Nowadays, more and more banks set their interest rates automatically, and without any human intervention. But even the smallest inaccuracies can cost consumers thousands of additional euros. While EU law allows the use of such an automatic system in certain circumstances, companies must follow strict rules to protect people’s fundamental right to privacy. Banks, for example, would need to provide their customers with “meaningful information about the logic involved” in calculating their personal interest rate. But many banks don’t seem to care. Contrary to EU law, Swedbank (one of the largest banks in Sweden) rejected a Swedish citizen’s access request by claiming that the calculation was a “trade secret”. noyb has now filed a complaint with the Swedish Data Protection Authority.
Conditions changing for the worse. Thanks to low interest rates and inflation, European citizens have enjoyed attractive conditions for taking out a loan for many years. In Sweden that’s because the National Bank’s (Riksbank) interest rate – which controls the current lending rate offered by Swedish banks – didn’t rise above 0%, at least between 2015 and early 2022. Then, the war in Ukraine started, forcing the Riksbank to raise the interest rate. Unsurprisingly, the banks followed suit – with the consequence that most Swedish households suddenly faced significantly higher housing costs. This is driving more and more households into debt. Swedes have some of the highest levels of household debt in the EU, at around €42,000 per person. At the same time, banks' margins on mortgages have increased.
Joakim Söderberg, data protection lawyer at noyb: “The main thing people in Sweden talk about right now is the cost-of-living crisis. Mortgages are a big part of that, maybe even the biggest part. At the very least, banks should comply with their obligations under the GDPR and be transparent about how they calculate loans. Instead, they refuse to respect people's fundamental right to data protection.”
Transparency required by law. While the situation might be similar in other EU countries, Sweden has one major problem: banks tend to set their interest rate fully automated and without any human intervention. This makes it hard for consumers to learn more about how their interest rate came to be. For this exact reason, EU law requires companies who use automated decision making to follow strict transparency rules: According to Article 15(1)(h) GDPR, companies must provide “meaningful information about the logic involved” in the calculations made by such a system. In reality, banks can get creative to circumvent their obligations: Swedbank, for example, rejected a Swedish data subject’s access request under Article 15 GDPR, (falsely) arguing that the logic behind its mortgage rate is a “trade secret”.
But transparency is extremely important here, because even a small change in the interest rate has serious consequences for consumers. Here is an example to illustrate this: If you have a 15-year loan of €300,000 with 4% interest, your monthly loan installment is €2,208. If the interest rate is suddenly raised to 4.5%, your monthly payment jumps to € 2,281. That's an extra €73 a month for 15 years – or a total of €13,140
Joakim Söderberg, data protection lawyer at noyb: “By insisting that the logic behind its interest rate calculation is a trade secret, the bank erodes what little trust consumers still have in them. It begs the question: How can we as consumers know we’re being treated fairly if we actually don’t know how we are treated?”
A supposed trade secret – that’s actually defined in EU law. According to both Swedish and EU law, a piece of information can only be a trade secret if its disclosure is likely to give competitors an advantage. But if the information is publicly available, the competitors already know. This is the case for interest rates: Transparency in mortgage lending is regulated via the EU’s Mortgage Credit Directive, which literally includes the equation for the calculation of mortgage rates. In addition, the Swedish Consumer Credit Law, in a direct reference to the EU’s directive, states that people are entitled to know how their interest rate was calculated, if the loan is based on a reference rate (such as the Riksbank's policy rate) and what the bank adds on top of that rate. This is supposed to enable consumers to make an informed choice about where to lend money and to potentially correct false or incomplete data that leads to higher interest rates.
Complaint filed in Sweden. noyb has therefore filed a complaint with the Swedish data protection authority (IMY) and request a full investigation of Swedbank’s decision to reject the data subject’s access request. In order to ensure that the complainant enjoys effective protection of his rights, noyb subsequently proposes that the IMY orders Swedbank to provide the data subject with full access to the logic used for the calculation of his mortgage rate. In addition, Swedbank should establish procedures to adequately respond to access requests in the future. Finally, noyb suggests the IMY to impose an administrative fine to prevent similar violations in the future.
