Competition Law in Credit Scoring Data Access

1. Introduction

Credit scoring data access concerns the ability of banks, fintech firms, lenders, credit-reference agencies (CRAs), payment platforms, and other financial-service providers to obtain and use data needed to assess the creditworthiness of individuals or businesses.

The competition-law problem arises when an undertaking controls an important credit-data input and restricts competitors' access to it. Examples include:

• repayment and default histories;
• bank-account transaction data;
• utility-payment information;
• credit-card records;
• business financial information;
• alternative-data inputs;
• identity and fraud data;
• credit scores and risk indicators;
• APIs supplying credit information; and
• data generated by a dominant digital platform.

Credit information can be particularly important because lenders use it to assess whether to provide finance. For example, UK government analysis has recognised that CRAs supply both underlying credit data and risk scores to finance providers.

Competition law therefore intersects with data portability, interoperability, essential-input theories, refusal to deal, discriminatory access, tying, exclusivity, self-preferencing, and digital-platform dominance.

2. Relevant Competition-Law Framework

A. Relevant Market

Several markets may need to be distinguished:

1. Credit information/data market
2. Credit-reference services
3. Credit-scoring services
4. Consumer lending
5. SME lending
6. Fintech credit assessment
7. Fraud and identity verification
8. Alternative-data analytics

The relevant market may be narrower where the particular dataset has no close substitute.

For example, a lender might technically obtain data from several CRAs, but if one undertaking possesses a uniquely comprehensive dataset derived from a major payments or platform ecosystem, competition authorities may examine whether those alternatives are actually substitutable.

3. When Does Credit Data Become a Competition Problem?

Possession of valuable data does not by itself create an antitrust violation.

A competition concern generally becomes stronger where the following elements coexist:

1. Dominance

The undertaking has substantial market power in credit data, credit scoring, or a related financial market.

2. Strategic importance of the data

The data is necessary or particularly important for competing effectively.

3. Lack of realistic alternatives

Competitors cannot reasonably reproduce the dataset or obtain equivalent information elsewhere.

4. Restriction of access

The dominant undertaking:

• refuses access;
• supplies data only on discriminatory terms;
• imposes excessive access conditions;
• limits API access;
• delays data feeds;
• provides inferior-quality data to rivals;
• restricts interoperability;
• prevents customers from transferring their data; or
• grants preferential access to its own lending subsidiary.

5. Competitive effect

The conduct makes it materially harder for competing lenders or scoring providers to compete.

4. Refusal to Provide Credit-Scoring Data

A classic issue is whether a dominant credit-data provider can be required to provide information to competitors.

The general competition-law doctrine concerning refusal to deal is restrictive. Authorities normally examine whether the input is genuinely indispensable and whether refusal is capable of eliminating effective competition.

The essential-facilities doctrine can therefore become relevant, although not every commercially useful database constitutes an essential facility.

5. Discriminatory Access

Suppose a dominant credit-data company provides:

• full transaction information to its affiliated lender;
• real-time API access to its own lending division;
• but only delayed or incomplete information to competing fintech lenders.

This can raise concerns about discriminatory treatment.

The analysis may involve:

• objectively justified differences;
• pricing;
• data quality;
• latency;
• technical restrictions;
• API functionality;
• authentication requirements;
• volume limits; and
• whether the restrictions disadvantage downstream competitors.

Where the dominant firm competes downstream, discrimination can also resemble self-preferencing.

6. Data as an Essential Input

Credit data may possess characteristics that make replication difficult.

For example:

A platform possessing ten years of repayment behaviour from millions of customers may have accumulated an informational advantage that a new entrant cannot reproduce simply by investing in software.

However, competition authorities must distinguish between:

valuable data
and
indispensable data.

The fact that data gives a company a competitive advantage does not automatically mean competitors have a legal right to access it.

7. Data Portability and Competition

Data portability can reduce barriers to entry.

If consumers can transfer financial information from one lender or platform to another, new credit providers may be able to construct competing risk assessments.

This can weaken the competitive significance of data held by incumbent firms.

Consequently, competition and data-protection regimes can operate together:

consumer data → portability → interoperability → lower switching costs → greater competition.

8. Credit-Scoring Algorithms and Data Access

Credit scoring involves two different competitive resources:

A. Input data

Examples:

• repayment history;
• income;
• transactions;
• defaults;
• account balances;
• payment behaviour.

B. Analytical technology

Examples:

• scoring models;
• machine-learning systems;
• risk algorithms;
• predictive models.

A firm may possess both.

