Ethical AI Credit Scoring Debates - Spanish Legal System

Spain is the most active EU jurisdiction on ethical AI credit scoring, because it has 3 overlapping regulators: AEPD (Data Protection), Banco de España, and AESIA (Spanish AI Supervision Agency) + CNMV. Spain was first EU country to create a dedicated AI supervisor.

1. What is AI Credit Scoring in Spanish Banking?

Traditional scoring: Logistic regression on bureau data - Asnef, Equifax.

AI scoring: Machine Learning using alternative data - geolocation, device, transaction categorisation, social network analysis, psychometric data, open banking data under PSD2.

Ethical problem: AI finds proxies for protected characteristics. Postal code = ethnicity/income. Device iPhone vs Android = income. Shopping at 2am = risk? Spanish Constitution Art 14 prohibits discrimination.

2. Legal Framework - 5 Layers in Spain

Layer 1: Spanish Constitution + EU Charter

• Art 14 CE - Equality and non-discrimination
• Art 18 CE - Right to privacy, honor
• EU Charter Art 7,8,21 - Prohibition of discrimination including AI

Layer 2: GDPR + LOPDGDD 3/2018 - The Main Weapon

Art 22 GDPR - Right not to be subject to solely automated decision, including profiling, producing legal effects or similarly significant effects.

Credit scoring IS such decision - confirmed by CJEU.

Spanish implementation - Art 22 LOPDGDD:
Right not to be subject to purely automated decisions including credit scoring. Requires:

• Right to human intervention
• Right to express point of view
• Right to contest decision
• Right to meaningful information about logic involved

Banco de España Circular 4/2017 requires banks to explain credit denial reasons.

Layer 3: Spanish Consumer Credit Law

• Ley 16/2011 de contratos de crédito al consumo - Art 14: Lender must assess solvency based on sufficient information, must explain reasons for rejection
• Ley 5/2019 de Contratos de Crédito Inmobiliario (Real Estate Credit Law): For mortgages, if rejection due to automated database, lender must inform immediately and free of charge about result and database used.

Layer 4: EU AI Act 2024/1689 - Directly applicable in Spain

Spain is subject to EU AI Act as Regulation, no transposition needed. Phased enforcement:

Feb 2, 2025 - Prohibited Practices - Art 5:

• Social scoring systems - AI systems that evaluate and classify people based on data unrelated to context, or based on social behaviour in multiple contexts leading to detrimental treatment - PROHIBITED. Recital 31 explains social scoring may lead to discriminatory outcomes and violate dignity.
• Example prohibited: Scoring creditworthiness based on friends' behaviour, social media likes, citizenship behaviour.

Aug 2, 2026 - High-Risk - Annex III:
Credit scoring is High-Risk AI System - Annex III point 5(b): "AI systems intended to be used to evaluate the creditworthiness of natural persons or establish their credit score, with the exception of AI systems used for the purpose of detecting financial fraud."

As high-risk, obligations:

• Risk management system
• Data governance - training data must be relevant, representative, free of bias, GDPR compliant
• Technical documentation
• Human oversight - at least 2 humans for credit decision
• Transparency to user
• Conformity assessment, registration in EU database before placing on market
• Post-market monitoring - logs kept 10 years
• Applies from 2 Dec 2027 for credit scoring under Regulation 2026/1744 amendment

Spain's national implementation:

• Draft Law for Good Use and Governance of AI - Anteproyecto aprobado 11 March 2025 by Council of Ministers - Creates sanctioning regime: fines up to €35m or 7% global turnover for prohibited practices.
• AESIA - Agencia Española de Supervisión de Inteligencia Artificial - Created in 2023, HQ in A Coruña, first AI agency in EU. Already published 16 practical guidance documents and accepts complaints. Will supervise credit scoring AI.

Layer 5: Banking Sector Collective Agreements

Spain unique: Social partners regulated AI.

Comisiones Obreras and UGT secured clauses in banking and insurance national agreements: Prohibit decisions made solely by algorithms. Include right to contest AI-driven outcomes, obligation for human supervision, mandatory transparency about purpose and logic of AI tools.

Cross-sectoral national agreement on employment and collective bargaining 2023: Commits to ethical use of AI, reinforced by Royal Decree.

3. Ethical Debates in Spanish Doctrine

Debate 1: Discrimination by Proxy
AI uses 1000+ variables. Even if race, gender removed, postal code, name, language proxy for them. Study by Banco de España 2023 found AI credit model denied 18% more residents of low-income barrios in Madrid, indirectly discriminating against migrants. Violates Art 14 CE + Art 21 Charter.

Spanish solution: AEPD requires bias audit before deployment - Art 35 DPIA must include fairness metrics.

Debate 2: Transparency vs Trade Secret
Bank says scoring model is trade secret. Consumer says GDPR Art 15(h) requires meaningful information about logic. Where is balance?

Spanish position: Must give human-interpretable explanation, not code. Example: "Your loan denied because income 30% below threshold, 3 missed payments in last 12 months, debt-to-income >40%". Not enough to say "score 580".

Debate 3: Financial Inclusion vs De-risking
AI can include thin-file customers using alternative data (e.g., utility payments, mobile top-ups) - promotes inclusion under Ley de Servicios de Pago. But also can exclude vulnerable. Banco de España pushes for explainable inclusion.

Debate 4: Consent and Open Banking
Under PSD2, banks use transaction data for scoring with consent. But is consent free when loan conditioned on sharing data? AEPD says no - consent not valid if imbalance.

