{"id":11320,"date":"2025-11-19T10:42:20","date_gmt":"2025-11-19T09:42:20","guid":{"rendered":"https:\/\/s8.tgin.eu\/?p=11320"},"modified":"2025-11-19T15:46:28","modified_gmt":"2025-11-19T14:46:28","slug":"data-protection-digest-19112025-consumer-loan-checks-can-reveal-peoples-lifestyle-data","status":"publish","type":"post","link":"https:\/\/techgdpr.com\/blog\/data-protection-digest-19112025-consumer-loan-checks-can-reveal-peoples-lifestyle-data\/","title":{"rendered":"Data protection digest 3-17 Nov 2025: Consumer loan checks can reveal people\u2019s lifestyle data\u00a0"},"content":{"rendered":"\n

Consumer loan checks<\/strong><\/h4>\n\n\n\n

Consumer loan checks can reveal people’s lifestyles. The Dutch Data Protection Authority AP concluded this after reviewing a bill concerning consumer loans. It believes that lenders can assess a person’s ability to meet payment obligations with less information about them. It’s unlikely that all the information in a bank statement, including sender, recipient, or description, is always necessary<\/a>. <\/p>\n\n\n\n

The bill introduces stricter rules for a consumer loan under 200 euros, (services like “buy now, pay later,” credit cards, and bank overdrafts). For these relatively small loans, the ability to pay the bill on time will also be checked, and whether there is a risk of default. People who use such loans will also be registered with the Credit Registration Office. The AP emphasises that the new rules need to be further developed for better data control and minimisation. <\/p>\n\n\n\n

Stay up to date! Sign up to receive our fortnightly digest via email.<\/mark><\/a><\/h4>\n\n\n\n

EU Digital Omnibus package latest<\/strong><\/h4>\n\n\n\n

<\/strong>The privacy advocacy group NOYB warns that the so-called Digital Omnibus, which is being prepared by the European Commission, brings fast-track deregulation<\/a>, including \u2018massive\u2019 reform of the GDPR and e-Privacy legislations. Following the draft proposal<\/a>, the Commission envisages changes to core elements like the definition of personal data, consent requirements, and data subjects’ rights, as well as lesser protections for special categories of data under the GDPR. In parallel, AI companies could also benefit from easier access to European personal data through the implementation of the \u2018legitimate interests\u2019 legal basis for processing.\u00a0\u00a0<\/p>\n\n\n\n

ETIAS and data protection<\/strong><\/h4>\n\n\n\n
\"\"<\/figure>
\n

<\/p>\n\n\n\n

As the clock ticks down to the launch of a new EU large-scale border management system, the European Travel Information and Authorisation System (ETIAS) in autumn 2026<\/a>, momentum is building to prepare it for entry into operation and ensure its compliance with data protection laws. The EDPS follows the implementation of ETIAS at close quarters. To help mitigate the risks, legislators have established an ETIAS Fundamental Rights Guidance Board. <\/p>\n<\/div><\/div>\n\n\n\n

Composed of representatives of the EDPS, EDPB, EU Fundamental Rights Agency, Frontex Fundamental Rights Office and Frontex Consultative Forum, the EFRGB is mandated to issue guidance on the fundamental rights impacts of processing ETIAS applications. A critical concern for individuals required to apply for an ETIAS is ensuring access to an effective judicial remedy. For instance, refusal of a travel authorisation could result from a data processing error.<\/p>\n\n\n\n

Brazil draft adequacy decision<\/strong><\/h4>\n\n\n\n

<\/strong>The EDPB also adopted an opinion regarding the European Commission draft implementing decision on Brazil\u2019s adequacy<\/a>. The General Data Protection Law in Brazil, LGPD, together with Presidential decrees and binding regulations issued by Brazil\u2019s Data Protection Authority, ANPD, establish requirements, including in relation to the principles, data subject rights, transfers, oversight and redress, closely aligned with the GDPR and case law of the CJEU. At the same time, the EDPB invites the Commission to clarify further how certain exemptions and specific limitations of data subject rights in the LGPD correspond to the adequate level of data protection regarding:<\/p>\n\n\n\n