Competition concerns can therefore arise if a dominant undertaking controls both the data and the algorithmic infrastructure required by downstream lenders.

9. Data Quality as a Competitive Parameter

Access cannot be analysed merely by asking whether competitors technically receive the data.

The quality of access matters.

For example:

Thus, nominal access may exist while effective access is substantially restricted.

10. Tying and Bundling

A credit-data provider may require a lender purchasing credit scores to also purchase:

• identity verification;
• fraud detection;
• marketing data;
• analytics;
• payment services; or
• unrelated financial products.

Where the undertaking is dominant in one market, such bundling can potentially foreclose competing suppliers.

The competition analysis would consider market power, separate products, coercion, foreclosure, efficiencies, and consumer effects.

11. Exclusive Data Agreements

Exclusive arrangements can also raise competition issues.

For example, a dominant credit-scoring provider could enter agreements preventing banks from supplying their repayment data to competing CRAs.

This may create a data-accumulation feedback loop:

More lenders → more data → better scoring → more customers → more lenders → still more data.

Such network effects can increase entry barriers.

12. Self-Preferencing

A vertically integrated financial platform might:

1. collect extensive customer transaction data;
2. operate a credit-scoring service;
3. provide scores to external lenders; and
4. operate its own lending business.

A competition concern could arise if the platform uses privileged access to data to provide its own lending business with information or functionality unavailable to competitors.

The relevant question is not merely whether the company has better information, but whether its conduct unfairly restricts downstream competition.

13. Algorithmic Credit Scoring

Algorithmic systems create additional competition-law questions.

For example, several credit-data companies could use similar datasets and automated pricing systems.

Potential issues include:

• algorithmic coordination;
• common pricing algorithms;
• data pooling;
• exclusionary scoring criteria;
• discriminatory access;
• automated refusal to deal; and
• use of proprietary data to disadvantage competitors.

However, competition law must distinguish genuine algorithmic coordination from independent use of similar technology.

14. Privacy and Competition Law

Credit data is frequently personal data.

Therefore, competition authorities cannot treat personal information as an ordinary commodity without considering privacy law.

A competition remedy requiring extensive data sharing may have to account for:

• consent;
• purpose limitation;
• data minimisation;
• confidentiality;
• security;
• rights of data subjects;
• third-party privacy; and
• trade secrets.

The interaction is particularly important because credit scoring can involve highly consequential automated profiling.

15. Six Important Case Laws

Case 1 — IMS Health GmbH & Co. OHG v NDC Health GmbH

Court: Court of Justice of the European Union
Citation: Joined Cases C-241/01 P and C-242/01 P

This is one of the foundational EU cases concerning access to information infrastructure controlled by a dominant undertaking.

IMS Health possessed a pharmaceutical-sales information system structured into regional segments. Competitors sought access because reproducing the system could have been commercially difficult.

The case established important criteria concerning when refusal to license/access an intellectual-property-protected resource may constitute abuse of dominance.

Principle

Competition law does not automatically require a dominant undertaking to license its property or information.

Exceptional circumstances may exist where:

• access is indispensable;
• refusal prevents the emergence of a new product or service;
• refusal lacks objective justification; and
• competition is effectively eliminated.

Relevance to credit scoring

A proprietary credit-data architecture may similarly require examination of whether the dataset is genuinely indispensable rather than merely useful.

Case 2 — Bronner v Mediaprint

Court: Court of Justice of the European Union
Citation: Case C-7/97

The case concerned access to a newspaper home-delivery system.

The Court applied a demanding test to claims that a dominant company must provide access to infrastructure.

Principle

An input is not indispensable merely because another company would find it economically difficult to replicate.

The alternative must be practically or economically unrealistic in the circumstances.

Credit-data relevance

A fintech company cannot necessarily demand access to a competitor's credit database simply because constructing its own database would be expensive.

It would need to establish much stronger circumstances concerning indispensability and competitive harm.

Case 3 — Slovak Telekom v Commission

Court: Court of Justice of the European Union
Citation: Joined Cases C-165/19 P and C-166/19 P

The case involved access to telecommunications infrastructure and exclusionary conduct by a dominant operator.

The Court considered circumstances in which access restrictions could constitute an abuse of dominance.

Principle

Competition law can intervene where a dominant undertaking uses control over an important upstream resource to restrict competition downstream.

Credit-scoring relevance

The same economic structure may arise where a company controls a critical credit-information input while competing in downstream lending.

Case 4 — Google Shopping

Authority: European Commission; General Court; Court of Justice proceedings

The Google Shopping litigation concerned the treatment of Google's comparison-shopping service within its search ecosystem.

