On paper, the PSD2 seems to have good safeguards when it comes to the protection of personal data. Not only is reference made to the General Data Protection Regulation (AVG), but a consumer must also give his explicit consent before data is processed by a payment service provider. In this article we describe how the PSD2 deals with privacy.<\/p>\n\n\n\n
To better follow the tough PSD2 we illustrate the PSD2 with some people, Alice and Bob. They regularly transfer money to each other. Alice has an account with several banks and would like to make use of a een onlinedienst voor het verstrekken van geconsolideerde informatie over een of meer betaalrekeningen die de betalingsdienstgebruiker bij een andere betalingsdienstaanbieder of bij meer dan \u00e9\u00e9n betalingsdienstaanbieder aanhoudt.<\/em> (Artikel 4 sub 16 PSD2).<\/p> De PSD2 maakt ook de betaalinitiatiedienst mogelijk waarbij een andere partij dan je bank een betaling mag afhandelen.\"> account information service.<\/span><\/a> It's about the 'Eve' service, from which she saw an ad. Bob deliberately chooses not to use an account information service.<\/p>\n\n\n\n Because the PSD2 account information can be used more widely, services such as the online checkbook, <\/span><\/a> budget management, overview of several accounts or advice on financial services. Sometimes before the PSD2 was also possible, but then you had to download the data from your bank and then upload it. PSD2 makes this process a lot easier.<\/p>\n\n\n\n Alice downloads the app 'Eve' and agrees to the terms and conditions. At this moment she is a customer of Eve, but Eve is not yet able to process payment details. For this Alice will explicit approval<\/span><\/a> have to give. <\/p>\n\n\n\n Alice gives Eve permission to retrieve her payment details. She has to confirm this permission at her bank. With Alice' permission, Eve asks Alice's bank for the payment details. The bank is de betalingsdienstgebruiker heeft het recht heeft gebruik te maken van diensten die hem toegang bieden tot rekeninginformatie<\/em>' en de bank mag dit niet hinderen. De verwerking van de persoonsgegevens vindt plaats op grond van art. 6 lid 1 sub c AVG, de wettelijke verplichting die een bank is opgelegd.\">mandatory <\/span><\/a> then provide all the information requested. Eve receives the data and updates and uses the data for its services.<\/p>\n\n\n\n Alice will be after 90 days<\/span><\/a> have to renew her consent. In the meantime, Eve has access to the payment details of Alice as far as Alice can see in her online environment. This can be done differ from one bank to another<\/a>. At the bank of Alice this can be up to 8 years. After 90 days, access is automatically terminated and Eve receives no more mutations. The data received by Eve may no longer be used for the purposes for which they were collected.<\/p>\n\n\n\n Alice's data is now at the AISP. The AISP is not allowed to do anything other than as agreed in the contract. The PSD2 emphatically repeats some Het aanbieden van betalingsdiensten door de betalingsdienstaanbieders kan de verwerking van persoonsgegevens met zich mee brengen. (...) Met name is het noodzakelijk, wanneer voor de toepassing van deze richtlijn persoonsgegevens worden verwerkt, dat het precieze doel wordt aangegeven, dat de desbetreffende rechtsgrondslag wordt vermeld, dat de relevante beveiligingsvoorschriften van Richtlijn 95\/46\/EG (is nu de AVG) worden nageleefd, en dat de beginselen noodzaak, evenredigheid, doelbegrenzing en een niet-buitensporige gegevensbewaarperiode in acht worden genomen. <\/em><\/p> Ook moeten in alle gegevensverwerkingsystemen die in het kader van deze richtlijn worden ontwikkeld en gebruikt, de beginselen gegevensbescherming by design en gegevensbescherming by default in acht worden genomen.<\/em>\"> important privacy principles.<\/span><\/a> An important privacy principle is target retention,<\/span><\/a> knowing what personal data are collected and processed for enables a person to agree or disagree with a processing, and to know what their rights (such as the right of access) are aimed at. The purpose limitation is through the definition of an account information service De nadruk op het vasthouden van de doelbinding komt terug in overweging 89, artikel 67 lid 2 sub f ('gaat niet over tot het gebruiken, zich toegang verschaffen tot of opslaan van gegevens voor andere doelstellingen dan het uitvoeren van de door de betalingsdienstgebruiker uitdrukkelijk gevraagde rekeninginformatiedienst, overeenkomstig de voorschriften inzake gegevensbescherming') en art. 94 lid 2 PSD2 ('Betalingsdienstaanbieders mogen alleen met de uitdrukkelijke toestemming van de betalingsdienstgebruiker toegang krijgen tot persoonsgegevens die noodzakelijk zijn voor het aanbieden van hun betalingsdiensten, deze verwerken en bewaren.)\">pretty well delineated.<\/span><\/a> Another principle is data minimization.<\/span><\/a> This is limiting the amount of data to only that which is necessary to carry out a processing operation.<\/p>\n\n\n\n Eve offers more services than just the account information service.