1. Introduction

Digital credit risk evaluation systems are technological systems used by banks, financing companies, microfinance institutions, and other authorised lenders to assess whether a borrower is likely to repay a loan.

These systems may analyse income, existing debts, repayment history, account transactions, business revenue, collateral, and other relevant financial information. Some systems also use statistical models or artificial intelligence to estimate default risk and recommend whether credit should be approved, refused, or offered on different terms.

In Morocco, these systems raise important civil-law questions concerning contractual consent, accuracy of financial information, privacy, confidentiality, lender responsibility, electronic evidence, and compensation for wrongful conduct.

The central legal question is: How can Moroccan lenders use digital credit scoring while respecting borrowers' rights and complying with applicable banking, data-protection, and civil-liability rules?

Morocco does not have one comprehensive statute governing every aspect of automated credit scoring. Instead, several bodies of law apply together.

2. Principal legal framework in Morocco

Law No. 09-08 is especially important because credit-scoring systems process identifiable information about an individual's financial circumstances. The law requires personal data to be processed lawfully, for specified purposes, and in a manner that is adequate, relevant, and not excessive. It also addresses data accuracy, information rights, access, and correction.

CNDPSupport+2

The precise obligations of a lender depend on the type of credit, the nature of the institution, the data used, and the applicable sector-specific rules.

3. How a digital credit risk evaluation system works

Stage 1 — Data collection

Income, existing liabilities, repayment history and relevant financial records

Stage 2 — Data verification

Identity checks, consistency, accuracy and lawful use of information

Stage 3 — Risk assessment

Statistical scoring, affordability analysis and default-risk estimation

Stage 4 — Credit decision

Approval, refusal, additional checks or revised lending terms

Stage 5 — Review and accountability

Correction of errors, audit trails, complaint handling and legal remedies

Each stage can create a distinct legal issue. For instance, an inaccurate repayment record may produce an incorrect score, while an inadequately governed model may treat similarly situated applicants inconsistently.

The existence of an unfavourable score does not, by itself, establish a legal violation. The relevant question is whether the lender complied with its applicable duties and whether the borrower can establish a legally actionable error or harm.

4. Civil liability arising from digital credit evaluation

Civil liability arises when a lender, credit-information provider, or technology supplier breaches an applicable legal duty and causes legally recognised harm.

The Moroccan DOC is the starting point for analysing contractual and extra-contractual responsibility.

A. Incorrect credit information

Suppose a bank's scoring system records a borrower as having missed several instalments, although the borrower paid them on time.

Possible legal issues include:

Failure to maintain accurate personal data.

Failure to correct an inaccurate credit record.

Breach of a contractual obligation, where applicable.

Civil liability if the legal requirements for compensation are established.

Law No. 09-08 is particularly relevant because Article 3 requires personal data to be accurate and, where necessary, updated, with reasonable measures taken to rectify or erase inaccurate or incomplete information.

BDJ

B. Negligent algorithmic assessment

A model may use outdated data, defective assumptions, or an improperly configured calculation method.

For example, a lender might incorrectly classify a self-employed applicant as unable to repay because its system does not properly account for irregular but substantial business income.

The fact that the decision was produced by software does not automatically exempt the responsible organisation from applicable legal obligations. However, an unfavourable assessment alone does not prove negligence or create an automatic right to credit.

C. Unlawful use of personal information

Credit models may use personal information obtained from banking records, commercial databases, applications, or third-party providers.

A lender must examine the lawfulness of the collection and use of that information, including the requirements of Law No. 09-08. A person's consent is not the only possible legal basis under that law; other statutory grounds may apply.

D. Contractual responsibility

Once a credit agreement has been concluded, disputes may arise concerning the interest rate, repayment schedule, payment processing, enforcement, or other contractual terms.

Electronic contracts and records may be relevant evidence under the applicable rules. Whether a breach gives rise to damages or another remedy depends on the agreement, the relevant law, and the facts.

E. Responsibility of technology providers

A lender may use an external vendor to supply scoring software or process borrower data. Outsourcing does not automatically eliminate the lender's own obligations.

The parties' contracts should identify responsibilities for data accuracy, system security, testing, incident reporting, audit access, and correction of errors. Where personal-data processing is outsourced, Article 23 of Law No. 09-08 also addresses security measures and the contractual relationship between a data controller and its processor.