The central competition issue involved the use of a dominant platform's infrastructure in a way that disadvantaged competing services.

Principle

Control over an important platform can create competition concerns where the platform systematically advantages its own downstream service and disadvantages rivals.

Credit-data relevance

A vertically integrated credit-data platform could potentially face analogous scrutiny if it:

• supplies credit information to third-party lenders;
• operates its own lending service; and
• systematically gives its own lending business superior data access.

The factual and legal tests, however, remain context-specific.

Case 5 — Slovak Telekom / Deutsche Telekom

The telecommunications cases involving Deutsche Telekom and Slovak Telekom are particularly relevant to access and foreclosure analysis.

The cases illustrate that a dominant undertaking controlling an upstream infrastructure can affect downstream competition through the conditions imposed on access.

Credit-data analogy

Consider:

Credit database → credit-scoring service → lending market

If a vertically integrated undertaking controls the first two stages and competes at the third stage, access conditions can become an important competition parameter.

Case 6 — CK v Dun & Bradstreet Austria GmbH

Court: Court of Justice of the European Union
Case: C-203/22
Judgment: 27 February 2025

This is particularly important for credit scoring.

Dun & Bradstreet had conducted an automated assessment of CK's creditworthiness. The CJEU examined the interaction between automated scoring, personal-data access, meaningful information about the logic involved, and trade-secret protection.

The Court held that where automated decision-making is involved, the data subject may require meaningful information explaining the procedure and principles actually applied to produce a result such as a credit profile.

The Court also addressed the balance between access rights and protection of trade secrets and third-party personal data.

Competition relevance

This case is not itself an antitrust case. Its importance for competition law is indirect but substantial.

It demonstrates that a credit-scoring provider's:

• data;
• scoring methodology;
• profiling process; and
• trade-secret claims

operate within a broader regulatory environment.

A competition remedy involving access to credit-scoring information therefore cannot ignore privacy and confidentiality obligations.

16. SCHUFA Scoring Litigation

Another highly relevant CJEU decision concerns SCHUFA Holding AG.

Case: C-634/21, SCHUFA Holding (Scoring)

SCHUFA provides creditworthiness information and assigns scores using mathematical and statistical procedures. The CJEU considered circumstances where the score plays a determining role in a lender's decision.

The Court held that such scoring can constitute automated decision-making producing legal or similarly significant effects under the GDPR where the score effectively determines the third party's decision.

Competition relevance

The case demonstrates why credit-scoring data can possess significant economic importance.

A score may function as a critical informational input into downstream credit markets.

That can make control over scoring information economically important when analysing competition, although GDPR significance does not itself establish dominance under competition law.

17. Experian Enforcement — UK

The UK's competition environment also demonstrates the importance of credit-data control.

The Information Commissioner's Office investigated the use of personal information by major credit-reference agencies, including Experian, for direct-marketing purposes. The Upper Tribunal ruled in 2024 following proceedings concerning the ICO's enforcement action.

This is principally a data-protection matter rather than an antitrust decision, but it illustrates the regulatory sensitivity surrounding large credit-information databases.

18. UK SME Credit-Data Sharing

The UK has also developed mechanisms specifically designed to improve competition in SME lending.

The UK's Commercial Credit Data Sharing regime requires designated banks to share specified commercial credit information through designated CRAs, with the objective of facilitating competition in SME finance.

This is significant because it illustrates a regulatory response to a potential structural problem:

Incumbent banks possess large quantities of borrower information → new lenders lack equivalent information → information asymmetry increases entry barriers.

Data-sharing obligations can therefore function as a competition-enhancing regulatory mechanism.

19. China: Credit Data and Digital Platforms

China presents particularly interesting issues because major technology platforms have historically accumulated extensive payment, e-commerce and behavioural data.

For example, Alibaba's ecosystem was used in the development of Sesame Credit, which incorporated information associated with e-commerce and Alipay activity.

This illustrates the potential competitive advantage arising from cross-market data aggregation:

e-commerce data + payments data + behavioural data → credit-risk assessment.

The resulting competitive question is whether an ecosystem operator can use such informational advantages to strengthen a position in financial services while preventing competing providers from accessing equivalent inputs.

20. Feedback-Loop Problem

Credit scoring can produce a particularly powerful data-feedback mechanism.

Stage 1

A platform has many customers.

Stage 2

It obtains large amounts of transactional information.

Stage 3

It develops sophisticated credit scores.

Stage 4

Its scoring improves lending decisions.

