{"id":714,"date":"2021-01-25T17:50:41","date_gmt":"2021-01-25T16:50:41","guid":{"rendered":"https:\/\/psd2meniet.nl\/?p=714"},"modified":"2021-01-25T22:13:23","modified_gmt":"2021-01-25T21:13:23","slug":"richtlijnen-psd2-gdpr-vastgesteld","status":"publish","type":"post","link":"https:\/\/psd2meniet.nl\/en\/richtlijnen-psd2-gdpr-vastgesteld\/","title":{"rendered":"Guidelines PSD2 & GDPR adopted"},"content":{"rendered":"

Last December 15, the European Data Protection Board (EDPB) adopted the 'Guidelines 06\/2020 on the interplay of the Second Payment Services Directive and the GDPR<\/a>...to. We gave our comments <\/a>during the consultation. In 20 pages and 40 comments, we made clear how the guidelines and PSD2 can be adapted to better protect the privacy of users. We found that the first version already pretty good and concrete<\/span><\/a>but saw plenty of room for improvement. The better the guidelines, the better data will be protected by providers of PSD2 services.<\/p>\n\n\n\n

Have the guidelines improved?<\/h3>\n\n\n\n

After the first read, we wondered if they had been modified at all :-). Apart from some dots, commas and minor adjustments, the guidelines remain as they were proposed. Does the EDPB fail to make use of good comments from the field? We regularly saw good comments from other respondents that were worthy of inclusion. We did not see them again. And the few adjustments that we did see, we had not seen before. We just have to assume that it has been read and taken into account ...<\/p>\n\n\n\n

We see the fact that the guidelines have hardly been modified as good news. The paragraphs that we consider important are fairly concrete and provide good guidelines for providers to apply better privacy by design. It would have been a pity if those paragraphs had been watered down by the lobbying violence.<\/p>\n\n\n\n

Barely adjusted? That's good news...<\/h3>\n\n\n\n

The concrete implementation by the directives is an important aid in the complex playing field. Both laws want to set frameworks and especially give space to companies to use financial and personal data. The AVG is complex because of its 'open standards' and the PSD2 is a tricky law because AISP (account information services) and PISP (payment services) are intertwined. In addition, the PSD2 mainly points to the AVG when it comes to privacy protection and easily distances itself from the discussion with the 'explicit consent' of Article 94(2) PSD2. In such a context, any clarification is an advantage.<\/p>\n\n\n\n

...but still a bit of a shame.<\/h3>\n\n\n\n

The guidelines are quite clear about transparency, special personal data and 'silent third party data'. They fall short on a number of points. Examples are:<\/p>\n\n\n\n