amongst others. Heavy activity on these sites may suggest a healthy cash flow. Additionally, spending patterns may give indications of the frequency someone loses control of finances. Similarly, probing the way applicants click through web pages can give suggestions about some of their character traits such as impulsiveness or attitude towards risk-taking. ^{Footnote 79}

Any data that may align with default rates can quickly be incorporated into the assessment. For example, some lenders are starting to look for customers with gym memberships, as they were found to be more reliable than those without aforementioned memberships. ^{Footnote 80} Others look at stores frequented by people deemed by the company to have a poor repayment history. ^{Footnote 81} Systems have been set up to detect unsettling patterns that are indicative of higher risk, such as expenses for marriage therapy for possible problems leading to separation or divorce, which can lower credit lines or lead to the setting of higher interest rates. ^{Footnote 82} Even web searches for the applicant’s name combined with keywords chosen by the lender may provide information. ^{Footnote 83} Accounts of smart devices provide other detailed data—for example they generate calls and text messages over given periods of time, each carrying a rich data set including the time the call was made, which may indicate having a more or less fixed job, the location of the caller at the time of the call, the receiver of the call, the type of information accessed via text messaging, and the types and number of payment transactions made through such devices. For those customers who consent to the sharing of their data in order to access credit, prepaid-minute or internet traffic purchase patterns can indicate a steady or uneven cash flow. Retailer loyalty cards can provide important insights into consumers’ income, spending habits, and family structure. ^{Footnote 84}

All the above illustrations show the limitless potential of big data in personal finance. At the same time, they indicate how digitalization and ensuing business models direct to the financialization of the private lives of consumers.

I. Personal Data, Credit-Risk Analysis, and the Creditworthiness Assessment

As noted, the emergence of policies over responsible lending in the area of credit for consumers—especially commencing in the preparatory works of the CCD and developing further in the MCD—and the resulting legal requirements to lenders to engage in the creditworthiness assessment of customers have shaped the rhetoric justifying the use of personal data in the lending process. This usually occurs with the consultation of databases and the use of scoring models. These tools have been promoted to assess the credit risk or creditworthiness of customers in order to prevent over-indebtedness by limiting excessive borrowing.

However, while the concepts of credit risk analysis and creditworthiness assessment may be easily confused, they are not the same and require a distinction. In fact, the temptation would be to consider that the creditors’ interest coincides with that of debtors: if the former reduce their credit risk, it is more likely that the latter would be able to repay their debts, thus diminishing the risk of becoming over-indebted. Following this temptation, however, would be folly.

Lenders may increase their profitability if the borrower falls in arrears, pays penalty interests, but eventually repays the debt. Similarly, lenders may market a more expensive credit service to some consumers who, on the basis of credit risk analysis, can nonetheless repay the debt or repay it with arrears. ^{Footnote 85} Financial incentives may lead lenders or intermediaries to market services that, though repayable by the consumers, do not necessarily coincide with their needs. ^{Footnote 86} In all these cases, lenders have minimized their credit risk to their profitability, yet the consumer suffers a detriment.

The above examples show that the concepts of credit risk and the creditworthiness assessment are not coincidental and may serve different interests. Therefore, the concept of creditworthiness assessment, which derives from responsible lending policies and finds legal recognition, requires a further analysis.

Responsible lending and borrowing is a post-economic crisis policy to tackle consumers’ over-indebtedness. In principle, it refers to the delivery of responsible and reliable markets, as well as the restoration of consumer confidence, where credit products are appropriate for consumers’ needs and are tailored to their ability to repay their debts. They envisage a framework that could ensure that all lenders and intermediaries act in a fair, honest, and professional manner before, during, and after the lending transaction. Similarly, it is expected that, in order to obtain credit, consumers provide relevant, complete, and accurate information about their finances. They are also encouraged to make informed and sustainable borrowing decisions. ^{Footnote 87} Therefore, responsible lending means that lenders should not act solely in their own interests, but also that they should take into account the borrowers’ interests and needs throughout the relationship in order to satisfy consumer needs and prevent over-indebtedness. In so doing, responsible lending also envisages a policy framework to prevent economic and social detriment at macro-level, when consumer indebtedness reaches high levels in the economy.

