Profiling and credit scoring: legal characterization and application of the Peruvian legal regime for personal data protection

• Autores: Zegarra Valdivia, Diego, Gil Aguilar, Giovanna
• Formato: artículo
• Fecha de Publicación: 2025
• Institución: Pontificia Universidad Católica del Perú
• Repositorio: Revistas - Pontificia Universidad Católica del Perú
• Lenguaje: español
• OAI Identifier: oai:ojs.pkp.sfu.ca:article/33496
• Enlace del recurso: http://revistas.pucp.edu.pe/index.php/iusetveritas/article/view/33496
• Nivel de acceso: acceso abierto
• Materia: Elaboración de Perfiles; Scoring Crediticio; Decisiones Automatizadas; Protección de Datos Personales; Tratamiento Objetivo; Reglamento de la LPDP; Sector Financiero; Perú; Profiling; Credit Scoring; Automated Decision; Making; Personal Data Protection; Objective Processing; Peruvian Data; Protection Law; Financial Sector; Peru

The increasing use of automated mechanisms for the analysis of personal data, particularly profiling and credit scoring, poses significant challenges from a personal data protection perspective. Within the Peruvian legal system, the recent explicit incorporation of automated decision-making and profiling into the Regulation of the Personal Data Protection Law, approved by Supreme Decree 016-2024-JUS, requires a clear conceptual delimitation of these techniques, as well as an assessment of their compatibility with the principles and rights recognized under the current data protection framework.In this context, this article aims to characterize profiling and credit scoring, to determine their conceptual relationship, and to examine the conditions that must be ensured to guarantee the lawfulness of their implementation in the Peruvian financial sector. To this end, a doctrinal approach is adopted, based on the analysis of comparative law, specialized scholarship, and advisory opinions issued by the National Data Protection Authority.The paper argues that credit scoring constitutes a specific manifestation of profiling which, when integrated into decision-making processes producing legal effects, triggers the safeguards established under Article 87 of the Regulation of the Personal Data Protection Law. Consequently, its implementation requires a rigorous assessment of the applicable legal basis, the proper identification of the source of personal data, and a clear allocation of responsibilities between the data controller and the data processor.