PSD2 (Payment Services Directive 2) is an incoming EU directive which promises a major shake-up for retail banking, primarily due to its stipulation that banks share their customers’ data with third party providers (TPPs), such as challengers or non-bank rivals such as PFMs.
Arriving in parallel is the EU’s new data protection legislation, the GDPR (General Data Protection Regulation) – which promises a common framework for the collection, management and processing of customer data by companies. The fines for non-compliance with GDPR are particularly significant, set at €20m or 4% of an organisation’s global turnover, whichever is greater. For a bank, this would be a notable sum.
At first blush it seems these two directives are at loggerheads, one promising to aggressively increase the sharing of customer data, the other promising to place much tighter restrictions on its usage. But are they? At their core, both pieces of legislation focus on giving customers greater control over their information – PSD2 in terms of who they would like it to be shared with, and GDPR in terms of what will be done with the data once companies have it.
