Summary of the Opinion of the European Data Protection Supervisor on the Proposal for a Regulation on a framework for Financial Data Access (The full text of this Opinion can be found in English, French and German on the EDPS website https://edps.europa.eu)
Date: 2023-11-20
Institutions: European Data Protection Supervisor
Subjects: access to information, data protection, data sharing, disclosure of information, exchange of information, financial institution, financial legislation, financial services, information service, personal data








C_202301054EN.000101.fmx.xml












Official Journal of the European Union


EN
Series C













C/2023/1054


20.11.2023






Summary of the Opinion of the European Data Protection Supervisor on the Proposal for a Regulation on a framework for Financial Data Access
(C/2023/1054)


(The full text of this Opinion can be found in English, French and German on the EDPS website https://edps.europa.eu)



On 28 June 2023, the European Commission issued a Proposal for a Regulation of the European Parliament and of the Council on a framework for Financial Data Access and amending Regulations (EU) No 1093/2010, (EU) No 1094/2010, (EU) No 1095/2010 and (EU) 2022/2554 (‘the Proposal’). The objective of the Proposal is to promote the development of data-driven financial services and products by enabling consumers and firms to better control access to their financial data.
The EDPS welcomes that the Proposal seeks to empower customers - including data subjects - to decide how and by whom their data is used. He notes, however, that the definition of ‘customer data’ is particularly broad, potentially including personal data of a highly sensitive nature. The categories of personal data to be made available under the Proposal should be clearly circumscribed, taking into account the risks for individuals whose personal data would be accessed and used. The EDPS also recommends explicitly excluding data created as a result of profiling from the definition of ‘customer data’.
The EDPS welcomes that the Proposal would impose several obligations on data holders and users that could have a positive effect on the level of protection of the personal data. To further this objective, data users should be obliged to clearly outline, for each request, the specific types of customer data they seek access to. The Proposal should also prohibit the denial of the financial services to customers who do not install and avail themselves of the permission dashboard or otherwise enable data sharing by data holders with data users under the Proposal.
The EDPS considers that a clearly identified and strongly enforced data use perimeter is necessary to delineate appropriate uses of personal data and to protect vulnerable consumers. In this regard, the EDPS welcomes that the Proposal provides for the development of guidelines by the European Banking Authority and the European Insurance and Occupational Pensions Authority, in cooperation with the European Data Protection Board (EDPB). To ensure that the guidelines are fully aligned with data protection law, the EDPS considers a formal consultation of the EDPB to be necessary. The EDPS also recommends extending the scope of the future guidelines to other relevant financial products and services, such as to mortgage credit agreements, payment services, other insurance products, investment products, and pension products. The guidelines should also elaborate, where appropriate, on the limits for combining ‘customer data’ with other types of personal data, such as personal data obtained from third party sources (e.g., social media networks or data brokers).
The EDPS recommends ensuring close cooperation between competent authorities under the Proposal and data protection supervisory authorities to ensure consistency between the application and enforcement of the Proposal and EU data protection law. Such close cooperation could be fostered by clarifying the circumstances in which competent authorities may consult and exchange information with data protection authorities.
1.   Introduction









1.


On 28 June 2023, the European Commission issued a Proposal for a Regulation of the European Parliament and of the Council on a framework for Financial Data Access and amending Regulations (EU) No 1093/2010, (EU) No 1094/2010, (EU) No 1095/2010 and (EU) 2022/2554 (1) (‘the Proposal’).












2.


The Proposal aims to promote the development of data-driven financial services and products by enabling consumers and firms to better control access to their financial data (2). By doing so, the Proposal would make it possible for consumers and firms to benefit from financial products and services beyond payments that are tailored to their needs based on the data that is relevant to them. At the same time, the Proposal aims to address the risks that are inherent to the increased sharing of and access to financial data (3).












3.


The Proposal is a sectoral building block that fits into the broader European strategy for data and enables data sharing within the financial sector and with other sectors (4). It is directly connected with one of the priorities of the Commission’s Digital Finance Strategy for the EU, notably of creating a European financial data space to promote data-driven innovation, building on the European data strategy (5), including enhanced access to data and data sharing within the financial sector (6).