The duty refers to both pre-contractual and post-contractual stages of the relationship between lenders and borrowers, and encompasses the whole life cycle of credit services, from their inception through marketing and until the borrower has repaid the loan. Thus, an important prerequisite for responsible lending is that consumer credit services are designed in a responsible way so as to reduce potential risks of detriment for borrowers that can be foreseen and therefore avoided. ^{Footnote 88} For example, the importance of financial services design from a consumer protection perspective has been increasingly recognized in the post-crisis era, which has witnessed the introduction of the so-called product governance regimes across different areas of financial services. Such regimes generally relate to the organizational conduct of business rules that should be observed by financial institutions when developing financial services. ^{Footnote 89}

This means that lenders should also determine whether the borrowers are likely going to be able to repay without incurring substantial financial harm generally, and whether a credit and any related services are actually suitable for them. In this sense, the duty to assess a borrower’s creditworthiness indicates a borrower-focused assessment to prevent the latter from culminating in financial distress. ^{Footnote 91}

This stance seems to be corroborated by the CJEU. In LCL Le Crédit Lyonnais it was held that the creditworthiness assessment should be done in the interest of consumers to prevent irresponsible lending practices and over-indebtedness. ^{Footnote 92} To the extent that the interest of lenders is to enlarge the customer base and profitability, these interests may not coincide with the provision of suitable products in the interest of borrowers in terms of provision of financial services at affordable costs to those who need and qualify for them. Creditors certainly have an interest in the ability of debtors to repay under the credit agreement between the parties, but they may not be concerned about the sustainability of the new debt on other financial arrangements with other parties. A problematic repayment situation may arise if the consumer is not able to repay the debt within a reasonable time, and/or the consumer is only able to repay it in an unsustainable way—for example, by cutting back on essential living expenses or by defaulting on other loans or financial obligations. In these circumstances, a consumer may feel the need to take out more credit in order to meet the existing repayment obligations or cover basic living expenses. Moreover, the higher the risk is for the creditor, the higher the price of the loan. Instead, the borrower-focused creditworthiness assessment should primarily be designed to prevent the consumer from ending up in a problematic repayment situation that may result in over-indebtedness. ^{Footnote 93}

All things considered, therefore, while a customer’s assessment may also include the assessment of credit risk, it should by no means be limited thereto, but it should include a proper borrower-focused creditworthiness assessment.

Therefore, even more markedly than in the case of use of traditional credit data, arguably the expanded data processing of Fintech is mostly done in the interest of the platforms and, at least in principle, of the P2P lenders for their own risk and price assessments—ultimately for their profitability. It is objected here that this form of credit risk analysis and marketing—even in the broadest sense—may coincide with responsible lending and the creditworthiness assessment.

Having established that P2P lending does not engage in the creditworthiness assessment and before concluding in the direction of non-compliance or lack of enforcement, a subsequent question arises concerning the extent to which P2P platforms and/or lenders are under any obligation to conduct it in the first place.

II. The Applicability of Credit Laws to P2P Lending

As noted, both the CCD and the MCD apply only to creditors as defined in the respective laws. Both laws frame a “creditor” as a person who grants or promises to grant credit in the course of his trade, business, or profession. ^{Footnote 94}

The applicability of the provision to P2P platforms is doubtful. The CJEU shed light on the matter in TrustBuddy AB, where the request for a preliminary ruling asked precisely whether Article 3(b) CCD is:

Following to the platform’s bankruptcy, the case was deleted from the CJEU register and the question remained unanswered. ^{Footnote 96}

As the situation stands, it is reasonable to maintain that the definitions of “creditor” do not encompass persons whose business model only consists of matching borrowers with lenders or investors. At face value, a platform may qualify as a “credit intermediary,” defined as “a natural or legal person who is not acting as a creditor and who, in the course of his trade, business or profession, for a fee … presents or offers credit agreements to consumers or … concludes credit agreements with consumers on behalf of the creditor.” ^{Footnote 97} As a credit intermediary, the platform shall certainly have a number of information obligations, ^{Footnote 98} but not the duty to assess the creditworthiness of the borrower, which should be a responsibility that remains on the creditors under Article 8 CCD and Article 18 MCD. As a result, the applicability of the CCD and the MCD to P2P lenders does not appear straightforward.

If the P2P lender is a private individual, it would be hard to maintain the she or he falls within “the course of his trade, business or profession,” especially if this is not their primary means of living, but a mere investment in the same fashion as bonds, shares, funds, or else. Thus, the transaction could hardly qualify as consumer or mortgage credit, with resulting no obligations under the credit laws. By contrast, to the extent that a P2P lender is a natural or legal person who grants credit in the course of his business or profession, the credit laws should apply.

The problem is that, as noted earlier in this work, it is the platform that conducts its own assessment of risks and establishes the pricing. The above analysis indicates that the creditworthiness assessment is clearly missing and P2P lenders, where applicable, do not have any means to conduct it independently.

III. The Risks for Debtors

The above analyzed vacuum is clearly to the detriment of the borrower. Not only may the absence of a proper creditworthiness assessment cause problems of inability to repay the debt or other existing debts. Based on profiles, even solvent debtors are at risk of paying more than necessary. Algorithms, in fact, can match customers with the highest price they are capable or willing to pay, which does not necessarily mean meeting the consumer’s needs.