Stage 5

More lenders and borrowers use its system.

Stage 6

The platform receives additional data.

Stage 7

The scoring system becomes even more accurate.

This creates:

Data → better scoring → more users → more data → stronger scoring.

Competition authorities may therefore examine whether access restrictions reinforce an incumbent's market power.

21. Possible Anti-Competitive Practices

22. Essential-Facilities Analysis

A court or competition authority considering compulsory access may examine:

A. Indispensability

Can competitors realistically reproduce the data?

B. Elimination of competition

Would refusal substantially eliminate effective competition?

C. New product/service

Does access permit a genuinely new or improved service?

D. Objective justification

Does the data holder have legitimate reasons for refusing access?

E. Proportionality

Can competition be protected without requiring unlimited disclosure?

This framework is particularly important because forced sharing can itself create:

• privacy risks;
• cybersecurity risks;
• free-riding;
• loss of investment incentives;
• confidentiality problems.

23. Trade Secrets and Competition

Credit-scoring models may be proprietary.

A firm may legitimately protect:

• source code;
• model architecture;
• feature engineering;
• proprietary variables;
• weighting methodology;
• fraud-detection methods.

However, trade-secret protection does not necessarily immunise conduct from competition law.

The difficult question is determining the boundary between:

legitimate protection of proprietary technology

and

strategic withholding of an indispensable competitive input.

The CJEU's 2025 Dun & Bradstreet judgment illustrates the need to balance meaningful access to information against trade-secret protection.

24. Remedies

Competition authorities could potentially consider several remedies.

Structural remedies

In exceptional cases:

• divestiture;
• separation of data and lending operations;
• restrictions on vertical integration.

Behavioural remedies

More commonly:

• non-discriminatory access;
• API interoperability;
• data portability;
• transparent access criteria;
• reasonable pricing;
• prohibition of exclusive arrangements;
• equal data quality;
• functional separation.

Regulatory data-sharing

Authorities may establish:

• open-banking systems;
• mandated data-sharing;
• standardised APIs;
• reciprocal data-sharing arrangements.

The UK's SME credit-data-sharing system provides an example of a regulatory approach intended to improve competitive access to information.

25. Key Legal Tests

For examination purposes, the issue can be reduced to the following framework:

Dominant position?
↓
Control over important credit-data input?
↓
Is the data indispensable or merely useful?
↓
Is access refused, restricted or discriminatory?
↓
Does the conduct foreclose competitors?
↓
Are there objective justifications?
↓
Are privacy, security and trade-secret interests implicated?
↓
Would access/interoperability improve competition?
↓
What proportionate remedy is appropriate?

26. Distinction Between Data Protection and Competition Law

This distinction is crucial.

Thus:

A violation of data-protection law is not automatically an antitrust violation, and possession of personal data is not automatically evidence of dominance.

27. Important Principles From the Case Law

The principal lessons are:

1. Bronner — compulsory access to an input requires a demanding indispensability analysis.
2. IMS Health — exceptional circumstances can justify intervention concerning access to an indispensable information resource.
3. Slovak Telekom — access restrictions by dominant vertically integrated undertakings can have downstream exclusionary effects.
4. Google Shopping — control over a major digital platform can become relevant where own services are systematically advantaged over competing services.
5. SCHUFA — credit scoring can have significant effects because the score may materially influence lending decisions. 
6. Dun & Bradstreet Austria — credit-scoring systems involve a balance between meaningful information about automated profiling, trade secrets and third-party data protection. 
7. UK SME Credit Data Sharing — regulatory data sharing can be used to address informational barriers to competition in lending. 

28. Conclusion

Credit scoring data access is increasingly a competition-law issue because data can function as a strategically important input into lending and financial services.

The strongest competition concerns arise where a dominant undertaking controls a difficult-to-replicate dataset and uses that control to disadvantage competing lenders or scoring providers through refusal, discrimination, exclusivity, inferior API access, self-preferencing or restrictive interoperability.

Nevertheless, not every proprietary credit database is an essential facility. Competition law must carefully distinguish valuable data from indispensable data and balance access against legitimate interests in privacy, cybersecurity, investment incentives and trade-secret protection.

The modern legal approach is therefore increasingly based on the interaction of:

Competition Law + Data Protection + Digital Regulation + Financial Regulation + Interoperability/Data-Portability Rules.

For a credit-scoring platform, the central competition-law question can ultimately be stated as:

Does control over credit data merely reflect legitimate innovation and investment, or is that control being used by a dominant undertaking to exclude competitors from an important downstream financial market?