4.


In essence, the Proposal would:






a.


establish the rules in line with which specific categories of ‘customer data’ - including personal data - in finance (7) may be accessed, shared, and used by financial institutions and financial information service providers (‘FISPs’) - the ‘eligible entities’ (8) - acting as either data holders (9) or users (10);










b.


provide the customer - who may be a natural or legal person (11) - with the right to request that the data holder shares this data with a data user for the purposes and under the conditions agreed between the data user and the customer (12);










c.


impose certain obligations on data users receiving data at the request of customers and set certain boundaries on how customer data may be used (13);










d.


mandate the European Banking Authority (‘EBA’) and the European Insurance and Occupational Pensions Authority (‘EIOPA’) - in cooperation with the European Data Protection Board (‘EDPB’) - to develop targeted guidelines addressing areas where the data sharing and access envisaged in the Proposal could entail higher exclusion risks for customers (14), thereby establishing a ‘data use perimeter’ (15);










e.


allow customers to monitor and manage the data permissions they have given to data users through financial data access permission dashboards (to be mandatorily set up by data holders) (16); and










f.


introduce requirements for the creation and governance of financial data sharing schemes (‘FDSS’) - of which data holders, data users and consumer organisations would be parties - to develop (inter alia) data and interface standards and a joint standardised contractual framework governing access to specific datasets (17).
















5.


The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 29 June 2023, pursuant to Article 42(1) of EUDPR (18). The EDPS welcomes the reference to this consultation in Recital (54) of the Proposal. In this regard, the EDPS also positively notes that he was already previously informally consulted pursuant to Recital (60) of the EUDPR.




8.   Conclusions









54.


In light of the above, the EDPS makes the following recommendations:






(1)


to clarify in Recital (48) that processing of personal data in the context of the Proposal Regulation should be carried out in accordance with the GDPR (19), the EUDPR and the ePrivacy Directive (20);










(2)


to clearly circumscribe the categories of personal data included in Article 2(1) of the Proposal, taking into account the nature of the financial services and products offered by eligible entities listed in Article 2(2) of the Proposal and the risks for individuals whose personal data would be accessed and used by data users;










(3)


to explicitly exclude data created as a result of profiling from the definition of ‘customer data’ in Article 3(3) of the Proposal;










(4)


to avoid any ambiguity between the term ‘permission’ within the meaning of the Proposal and the legal basis for processing under the GDPR, by additionally clarifying in Recital (48) that permission should not be construed as ‘consent’ or ‘explicit consent’ or ‘necessity for the performance of a contract’ as defined in the GDPR;










(5)


to insert in the enacting terms of the Proposal a provision that would prohibit the denial of financial services listed in Article 2(2) of the Proposal to customers who do not install and avail themselves of the permission dashboard under Article 8 of the Proposal or otherwise enable data sharing by data holders with data users under the Proposal;










(6)


to include a requirement in Article 6 of the Proposal for data users to clearly outline in their access requests to customers the specific types of customer data they seek access to;










(7)


to amend the wording of Article 6(2) of the Proposal as follows: ‘A data user shall only request and access customer data under Article 5(1) that is adequate, relevant and necessary for the purposes and under the conditions for which the customer has granted its permission’;










(8)


to specify that a data user may only contact customers for direct marketing purposes subject to their prior consent or with offers for products or services similar to the ones for which they have accessed customer data and under the conditions provided by Article 13(2) of the ePrivacy Directive;










(9)


to include an explicit reference, in Article 7 of the Proposal, to the need to comply with the existing EU sectoral rules and guidelines regarding the access to and use of personal data for the purpose of the provision of the financial services and products in scope of the Proposal;










(10)


to provide for a formal consultation of the EDPB by both EBA and EIOPA when developing the proposed data use perimeter guidelines, by adding to Article 7(4), after ‘in close cooperation with’, the wording ‘and subject to a formal consultation of’;