<\/span><\/a> Eve offers the possibility to receive offers based on the payment details, for example from energy suppliers. Alice wants to know more about this. It sounds fun, but who does her data go to? At Eve, the payment details of Alice are converted into a profile. This profile is offered to various energy suppliers. <\/p>\n\n\n\n Alice sees that she can save on the costs of an energy supplier. She decides to switch from an energy supplier. A button in the Eve app takes her to the registration site of the energy supplier. She concludes a contract with the supplier. Isn't that nice? Bob hesitates. He read in Eve's terms and conditions that the company uses an external service provider that specialises in making profiles. Alice's data does not remain with Eve, but is also processed by Mallory Ltd. In the privacy statement he reads that Mallory Ltd. draws up risk profiles, partly from open sources and sources that are not public, for example Collection agencies and (trade) information agencies.<\/span><\/a>\n\n\n\n Alice isn't comfortable. She decides to quit Eve. You'll need your permission anytime and in an easy way Toestemming met aan meerdere voorwaarden voldoen. E\u00e9n daarvan is dat toestemming 'te allen tijde' ingetrokken moeten kunnen worden. 'Het intrekken van de toestemming is even eenvoudig als het geven ervan.' (art. 7 lid 3 AVG)\">can withdraw<\/span><\/a> In de app klikt ze op de knop ’toestemming intrekken’. De verbinding tussen de bank en Eve is nu verbroken. De betalingsgegevens van Alice staan nog bij Eve. En omdat Alice meerdere diensten via Eve heeft afgenomen staan haar gegevens ook bij die partners. Alice heeft het recht om de gegevens te laten wissen, the 'right to be forgotten'<\/span><\/a>. Alice will have to ask for this right, not only from Eve but from all the partners from whom she has obtained services. Exercising the 'rights of the person concerned' are often difficult to perform.<\/span><\/a> In addition, certain financial data must be kept for 7 years, during which time they will lead a dormant existence. Anonymised data or data in models and profiles will also underperform<\/span><\/a>\n\n\n\n Alice soon finds out she has to ask for her data to be erased for every service she has taken through Eve. Only the transfer of payment data is deactivated. This will make her have to do with Eve, too.<\/span><\/a> Because Alice is still a customer of Eve and only the services <\/em>ceases, Eve won't erase the data yet. This may also apply to other providers whose contracts are still ongoing. Chances are that Alice leave it at that.<\/span><\/a> <\/p>\n\n\n\n This article is constantly being expanded. Do you have any suggestions or do you want to know how Bob is getting on? Let us know via <\/span>martijn@privacyfirst.nl<\/span>.<\/span><\/p>","protected":false},"excerpt":{"rendered":" On paper, the PSD2 seems to have good safeguards when it comes to the protection of personal data. Not only is it ... <\/p>\n Op papier lijkt de PSD2 goede waarborgen te hebben als het gaat om de bescherming van persoonsgegevens. Niet alleen wordt verwezen naar de Algemene verordening gegevensbescherming (AVG) maar \u00f3\u00f3k moet een consument zijn uitdrukkelijke toestemming geven voordat gegevens door een betalingsdienstaanbieders verwerkt worden. In dit artikel beschrijven we hoe de PSD2 omgaat met privacy. PSD2 door de ogen van ‘Alice’ en ‘Bob’ Om de taaie PSD2 beter te volgen illustreren we de PSD2 aan de hand van enkele personen, Alice en Bob. Zij maken regelmatig geld naar elkaar over. Alice heeft bij meerdere banken een rekening en wil graag gebruik…<\/p>\n","category_list_v2":"achtergrond<\/a>","author_info_v2":{"name":"Martijn van der Veen","url":"https:\/\/psd2meniet.nl\/en\/author\/martijn\/"},"comments_num_v2":"0 comments","_links":{"self":[{"href":"https:\/\/psd2meniet.nl\/en\/wp-json\/wp\/v2\/posts\/279"}],"collection":[{"href":"https:\/\/psd2meniet.nl\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/psd2meniet.nl\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/psd2meniet.nl\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/psd2meniet.nl\/en\/wp-json\/wp\/v2\/comments?post=279"}],"version-history":[{"count":10,"href":"https:\/\/psd2meniet.nl\/en\/wp-json\/wp\/v2\/posts\/279\/revisions"}],"predecessor-version":[{"id":763,"href":"https:\/\/psd2meniet.nl\/en\/wp-json\/wp\/v2\/posts\/279\/revisions\/763"}],"wp:attachment":[{"href":"https:\/\/psd2meniet.nl\/en\/wp-json\/wp\/v2\/media?parent=279"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/psd2meniet.nl\/en\/wp-json\/wp\/v2\/categories?post=279"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/psd2meniet.nl\/en\/wp-json\/wp\/v2\/tags?post=279"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}Data from Alice' bank to AISP<\/h3>\n\n\n\n
Data from Alice are processed by AISP<\/h3>\n\n\n\n
#Adv \"Hey Alice, is this something for you?<\/h3>\n\n\n\n
Alice withdraws her consent<\/h3>\n\n\n\n
Alice notes: withdrawing consent is not automatically deleting data<\/h3>\n\n\n\n