INFORMATION TECHNOLOGY
European Data Protection Supervisor - EDPS: Opinions 38 and 39/2023 on the EU package proposal on financial information and payment services.
If – on the one hand – months of intense work are expected for the compliance and governance of banks, financial intermediaries, insurance companies, other financial entities, payment system and service providers, ICT providers, etc. (think, just to give an example, of the obligations required by the EU framework on cybersecurity and digital operational resilience referred to in Regulation DORA 2022/2554 and Directive 2022/2555 - NIS 2), it is true that the sectoral regulatory framework also offers these entities new opportunities for the development of services.
The European Data Protection Supervisor issued two interesting Opinions (38 and 39 of 2023) on the proposals that the EU Commission presented last June 28:
(1) the proposal for a Regulation to promote the development of financial services and products based on access to financial data of consumers and businesses, under the control of these (Proposal for an Open Finance Regulation or - Financial Data Access Framework - FIDA)
(2) the proposal for a Regulation on payment services in the internal market (the proposal for Payment Services Regulation - PSR) and
(3) the proposal for a PSD3 Directive amending PSD2 and whose objective – among others – is to allow payment system and service providers to process special categories of personal data in the public interest of good functioning of the internal market for payment services.
In any case, this package of regulations will also impose obligations on financial entities, such as banks, which will be required to provide the customer with a control panel to monitor and manage requests for access to financial data and the consequent authorizations granted to third party users of the data (not to be confused with privacy consent, as the EDPS recalls in the Opinion). Of particular interest is also the suggestion of the EDPS – in its Opinion on the Proposal for the Open Finance Regulation – to extend the scope to other financial products and services, such as mortgage credit agreements, particular payment services, specific insurance products, investment products and pension products.
The European Data Protection Supervisor issued two interesting Opinions (38 and 39 of 2023) on the proposals that the EU Commission presented last June 28:
(1) the proposal for a Regulation to promote the development of financial services and products based on access to financial data of consumers and businesses, under the control of these (Proposal for an Open Finance Regulation or - Financial Data Access Framework - FIDA)
(2) the proposal for a Regulation on payment services in the internal market (the proposal for Payment Services Regulation - PSR) and
(3) the proposal for a PSD3 Directive amending PSD2 and whose objective – among others – is to allow payment system and service providers to process special categories of personal data in the public interest of good functioning of the internal market for payment services.
In any case, this package of regulations will also impose obligations on financial entities, such as banks, which will be required to provide the customer with a control panel to monitor and manage requests for access to financial data and the consequent authorizations granted to third party users of the data (not to be confused with privacy consent, as the EDPS recalls in the Opinion). Of particular interest is also the suggestion of the EDPS – in its Opinion on the Proposal for the Open Finance Regulation – to extend the scope to other financial products and services, such as mortgage credit agreements, particular payment services, specific insurance products, investment products and pension products.
