The National Commission on Informatics and Liberty (CNIL) published a recommendation in May 2026 and explanations on the rights of individuals in case of credit refusal, notably concerning the assessment of their creditworthiness.

Financial institutions, which are not obliged to grant credit under the principle of contractual freedom, have the legal obligation to assess the creditworthiness of applicants. This assessment may rely on artificial intelligence tools or statistical models, which must comply with the GDPR regarding transparency and non-discrimination, with the institution remaining responsible for the final decision. Before granting credit, the lender must notably consult the national file of repayment incidents on personal credits (FICP), managed by the Banque de France, and may also consult the central check file (FCC).

A credit refusal may result from several factors, such as a situation deemed risky by the lender, multiple requests to institutions of the same group within less than six months, or an entry in a payment incident file. Data from a refused application may be retained for six months. Institutions may also use their own files listing past payment incidents, with the CNIL recommending not to use them beyond twenty-four months. Data subjects have the right to access their data, including their "score" and the elements to understand it, under article 15 of the GDPR, as well as the right to rectify inaccurate information in accordance with article 16 of the GDPR.