The question here is whether borrowers’ creditworthiness could be achieved through correlations or associations, bearing in mind that they are not causation. Likewise, prediction is not the same as knowledge. Unlike the latter, the former is not neutral and is used to determine the future. Therefore, the risk is that Fintech will create a more complex and fragmented financial environment where data analytics may exploit or manipulate consumer behavior or biases. The problem is that these systems are overly complex, not transparent, and there are no mechanisms to safeguard against abuses and mistakes—generally known as the “black box” problem. ^{Footnote 99}

Algorithms are complicated and opaque and, as a result, they transform numerous bits of apparently neutral or unrelated information about a consumer into straight numerical scores that determine the outcome and/or price of applications. Most of the time not only the logics/biases of the algorithms remain secret, but also the data sources used by the individual lenders are undisclosed. Accordingly, the use of algorithms raises concerns that consumers have limited means to identify and contest lenders’ decisions and to undertake the necessary steps to improve their chances. ^{Footnote 100} It is arguably very difficult to determine how the data is correlated and whether the variety of unrelated data operates as proxies for personal features—also being of sensitive nature—targeting vulnerable individuals or behavioral biases. The fact that qualitative data is selected in addition to quantitative data poses the risk of unintentional or even intentional discrimination—for example, by cherry-picking certain borrowers and manage default rates that increase profitability—especially because their choice reflect biased human decisions in the design of the algorithm. Algorithms work on the basis of predetermined features or variables. Therefore, they are in a sense inherently biased or discriminatory. They assess the features of a person—thus his or her viability—according to the past behavior of others. In this way, the most appropriately designed algorithm is the one that can select, or discriminate, most effectively or better than others. This is a fundamental feature of algorithms that cannot be avoided. Obviously, the resulting decision-making does not overtly discriminate on the basis of factors such as race, gender, or age that are caught by anti-discrimination laws. ^{Footnote 101} Nevertheless, it may instead use correlated information to build an in-depth profile of a particular customer and make indirect or other discriminations not explicitly covered by the law—such as discriminations based on behaviours, culture or wealth. Some instances of these discriminations can be traced back to traits of race, gender, or, age but they will be very hard—if not impossible—to prove. Big data may unearth protected information. For instance, they may reveal information that could not be otherwise obtained in any credit application, for example, shopping lists may reveal medical information or the health status of a person. ^{Footnote 102}

In totality, an indiscriminate use of data may easily lead to increased stereotypical decisions. They may respond to schemes concluding that certain groups of the population pose greater credit risks than others, so lenders decide to refrain from allowing access to financial services to those groups of consumers or make them pay more. In short, big data and Fintech allow too much access into their customer’s personal lives, and thus can create or ruin reputations. ^{Footnote 103}

All the above concerns can be exacerbated by inaccuracies in the data, the speed of its dissemination, or pre-existing biases. Big data can become a real problem for consumers who will not be able to determine where an error or a bias exists. If, under the traditional credit assessment system, they may be able to identify wrong or partial information in relation to a credit line or credit history, big data may make it impossible to know where the error or bias comes from because too much unrelated data from too many sources comes into play. Equally, big data can well frustrate the legal right individuals have to correct their data. ^{Footnote 104} These risks not only expose an increasing intrusion in people’s private lives, but also raise debates and concerns over the financialization of their lives and the shaping and conforming of behaviors beyond that of repayment.

In sum, the identified risks stemming from big data analytics in Fintech applications may appear several and diverse in nature, ranging from the absence of a creditworthiness assessment, consumer over-indebtedness, unsuitable credit lines for consumer needs, abuse of market power, exploitation of vulnerable consumers, discrimination between consumers, stereotypicization, system complexity, and opacity.

IV. The Risk for Creditors

It is possible that the assessment processes undertaken by P2P platforms through Fintech and big data may replace the traditional credit risk analysis of traditional lenders. As noted, the underlying rationales are the enlargement of the customer base, more accuracy, and tailored pricing.

Even here, however, problems arise, this time for the P2P lenders. Because platforms do not bear any financial risks—aside from their business reputation—but instead gain from the transaction, it is anomalous that they are entrusted with the conduct of a credit-risk analysis under their own criteria. The P2P lenders do not know such criteria or the logic used for the assessment of the borrowers and the evaluations made. Their capital could be at risk and it is unclear how accurately such a risk is compensated by appropriate pricing. This rings even truer if one considers that Fintech and big data operate in an opaque manner unknown to the P2P lender and protected under trade secrets. These situations are exacerbated when the P2P lenders are unaware individuals who are, more often than not, laypeople.

Additionally, in those Member States where traditional lenders are subjected to consultation and reporting in public data registries, P2P lending would circumvent such an obligation where the P2P lenders are professional ones.

All in all, it appears evident that P2P lending operates in a legal vacuum where both unaware creditors and debtors face major risks due to the absence of the obligation to perform the creditworthiness assessment or the outsourcing of the credit risk analysis onto platforms. ^{Footnote 105}