Statement 2/2024 on the financial data access and payments package

Adopted 2 2. On 22 August 2023, the EDPS provided two comprehensive opinions on these proposals 6 . Since the se opinions have been published, the co - legislators have taken up their work on the p roposals . The Plenary of the European Parliament (EP) has adopted its final report 7 on the PSR Proposal on 23 April 202 4 . The ECON committee has adopted a report on the FIDA P roposal on 30 April 2024 8 . 3. The EDPB welcomes that the EP’s reports take on board most of the recommendations issued by the EDPS in Opinion 38/2023 on the FIDA Proposal and some of the recommendations issued by the EDPS in Opinion 39/2023 on the PSR Propo sal. However, some recommendations on the FIDA proposal have not yet been implemented in a satisfactory manner and many recommendations on the PSR proposal have not yet been taken on board. 4. In particular, this statement point s out to topics where further alignment with the guidelines issued by the EDPB 9 and the Opinions of the EDPS should be made, in order to ensure a higher level of protection of personal data compared to the one already provided by the EP reports .

5. In addition, the EDPB notes that on 18 December 2023, t he Spanish P residency of the Council of the European Union has published a progress report providing a summar y of the discussions of six meetings of the Council working group on the PSR and PSD3 proposals 10 . The progress report states that , during these discussions, many Member States stressed the importance of the issue of data sharing for the purpose of preventing and countering fraud . This topic , due to the processing of personal data involved , is very r elevant from the privacy and data protection perspective . 6. Considering that the Council’s work is focusing on fraud prevention, this statement provide s recommendations in this regard , building upon the practical experience of national data protection authorities on this matter. In particular, the EDPB considers that additional safeguards should be included in the legislation regarding the sharing of data for fraud purposes in order to ensure the fundamental right to data protection .

eu/ doc/ document/ST - 16676 - 2023 - INIT/en/pdf Adopted 3 7. The EDPB notes that Article 83 of the PSR Proposal provides the obligation for payment service providers (‘ PSPs’) to have transaction monitoring mechanisms (‘TMM’) in place in order to improve, inter alia, the prevention and detection of fraudulent transactions. 8. While acknowledging the importance to prevent payment fraud, t he EDPB deems that the inclusion of r obust data protection safeguards is necessary to protect the interests and fundamental rights and freedoms of individuals that would be subject to the TMM . 9. This applies in particular to cross - border data sharing by PSPs , for which the specific requirements for the processing (which may include the creation of dedicated databases) and disclosure of personal data for the purpose of fraud prevention should be clearly defined in the enacting terms of the PSR P roposal .

10. The EDPB takes note of some developments in the EP’s report on the PSR Proposal in this respect 11 . However, the EDPB considers that these developments do not include sufficient safeguards from a data protection perspective. Consequently , the EDPB calls on the EU co - legislators to include the below recommendations in the PSR to ensure that the level of interference with the fundamental right to the protection of personal data of persons concerned is necessary and proportionate to attain the objective of preventing pay ment fraud. 11. With regard to the processing of personal data via the TMM , the EDPB recommends that the PSR :  further specif ies t he categories of personal data that PSPs will process in the context of TMM . , to verify whether the Third Par ty Provider has a GDPR legal basis for processing) would not constitute prohibited obstacles to data access by payment initiation and account information service providers (Article 44(1a)) .

12 R eferred to in Article 83(2)(a) of the PSR. Adopted 4  provides that PSPs are not granted the right to use all types of data collected in relation to TMM also for the purpose of strong customer authentication as an element of ‘inherence’ pursuant to Article 3 (35) of the PSR Proposal 13 . This recommendation is justified by the fact that ‘inherence’ elements must refer to something the user is 14 . While havi ng in mind t h e requirement for PSPs to provide a very low probability of an unauthorised party being authenticated as the payment service user 15 , the EDPB recommends limiting the categories of data that may be processed for the purposes under Article 83(2) of the PSR Proposal.  defines a ppropriate data storage periods for the personal data collected under Article 83 of the PSR Proposal and justifie s such retention period in a Recital . 12. With regard to the transmission of personal data collected in the context of the functioning of the TMM , the EDPB recommends that the PSR :  provides that e xchanges of data under Article 83 of the PSR Proposal are , in principle, limited to exchanges between PSPs .