BDJ

5. Six or more relevant judicial authorities

A significant qualification is necessary: I could not verify six published Moroccan judgments directly addressing algorithmic credit scoring. The following are genuine comparative judicial authorities relevant to automated assessment, credit information, personal-data rights, and remedies. They are not binding Moroccan precedents, and the EU General Data Protection Regulation (GDPR) must not be confused with Moroccan Law No. 09-08.

Case 1. OQ v Land Hessen (SCHUFA Holding — Scoring)

Court: Court of Justice of the European Union (CJEU)

Case number: C-634/21

Date: 7 December 2023

Legal issue: Whether an automatically calculated creditworthiness score can itself constitute automated individual decision-making.

Facts and principle: A credit-information agency calculated a probability score concerning an individual's ability to meet future payment commitments. A bank relied heavily on that score when deciding whether to grant credit. The Court held that the automated creation of the score could itself fall within Article 22 GDPR where the receiving third party drew strongly on it in making a decision that significantly affected the individual.

EUR-Lex+1

Relevance to Morocco: This is one of the most directly relevant comparative cases for digital credit scoring. It demonstrates that responsibility cannot always be assessed solely by looking at the bank that formally approves or rejects an application; the role of the scoring provider may also matter.

Limit: Moroccan law does not automatically reproduce the GDPR's Article 22 framework. Moroccan analysis must consider the actual requirements of Law No. 09-08, including Article 11.

Case 2. CK v Magistrat der Stadt Wien (Dun & Bradstreet Austria)

Court: CJEU

Case number: C-203/22

Date: 27 February 2025

Legal issue: Access to meaningful information about automated creditworthiness assessments.

Principle: The Court interpreted the GDPR's right to information about automated decision-making. It explained that meaningful information should enable the person concerned to understand the procedure and principles actually applied to their personal data. Merely disclosing a complex algorithm or providing a generic explanation may not be sufficient. Where trade secrets or third-party rights are implicated, the relevant information may require assessment by a competent authority or court.

European Union Agency for Fundamental Rights+1

Relevance to Morocco: This case provides a useful model for considering transparency in credit scoring. A borrower disputing an erroneous score may need enough information to identify the underlying error and challenge the assessment.

Limit: It interprets EU law, not Moroccan law. It does not mean that Moroccan borrowers automatically have an identical right to disclosure of every model parameter.

Case 3. SCHUFA Holding and Others — Discharge from Remaining Debts

Court: CJEU

Joined cases: C-26/22 and C-64/22

Date: 7 December 2023

Legal issue: Retention of information about the discharge of remaining debts.

Principle: The Court examined the retention of information relating to the discharge of remaining debts by a private credit-information agency. It concluded that the GDPR opposed the particular prolonged retention practice at issue where the information was retained longer by the private agency than in the relevant public register, subject to the circumstances considered by the Court.

curia

Relevance to Morocco: The case illustrates the importance of assessing how long negative financial information remains in a credit database and whether continued retention is justified.

Limit: It does not establish a universal retention period for Moroccan credit records. The applicable Moroccan rules and any relevant sector-specific retention requirements must be examined separately.

Case 4. Österreichische Post AG — Compensation for Infringement of Data-Protection Rights

Court: CJEU

Case number: C-300/21

Date: 4 May 2023

Legal issue: Conditions for compensation following unlawful personal-data processing.

Principle: The Court held that compensation under Article 82 GDPR requires an infringement, damage, and a causal link between the infringement and the damage. An infringement alone does not automatically establish entitlement to compensation, although EU law does not permit a minimum seriousness threshold to be imposed on non-material damage as a separate condition.

curia

Relevance to Morocco: This is a useful comparative framework for distinguishing a data-protection violation from a proven claim for damages. It helps structure analysis of harm allegedly caused by an inaccurate credit profile or unlawful disclosure.

Limit: Moroccan compensation claims are governed by the relevant Moroccan rules. The GDPR's specific remedy cannot simply be imported into Moroccan civil law.

Case 5. Österreichische Post AG — Identification of Data Recipients

Court: CJEU

Case number: C-154/21

Date: 12 January 2023

Legal issue: The right to know the recipients of personal data.