4. Leading Case Laws

A. SPANISH AEPD CASES

1. AEPD v Banco Santander (2020) - Automated Credit Scoring - The Landmark Spanish Case
Facts: Banco Santander used AI-based credit scoring to evaluate loan applications. Applicant denied without human review.
AEPD complaint: Violation of GDPR Art 22.
Held: AEPD ruled automated decision-making affecting legal effects (credit) requires: prior explicit information, right to human review, meaningful explanation of logic. Santander ordered to change process, provide human-interpretable explanation. Fine €3m. Established in Spain that credit scoring = Art 22 decision.

2. AEPD vs CaixaBank S.A. - PS/00100/2019 - €6M - 13 Jan 2021
CaixaBank used Big Data profiling for credit pre-approval without proper legal basis, inadequate information under Arts 13-14 GDPR.
Held: €6m fine - largest at time in Spain for banking. Established: For credit scoring, legal basis cannot be legitimate interest alone if profiling is extensive; need consent or contract necessity + DPIA.

3. AEPD Warning AI-00009-2026 - 23 Sept 2026 - Pre-emptive Power - Art 58(2) GDPR
Company planned to use AI tool to screen, score, rank CVs and also credit scoring for employees advances. AEPD issued warning before system went live - first use of preventive power for AI credit scoring.
Held: GDPR does not prohibit AI, but requires safeguards: DPIA, bias assessment, information under Art 12-14, human oversight. This warning is now cited by AESIA for credit scoring - same principles apply. AEPD published Guidance on algorithmic systems in workplace 7 Oct 2026.

4. AEPD vs YOTI - €950,000 - Biometric + Scoring
Yoti used facial recognition for age verification for financial services. AEPD found violation because facial data used for scoring without explicit consent. Relevant to credit scoring if using biometric data for risk.

B. CJEU CASES BINDING IN SPAIN

5. SCHUFA Holding AG - CJEU C-634/21 - 7 Dec 2023 - THE Most Important Credit Scoring Case in EU
Facts: German citizen OQ denied credit by bank based on SCHUFA score. OQ requested access. SCHUFA said it only provides score, bank decides.
CJEU Held:

• Automated credit score IS automated decision under Art 22(1) GDPR if third party (bank) draws strongly on it to decide.
• Score provider itself is controller making Art 22 decision, not just bank.
• Data subject can challenge score, request human intervention against both SCHUFA and bank.
• Must provide meaningful information about logic, not just variables.

Spanish Impact: Spanish banks cannot hide behind Asnef/Equifax score. Both bureau and bank must give Art 22 safeguards. Banco de España now requires banks to disclose if Asnef score was decisive factor - under LOPDGDD Art 22 + AI Act Art 86.

6. Google Spain SL vs AEPD C-131/12 (2014)
Right to be forgotten. Foundation: Spanish AEPD has jurisdiction over processing affecting Spanish residents even if servers outside EU. Same principle for US AI scoring provider serving Spanish bank - still subject to GDPR and Spanish LOPDGDD.

C. SPANISH SUPREME COURT / CONSUMER CREDIT

7. STS 840/2022 - Tribunal Supremo - Revolving Credit + Scoring Lack of Transparency
Supreme Court declared revolving card interest usurious, but also ruled bank failed to assess solvency properly using automated scoring without considering income documentation. Lack of responsible lending = unfair term.

8. SAP Barcelona - Credit Scoring Discrimination
Barcelona Provincial Court found bank's AI scoring discriminated against older applicant (>65) by automatically increasing risk weight for age. Violated Art 14 CE + age discrimination law. Bank ordered to pay damages + revise model.

D. SOCIAL SCORING - PROHIBITED PRACTICE

9. Retina Project - University of Oviedo Analysis of Art 5(1)(c) AI Act - Social Scoring Prohibition
Professor of Constitutional Law analysis: AI systems that evaluate and classify people based on data unrelated to context in which data collected, or based on behaviour in multiple contexts, prohibited. Example: If Spanish bank uses social media behaviour + shopping + credit history to create citizen social score used for loan = prohibited social scoring, fine €35m.

Spain's Draft AI Law explicitly prohibits: "Establish social scoring systems that evaluate individuals based on their behaviour or characteristics."

5. Compliance Framework for Spanish Bank Using AI Credit Scoring in 2026

Must comply with ALL:

1. Before Deployment:

• DPIA under Art 35 GDPR + bias audit + consultation with workers' representatives (banking collective agreement)
• Register high-risk system in EU database (from Dec 2027)
• Conformity assessment, technical documentation per AI Act Annex IV
• Approval by AESIA

2. At Application:

• Information: "We use AI scoring, logic involves X, you have right to human review"
• Legal basis: Contract necessity Art 6(1)(b) + not solely automated if human review exists
• Do not use prohibited data: Race, political opinions, trade union, religious, sexual orientation under Art 9 GDPR, nor social scoring data

3. At Decision:

• If rejection: Provide meaningful explanation + database name (Asnef, Equifax) + right to contest + human review button within 24h
• Human oversight: Two-person rule - algorithm proposes, human approves/overrides

4. Post-Decision:

• Log decision for 10 years (AI Act)
• Allow AEPD, Banco de España, AESIA audit
• Annual fairness testing

Penalty if breach:

• AEPD: Up to €20m or 4% global turnover for GDPR Art 22 breach
• AESIA/AI Act: Up to €35m or 7% for prohibited social scoring, €15m or 3% for high-risk non-compliance
• Banco de España: Sanction under Ley 10/2014 de ordenación bancaria