The Constitutional Court, pursuant to the new Personal Data Protection Law, and in the area of credit information, positive information and information of a personal nature to be included in the data banks of Private Risk Information Registries (Centrales Privadas de Información de Riesgos or CEPIRS), has established the following criteria:

• On the credit information to be included in Private Risk Information Registries data banks: The Constitutional Court has ruled that it is legitimate and in accordance with freedom of contract rights that there should be a continuous flow of credit risk information in the market, since this is the only way to build up confidence in the financial system . When credit institutions have a credit history for their customers they can conduct a more thorough credit assessment, and in this way have a sounder basis for deciding whether to originate a loan or not. This will have a direct repercussion on the society’s economy.
• On Private Risk Information Registries and positive information: Private Risk Information Registries are mandated to store information about both non-performing and performing loans. Their aim is not only to identify persons who do not represent a fair credit risk, but also to establish how much can be lent, and for how long, to those who have taken out a loan in the financial system in the past.
• On storing personal information in CEPIRS: The Constitutional Court notes that personal information, such as home addresses, telephone numbers, employment information, etc, does not include details of the borrower’s track record in the financial system. Such data may only be gathered for a “particular, explicit and legitimate purpose”; and the express consent of the borrower will be required for this information to be used commercially. As a result, the Supreme Court has ruled that the CEPIRS’s use of this personal information exceeds their powers and does not meet the purpose for which they were set up, which is to process data about creditworthiness and loans.