Summary of the Opinion of the European Data Protection Supervisor on the proposal for a Regulation of the European Parliament and of the Council amending Regulations (EU) No 260/2012 and (EU) 2021/1230 as regards instant credit transfers in euro 2023/C 60/10 (The full text of this Opinion can be found in English, French and German on the EDPS website https://edps.europa.eu)
Date: 2023-02-17
Institutions: European Data Protection Supervisor
Subjects: data protection, electronic banking, electronic money, euro, financial services, intra-EU payment, payment system, personal data, protection of privacy, provision of services








C_2023060EN.01001201.xml










17.2.2023   


EN


Official Journal of the European Union


C 60/12






Summary of the Opinion of the European Data Protection Supervisor on the proposal for a Regulation of the European Parliament and of the Council amending Regulations (EU) No 260/2012 and (EU) 2021/1230 as regards instant credit transfers in euro
(2023/C 60/10)


(The full text of this Opinion can be found in English, French and German on the EDPS website https://edps.europa.eu)


On 26 October 2022 the European Commission issued a proposal for a Regulation of the European Parliament and of the Council amending Regulations (EU) No 260/2012 and (EU) 2021/1230 as regards instant credit transfers in euro (1).
The objective of the proposal is to improve the low uptake of euro instant credit transfers to allow for their benefits to realise, including efficiency gains for consumers, merchants, corporate users, payment service providers and financial technology companies, and public administrations including tax authorities. A second objective is to extend the means of payment at points of interaction, particularly for cross-border transactions. At the end of 2021, only 11 % of euro credit transfers sent in the EU were instant payments, although the architecture for instant payments in euro already exists, inter alia with the Single Euro Payments Area (SEPA) instant credit transfer scheme of 2017.
From the problems addressed by the proposal, two are of particular relevance to data protection: To address concerns by payers about the security of instant payments, the proposal would oblige payment service providers to verify whether the payment account identifier and the name of the payee provided by the payer match, prior to authorization of the payment by the payer. Where they do not match, the payment service provider shall notify the payer of any discrepancies detected and the degree of any such discrepancy. The EDPS welcomes the proposal and in particular the proposed matching that would give payers the chance to compare their data with the response from the system and make informed decisions whether it is safe to authorise the payment. Where this security feature is not needed, the proposal gives payers the possibility to opt-out, thus leading to less processing of personal data.
Under the current legislation, a high rate of rejected instant payments is caused by wrongly identifying persons who are involved in the instant credit transfer as persons on EU sanctions lists. The proposal provides for a requirement for sanctions screening in the form of very frequent checking of clients against EU sanctions lists, rather than for each individual transaction, to avoid the false positives. The EDPS welcomes that the proposal would direct the practice to a periodic verification method that can be executed with the necessary diligence, so that false positives can be avoided and data subjects do not experience unwarranted payment refusals.
The EDPS does not have any observations relating to the remaining provisions of the proposal.
1.   INTRODUCTION









1.


On 26 October 2022 the European Commission issued a proposal for a Regulation of the European Parliament and of the Council amending Regulations (EU) No 260/2012 and (EU) 2021/1230 as regards instant credit transfers in euro.












2.


The objective of the proposal is to improve the low uptake of euro instant credit transfers to allow for their benefits to realise, including efficiency gains for consumers, merchants, corporate users, payment service providers and financial technology companies, and public administrations including tax authorities. A second objective is to extend the means of payment at points of interaction, particularly for cross-border transactions.












3.


Two EU legal acts in the field of payments, the 2015 Directive on payment services in the internal market (PSD2) (2) and the Regulation on cross-border payments (3), already apply to instant payments and will continue to do so after the entry into force of this proposal. However, the SEPA Regulation (4) was chosen by the Commission to host the new provisions as it lays down technical and business requirements for all credit transfers in euro and instant payments in euro are a new category of credit transfers in euro.












4.


The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 27 October 2022, pursuant to Article 42(1) of EUDPR (5). The EDPS welcomes the reference to this consultation in recital 23 of the proposal.




5.   CONCLUSIONS









17.


In light of the above, the EDPS welcomes the measures provided for by the proposal to verify data of a payee and to abstain from checking payment service users during an instant credit transfer.












18.


The compensatory regular verification with the EU sanctions lists, irrespective of a concrete transaction, does not raise any concerns.





Brussels, 19 December 2022.

Wojciech Rafał WIEWIÓROWSKI




(1)  COM(2022) 546 final.

(2)  Directive (EU) 2015/2366 of the European Parliament and of the Council of 25 November 2015 on payment services in the internal market, amending Directives 2002/65/EC, 2009/110/EC and 2013/36/EU and Regulation (EU) No 1093/2010, and repealing Directive 2007/64/EC (OJ L 337, 23.12.2015, p. 35).

(3)  Regulation (EU) 2021/1230 of the European Parliament and of the Council of 14 July 2021 on cross-border payments in the Union (OJ L 274, 30.7.2021, p. 20).

(4)  Regulation (EU) No 260/2012 of the European Parliament and of the Council of 14 March 2012 establishing technical and business requirements for credit transfers and direct debits in euro and amending Regulation (EC) No 924/2009 (OJ L 94, 30.3.2012, p. 22).

(5)  Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39).