Profiling and credit scoring: legal characterization and application of the Peruvian legal regime for personal data protection

Abstract

The increasing use of automated mechanisms for the analysis of personal data, particularly profiling and credit scoring, poses significant challenges from a personal data protection perspective. Within the Peruvian legal system, the recent explicit incorporation of automated decision-making and profiling into the Regulation of the Personal Data Protection Law, approved by Supreme Decree 016-2024-JUS, requires a clear conceptual delimitation of these techniques, as well as an assessment of their compatibility with the principles and rights recognized under the current data protection framework.
In this context, this article aims to characterize profiling and credit scoring, to determine their conceptual relationship, and to examine the conditions that must be ensured to guarantee the lawfulness of their implementation in the Peruvian financial sector. To this end, a doctrinal approach is adopted, based on the analysis of comparative law, specialized scholarship, and advisory opinions issued by the National Data Protection Authority.
The paper argues that credit scoring constitutes a specific manifestation of profiling which, when integrated into decision-making processes producing legal effects, triggers the safeguards established under Article 87 of the Regulation of the Personal Data Protection Law. Consequently, its implementation requires a rigorous assessment of the applicable legal basis, the proper identification of the source of personal data, and a clear allocation of responsibilities between the data controller and the data processor.