Principle: Under the GDPR, the data subject's right to obtain information about recipients generally includes the identities of actual recipients where they can be identified, rather than merely generic categories, subject to the conditions recognised by the Court.

curia

Relevance to Morocco: A borrower may need to understand whether credit data has been shared with a bank, a credit-information provider, or an external technology company. The case illustrates why transparency about data recipients can matter when investigating a disputed credit assessment.

Limit: The extent of disclosure available in Morocco must be assessed under Law No. 09-08 and its applicable procedures.

Case 6. Google Spain SL and Google Inc. v Agencia Española de Protección de Datos and Mario Costeja González

Court: CJEU

Case number: C-131/12

Date: 13 May 2014

Legal issue: Accuracy, relevance, and continued availability of personal information in search results.

Principle: The Court recognised that individuals could, under the EU legal framework then applicable, seek removal of certain search-result links where the relevant information was inadequate, irrelevant, no longer relevant, or excessive in relation to the purposes of the processing, subject to the applicable balancing of rights.

Relevance to Morocco: The case is useful by analogy when considering outdated financial information that continues to influence digital profiles. It highlights the importance of accuracy, relevance, and the continuing justification for retaining or disseminating personal information.

Limit: Search-result de-referencing is not the same as correcting a credit database. The judgment does not create an automatic Moroccan right to erase accurate and lawfully retained financial records.

Case 7. Barbulescu v Romania

Court: European Court of Human Rights

Application number: 61496/08

Date: 5 September 2017

Legal issue: Privacy and monitoring of electronic communications.

Principle: The Grand Chamber examined workplace monitoring of an employee's electronic communications under Article 8 of the European Convention on Human Rights and found a violation because the domestic authorities had not adequately protected the employee's right to respect for private life and correspondence.

Relevance to Morocco: Creditworthiness models can rely on extensive digital data, so the case illustrates the need to examine proportionality, transparency, and safeguards when organisations monitor or analyse personal information.

Limit: The case concerned workplace communications rather than lending. It is a broader comparative privacy authority, not a credit-scoring judgment, and the Convention framework does not automatically govern Moroccan proceedings.

Case 8. United Kingdom Supreme Court — Lloyd v Google LLC

Court: UK Supreme Court

Case number: [2021] UKSC 50

Date: 10 November 2021

Legal issue: Compensation and proof of damage in a large-scale data-protection claim.

Principle: The Court rejected the particular representative claim for compensation that had been advanced on the basis of loss of control over data without establishing individual damage in the manner required by the applicable law.

Relevance to Morocco: This decision illustrates why a claimant should distinguish an alleged data-protection infringement from the evidence required to establish a civil claim for compensation.

Limit: It is a UK authority involving a different statutory framework. Its approach must not be substituted for Moroccan rules on civil liability and damages.

6. Article 11 of Law No. 09-08 and automated credit decisions

Article 11 deserves particular attention because it addresses decisions based on automated processing of personal data.

It provides, in substance, that decisions producing legal effects concerning a person cannot be taken solely on the basis of automated processing intended to evaluate certain aspects of that person's personality. The provision also identifies circumstances that are not considered decisions based solely on automated processing, including certain contractual decisions where the individual has been given an opportunity to present observations.

For digital credit evaluation, this raises several questions:

Is the score used merely as one input, or does it effectively determine the outcome?

Is the system evaluating personal characteristics through automated profiling?

Has the borrower been given the opportunity to present relevant observations where required?

Does a statutory exception or another applicable legal provision affect the analysis?

The wording and exceptions in Article 11 must be examined carefully in each case. It should not be assumed that every automated credit score is prohibited, or that the presence of a human reviewer automatically makes every process lawful.

7. Credit information, confidentiality, and data accuracy

Credit-information systems can help lenders make informed decisions, but errors may have consequences across multiple institutions.

For example, a borrower might repay a debt, but the relevant record is not updated. A subsequent lender may rely on outdated information and decline the application.

The legal analysis should examine four issues.

First, accuracy. Under Article 3 of Law No. 09-08, data must be accurate and updated where necessary.

Second, transparency. Articles 5 and 7 address information at collection and rights of access to personal data.

Third, lawful disclosure. The sharing of information between a lender and a credit-information provider must comply with the applicable rules governing the processing and communication of personal data.

