Experian Italia Fined €120K for Opaque Credit Scoring Practices Under GDPR
Experian Italia failed to provide data subjects with meaningful information about how their creditworthiness scores were calculated, violating GDPR's transparency and privacy-by-design principles. This is not merely a procedural failure — concealing automated decision-making logic directly undermines individuals' ability to contest inaccurate assessments and exercise their rights under Articles 13, 14, and 22 of the GDPR. Organizations that process personal data for profiling or scoring purposes are legally required to explain the logic involved, not just acknowledge that a score exists. The €120,000 fine signals that regulators are intensifying scrutiny of algorithmic transparency, particularly in the financial and credit sectors. Companies relying on automated scoring models must treat explainability as a compliance requirement, not a technical afterthought.
Tactical Insight
Immediate actions
- Audit all automated decision-making and profiling processes to ensure data subjects can receive clear, plain-language explanations of scoring logic.
- Review and update Data Subject Access Request (DSAR) response templates to include disclosure of scoring methodologies, input variables, and their relative weights.
Data governance improvements
- Embed privacy-by-design reviews into the development lifecycle of any new scoring or profiling model before deployment.
- Appoint a dedicated DSAR response team with subject-matter expertise in automated processing to ensure technically accurate and legally compliant replies.
- Document all profiling algorithms in a central model registry, including version history and explainability artifacts, to support rapid regulatory disclosure.
Long-term compliance measures
- Conduct annual GDPR Article 22 compliance assessments covering all automated decision-making systems that produce legal or similarly significant effects.
- Engage your Data Protection Officer (DPO) in regular reviews of credit and risk scoring models to validate ongoing compliance with transparency obligations.