In particular , the EDPB has concerns about the possible exten sion of the obligation to share information for PSPs not only among them but also with public authorities 16 . , only where there is a justified suspicion that a serious criminal offence has taken place), together with accompanying data protection safeguards .  does not task t he European B anking Authority (EBA) with setting up a dedicated IT platform to allow PSPs to exchange information under Article 83 of the PSR Proposal 17 . The establishment of such unique IT platform would centralise sensitive transaction informati on . , in case of data breach) , compared to a distributed/decentralised data processing as it is currently the case with PSPs. However, in case such an IT platform is provided in the Proposal, the EDPB highlights the need for the Proposal (for instance, in a Recital) to adequately demonstrate the necessity and proportionality of the interference with individuals’ funda mental right to the protection of personal data ;  defines the term “information sharing agreement” in the enacting terms of the PSR ;  limits the t ransmission of data to what is strictly necessary to warn the other PSP of fraudulent payment transaction .

In this respect, the EDPB is concerned that amendments proposed by 13 As proposed in the EP Report, in new final paragraph of Article 83(2) of the PSR Proposal. 14 According to the EBA, inherence “ includes biological and behavioural biometrics, relates to physical properties of body parts, physiological characteristics and behavioural processes created by the body, and any combination of these ” . See EBA Opinion on the elements of strong customer authentication under PSD2 (EBA - Op - 2019 - 06) , para. eu/s ingle - rule - book - qa/qna/view/publicId/2020_5353 16 As proposed in the EP Report, in new Article 83(3a) of the PSR Proposal. 17 As proposed in the EP Report, in new Article 83(4 a) of the PSR Proposal. Adopted 5 the EP to Article 83(2) of the Proposal would significantly enlarge the scope of transmitted data to cover not only the IBAN of the payee but also detailed personal data about them 18 ;  limi ts a ccess to transmitted data by the receiving PSP to authorised and qualified staff of the PSP s;  clarifies in a recital what would constitute sufficient evidence under Article 83(3) of the PSR Proposal and include s in t h e enacting terms of the Proposal th e fact that such evid ence should be s h ared with the receiving PSP , in order to enable the receiving PSP to take appropriate and proportionate measures ;  provides that, i n the event a PSP shares information with another PSP , this should not automatically lead to the blocking of the execution of the payment order by the PSPs without further analysis , but could instead justif y a more in - depth check of the transaction .

(AISPs) and Payment Initiation Service Providers (PISPs) under the PSR Proposal Transparency 13. The EDPB takes the view that Article 43(4)(b) of the PSR Proposal should include an obligation for PISPs and AISPs to inform account servicing PSP s about the customer account to which access is being sought . In addition, PISPs and AISPs should inform the account servicing PSP about the legal basis under Article 6(1) GDPR and (if applicable) the exception under Article 9(2) GDPR that they would rely o n to access the personal data of the payment service user . Data minimisation 14. The EDPB recalls that, in accordance with the principle of minimisation enshrined in Article 5 (1) (c) GDPR , access to personal data by AISPs and PISPs should be limited to person al data that are strictly necessary to provide the requested service to the customers .

19 Moreover, the EDPB recalls that the controller must implement appropriate technical and organisational measures for ensur ing that, by default , only personal data which are necessary for each purpose of the processing are processed pursuant to the o bligations to respect the requirements of data protection by design and by default established in Article 25(1) and 25(2) of the GDPR 20 . 15. In this regard, the EDPB notes that l arge amounts and a wide variety of categories of personal data will likely be shared by data holders with data users under the FIDA Proposal and by account servicing PSPs with PISPs and AISPs under the PSR Proposal . Therefore, the EDPB recommends having du e regard to the data minimisation principle 21 in the context of the rules for the exchanges of financial data in the Proposals. Compliance with this principle is of paramount importance in the context of financial services not only under the privacy and dat a protection 18 As proposed in the EP Report, in the proposed amendments to Article 83(3) of the PSR Proposal, referring to name, personal identification number, organisation number, modus operandi and other transaction information of a payee.

19 See, in this r egard, EDPB Guidelines 06/2020, paras. 59 - 67. pdf 21 Article 5(1)(c) GDPR. Adopted 6 viewpoint, but also to limit the risk of financial exclusion which might arise due to the collection and storage of personal data that is financially irrelevant 22 . 16. The EDPB therefore welcomes that the ECON Committee’s report would significantl y limit the scope of data sharing in the FIDA Proposal, such as excluding data which is derived or inferred from data provided by a customer as a result of profiling from the scope of the Proposal 23 . The principle of data minimisation is furthermore covered in Recital 10 of the FIDA Proposal and will be implemented via technical requirements in so - called Financial Data Sharing Schemes that data holders and data users must adhere to. 17. However, Article 47 of the PSR P roposal would not limit access to p ersonal data by AISPs to data that are strictly necessary to provide the requested service.

