On March 9, 2009, the Portuguese Data Protection Commission (CNPD) issued public guidance (Decision no. 156/09) on personal data processing for companies providing credit-scoring data. In order to assess an individual’s creditworthiness, companies typically have access to that individual’s name, date of birth, address, marital status and other information relating to their credit history. According to the Decision, which draws heavily on Portugal’s Data Protection Act (Law 67/98), CNPD authorization must first be sought before credit scoring begins. Decision 156/09 is available (in Portuguese) here.