Key points
- The GDPR strengthens the protection of personal data collected by banks, where lawyers have a role to play in compliance.
- The PSD2 directive was transposed into French law by an ordinance of 9 August 2017 and has applied since 13 January 2018.
- The GDPR, Regulation (EU) 2016/679 of 27 April 2016, applicable since 25 May 2018, harmonises data protection across the European Union.
- Strong customer authentication, mandatory for electronic payments subject to exemptions (in particular remote payments of up to 30 euros), combines at least two factors and has applied since 14 September 2019.
- PSD2 requires banks to give third-party providers access to customer data, with the customers’ consent, through a secure interface (API).
- PSD2 and the GDPR converge: easier access to data comes with stronger protection requirements.
The GDPR places particular demands on banks, which collect financial personal data that is especially exposed. It therefore strengthens the existing framework for banking institutions, within which lawyers have an important role to play in compliance.
The second Payment Services Directive (PSD2, DSP 2 in French)[2] was transposed into French law by an ordinance of 9 August 2017[3] and has applied since 13 January 2018. It updates the regulatory framework for payments in Europe by enabling the emergence of “innovative, safe and easy-to-use digital payment services”.
The EU General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679 of 27 April 2016), applicable since 25 May 2018, strengthens and harmonises data protection for individuals within the European Union.
The aim is to strengthen transparency and the security of personal data.
The concept of personal data is thus defined as “any information relating to an identified or identifiable natural person”, that is, a person who “can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person ”[1].
Obligations arising from PSD2
Combating cyberattacks and fraud is central to the directive.
The text aims to protect users adequately against these risks. Recital 95 of the Directive states that “security of electronic payments is fundamental for ensuring the protection of users (…) All payment services offered electronically should be carried out in a secure manner, adopting technologies able to guarantee the safe authentication of the user and to reduce, to the maximum extent possible, the risk of fraud”.
Some security measures did not apply immediately: the directive made them applicable eighteen months after the entry into force of the regulatory technical standards (Delegated Regulation (EU) 2018/389), that is, from 14 September 2019. They include in particular:
- The strong authentication requirement. It is mandatory for electronic payments, subject to exemptions (in particular remote payments of no more than 30 euros, within certain cumulative limits), in order to reduce e-commerce fraud. Strong authentication means at least two factors among a password, a device the user possesses and a biometric feature such as a fingerprint, voice or iris.
- Opening the market to new players (payment initiation service providers and account information service providers) by allowing access to account information through a secure communication channel. For access to account information, the rules require a new strong customer authentication at least every 180 days (90 days before 25 July 2023).
Alignment between PSD2 and the GDPR
PSD2 requires banks to give third parties such as payment initiation service providers or account information service providers access to their customers’ data, with the customers’ consent. To ensure communication based on “common and secure open standards”, banks must adapt their online banking interface or create a dedicated interface (an API, an interoperable application programming interface). This interface avoids “screen scraping”[4] techniques, in which payment initiators use customers’ login details and passwords, relying on their access codes.
French banks have therefore had to work on the definition, development and roll-out of APIs (Application Programming Interfaces).
As a result, the GDPR and PSD2 are two very significant sets of rules. Some requirements may seem contradictory because of the opening up of payments under PSD2. Indeed, greater accessibility of data will call for significant protection measures. This is where PSD2 and the GDPR converge. On the one hand, access to data is made easier; on the other, the use of that data is regulated and respects the rights of the data subjects.
The General Data Protection Regulation – GDPR
The lawyer’s role in GDPR compliance
From the GDPR to PSD2, banks keep facing the confidentiality challenge
[1] Article 4, point 1, of Regulation (EU) 2016/679 (GDPR)
[2] Directive 2015/2366
[3] Ordinance No. 2017-1252 of 9 August 2017 transposing Directive 2015/2366 of the European Parliament and of the Council of 25 November 2015 on payment services in the internal market
[4] Screen scraping (capture de données d’écran in French) is a technique by which a program retrieves data normally intended to be sent to an output device (usually a monitor) in order to extract information from it.