Fourth, security and confidentiality. Articles 23–26 address security measures, processing arrangements, and professional confidentiality.

These provisions may be relevant to a complaint involving inaccurate credit records, unauthorised disclosure, or inadequate protection of borrower information.

BDJ

8. Algorithmic discrimination and fairness

Credit-scoring systems may unintentionally disadvantage certain applicants if their inputs, historical training data, or design assumptions produce systematically inaccurate outcomes.

Potential risks include:

Treating irregular income as evidence of unreliability without assessing the person's actual ability to repay.

Using inaccurate or outdated financial records.

Giving excessive weight to characteristics that are weak predictors of default.

Producing inconsistent results for applicants with comparable financial circumstances.

Failing to identify data errors that disproportionately affect particular groups.

A lender should test whether the model is accurate, relevant, and suitable for the purpose for which it is used. It should also document model changes, monitor outcomes, and establish a process for investigating disputed decisions.

These are prudent governance measures. Whether a particular outcome amounts to unlawful discrimination or another legal violation depends on the applicable law and the facts; not every difference in credit treatment is unlawful.

9. Remedies available to borrowers in Morocco

A borrower who believes that a digital credit evaluation has been conducted unlawfully should identify the nature of the problem before choosing a remedy.

Step 1 — Request information and correction

Request access to relevant personal data and seek correction of inaccurate information under the applicable provisions of Law No. 09-08.

Step 2 — Complain to the relevant institution

Raise the issue with the lender or relevant credit-information provider. Depending on the matter, a complaint to Bank Al-Maghrib or the CNDP may be appropriate.

Step 3 — Consider judicial remedies

Depending on the legal basis, seek appropriate relief through the competent court, including correction-related relief or compensation where the legal requirements are satisfied.

Step 4 — Preserve evidence

Retain credit reports, loan applications, rejection notices, repayment receipts, correspondence, and any explanation provided about the scoring result.

A refusal of credit does not, by itself, establish an entitlement to compensation or a right to force the lender to approve the loan. The appropriate remedy depends on whether a legal duty was breached and what relief the law permits.

10. Compliance framework for Moroccan lenders

Banks and other covered institutions should implement a governance framework that combines legal compliance, model oversight, and borrower protection.

A well-designed system should enable a lender to explain its decision-making process at an appropriate level, investigate inaccurate records, and demonstrate compliance with the obligations applicable to its activities.

11. Critical assessment

Morocco's existing legal framework provides a foundation for regulating digital credit evaluation through civil liability, banking supervision, and personal-data protection. The principal challenge is applying these rules to systems where the assessment is produced by an algorithm and the data, model, lender, and technology provider may be controlled by different entities.

The comparative cases discussed above illustrate three particularly important issues:

Responsibility: A scoring provider may play a significant role even when another institution makes the final lending decision.

Transparency: Individuals need legally appropriate ways to identify and challenge inaccurate information.

Compensation: A claim for damages requires analysis of the applicable legal requirements, rather than an assumption that every error automatically produces compensation.

Morocco should not be described as having adopted the complete EU regime for automated decisions. Any assessment of an actual credit-scoring practice must be based on Moroccan law, including the specific provisions of Law No. 09-08, applicable banking rules, and the relevant contractual and civil-liability principles.

12. Conclusion

Civil Law and Digital Credit Risk Evaluation Systems in Morocco concerns the legal accountability of lenders and other organisations that use digital tools to assess creditworthiness.

The DOC supplies the general civil-law framework for contractual and extra-contractual responsibility. Law No. 09-08 governs important aspects of personal-data processing, accuracy, access, and automated decisions. Law No. 103-12 and applicable Bank Al-Maghrib rules provide the relevant banking-regulatory context.

The comparative authorities, particularly SCHUFA Holding (C-634/21) and Dun & Bradstreet Austria (C-203/22), offer useful guidance on automated scoring and transparency. However, they are foreign judgments and do not establish binding Moroccan rules.

The fundamental principle is that digital credit evaluation must remain legally accountable. Lenders should use reliable data, respect applicable privacy and banking obligations, maintain appropriate oversight, and provide effective procedures for investigating errors. Where unlawful conduct causes legally recognised harm, the affected person may pursue the remedies available under Moroccan law.