Based on the experience of national data protection authorit i es in their supervis ory activities , it can be noted that AISPs often access more personal data than the y should when requesting the account information necessary to provide the ir respective service. The access to such unnecessary information is not in line with the principle of data minimisation. Therefore, the EDPB calls for expressly including the obligat ion for account servicing PSPs to deploy technical measures that enable or support AISPs and PISPs in their obligation to access and retrieve only the personal data that is necessary for the provision of their services 24 , in the PSR Proposal . 3 The legal meaning of the term ‘ permission ’ under the FIDA and PSR P roposals 18. The EDPB welcomes the further clarifications proposed by the ECON committee to the FIDA Proposal on the legal meaning of the term “permission”, which is used instead of the notion of “explic it consent” 25 .

The ECON Committee report on the FIDA Proposal clarifies that ‘ permission’ should not be construed as ‘consent’ or ‘necessity for the performance of a contract’ under the GDPR 26 . The EDPB welcomes this amendment, as it considers it important t o disambiguate the term ‘permission’ from the data protection legal basis provided under the GDPR. 19. The EDPB calls for the inclusion of a similar clear di fferentiation between the term ‘permission’ and the legal basis for processing under the GDPR, in part icular the legal basis of ‘ necessity fo r the performance of a contract’ , in the legal text of the PSR P roposal 27 . 20. The EDPB also strongly recommends to reconside r Article 49(4) of the PSR Proposal, which states that account servicing PSPs must not verify the permission granted by the payment service user to AISPs and PISPs. It should on the contrary be possible for accoun t servicing PSPs to verify the permission obtained by AISPs and P I SPs from the customer before granting them access to her or his account information.

22 This is one of the objectives pursued by the FIDA Proposal, as explicitly mentioned in Recital 15 of the Proposal. 23 As proposed in the EP Report , in the amended Recital 9 of the FIDA Proposal. 24 See EDPB Guidelines 06/2020 , para. 64. 25 The term “expl icit consent” is currently used in Article 94 of PSD2. The EDPB has had the chance to clarify that the term in that provision does not equate to “consent” under the GDPR, given that under PSD2 it is a contractual consent and cannot be regarded as an additi onal legal basis for processing of personal data. See EDPB Guidelines 06/2020, paras. 36 and 37 . 26 As proposed in the EP Report , in the amended Recital 48 of the FIDA Proposal. 27 Article 65a of the EP Report on the PSR Proposal only distinguishes ‘permission’ from ‘consent’. 4 Requirements for permission dashboards under the FIDA and PSR Proposals 21. The EDPB calls on the co - legislators to specify in Article 43 of the PSR P roposal that the permission dashboard should not be designed in a way that would unduly influence payment service users to grant or withdraw permissions , in line with Recital 65 .

22. I n relation to the FIDA Proposa l , the EDPB calls for the permissions dashboard under Article 8 of the Proposal to require data users to inform data holders about th e legal basis under Article 6 (1) GDPR and (if applicable) the exception under Article 9 (2) GDPR that they rely on to access personal data contained in the customer dataset. 5 Special categories of personal data under the PSR Proposal 23. The EDPB recalls that processing of special categories of personal data under the GDPR is prohibit ed, pursuant to Article 9 (1), and only allowed if any of the exception s in Article 9 (2) applies . Therefore, the EDPB calls on the co - legislators to specify in the PSR P roposal in relation to which specific , designated payment service the providers of payment systems and PSP s are allowed to process specific special categories of personal data pursuant to Article 80 . Furthermore , justifications as to why the processing of special ca tegories of personal data for specific payment service s is necessary and proportionate and cannot be avoided via alternative means should be provided in a R ecital .

24. The EDPB also reiterates the recommendation made by the EDPS to clarify the definition of ‘ sensitive payment data’ (referred to, in broad way, as “ data which can be used to carry out fraud, including personalised security credentials ”) 28 by further specifying the categories of personal data falling under this definition . 6 Regulatory cooperation under the PSR Proposal 25. The EDPB notes that the Article 93(3) of the PSR Proposal provides that competent authorities shall cooperate with “ other authorities from any sector concerned as applicable to each case ”. 26. The EDPB recommends that t he PSR Proposal ex pressly refer s to cooperation between the authorities which are competent for the supervision of the provisions of the PSR Proposal and data protection supervisory authorities . These authorities should exchange information with each other to ensure coopera tion on the ir respective supervisory tasks .

This is necessary for the effective and coherent enforcement of administrative sanctions and administrative measures , in particular where the same practices by entities covered by the Proposals and EU data protection law could lead to sanctions from financial authorities and data protection supervisory authorities . Therefore, the EDPB recommends that data protection supervisory authorities are explicitly mentioned in Article 93(3) in line with Recital 97 and Article 48(5) of the PSR P roposal and that modalities for such cooperation be further specified , notably with regard to the exchange of confidential information . For the European Data Protection Board The Chair ( Anu Talus ) 28 Article 3(38) of the PSR Proposal .