(11)


to provide for the adoption of the guidelines under Article 7, subject to the formal consultation of the EDPB, at the earliest possible moment considering the date of applicability of the Proposal;










(12)


to extend the scope of the guidelines under Article 7 to other important financial products and services in scope of the Proposal;










(13)


to specify that the guidelines under Article 7 should also address, where appropriate, the limits of the combination for combining ‘customer data’ obtained pursuant to the Proposal with other types of personal data;










(14)


to require data users under Article 8(4)(b) to also inform data holders about the customer account, financial product or financial service to which access is being sought;










(15)


to require data users under Article 8(4)(b) to inform data holders about the legal basis under Article 6(1) GDPR and (if applicable) the exception under Article 9(2) GDPR that they would rely on to access personal data contained in the customer dataset;










(16)


to specify in Article 8 of the Proposal that the permissions dashboard should not be designed in a way that would encourage or unduly influence the customer to grant or withdraw permissions;










(17)


to require data users to demonstrate to data holders in an appropriate manner that they have obtained the customer’s permission to access the customer data held by the data holder;










(18)


if data users may request access to customer data on behalf of a customer, to require data holders to request (and data users to provide) proof of the representation powers obtained from the customer;










(19)


to amend Article 14(7) of the Proposal to clarify that competent authorities may withdraw the authorisation they have granted to a FISP in cases where supervisory authorities under the GDPR establish that a FISP has breached its obligations under EU data protection law;










(20)


to provide for a definition of ‘financial information services’ in Article 3 of the Proposal;










(21)


to require FDSS to lay down the minimum technical and organisational measures that FDSS members should implement to ensure an appropriate level of security for exchanged personal data;










(22)


to replace the word ‘similar’ after ‘to draw up codes of conduct’ in Recital (25) of the Proposal with ‘in accordance with Article 40 GDPR’;










(23)


to specify that supervisory authorities under the GDPR are among the ‘other relevant public authorities’ or ‘other competent authorities’ to be consulted by competent authorities pursuant to Articles 14(1) and 10(6) of the Proposal; and










(24)


to make explicit reference to supervisory authorities under the GDPR in Article 18(3) of the Proposal.










Brussels, 22 August 2023.

Wojciech Rafał WIEWIÓROWSKI
               





(1)  COM(2023) 360 final.

(2)  COM(2023) 360 final, p. 1.

(3)  COM(2023) 360 final, p. 1-2.

(4)  COM(2023) 360 final, p. 3.

(5)  Communication from the Commission to the European Parliament, the European Council, the Council, the European Economic and Social Committee and the Committee of the Regions on A European Data Strategy (COM(2020) 66 final, 19.2.2020).

(6)  Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions on a Digital Finance Strategy for the EU (COM(2020) 591 final, 24.9.2020, p. 3 and 4).

(7)  Listed in Article 2(1) of the Proposal.

(8)  Listed in Article 2(2) of the Proposal.

(9)  Article 3(5) of the Proposal: ‘
            “data holder” means a financial institution other than an account information service provider that collects, stores and otherwise processes the data listed in Article 2(1)’.

(10)  Article 3(6) of the Proposal: ‘
            “data user” means any of the entities listed in Article 2(2) who, following the permission of a customer, has lawful access to customer data listed in Article 2(1)’.

(11)  Article 3(2) of the Proposal.

(12)  Article 5 of the Proposal.

(13)  Article 6 of the Proposal.

(14)  Notably, products and services related to the credit score of consumers and to risk assessment and pricing of consumers in the case of life, health and sickness insurance products. See also recital (18) of the Proposal.

(15)  Article 7 of the Proposal.

(16)  Article 8 of the Proposal.

(17)  Titles IV and V of the Proposal.

(18)  Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39).

(19)  Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1).

(20)  Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) (OJ L 201, 31.7.2002, p. 37).


ELI: http://data.europa.eu/eli/C/2023/1054/oj
ISSN 1977-091X (electronic edition)