Data Protection Authority opinion concerning implementation of PSD2 and GDPR

Dear,

In the letter dated 28 September 2017, you requested the Personal Data Authority (hereinafter referred to as the DPA) on the grounds of Section 51, second paragraph, of the Dutch Personal Data Protection Act (hereinafter referred to as: the Wbp) to issue an opinion concerning the draft Implementing Decree of PSD2 (hereafter referred to as the "Draft Implementing Decree")1. Together with the Implementation Act of PSD2 (hereafter: the" Implementation Act")2, the Implementing Decree is intended to provide for the national transposition of Directive (EU) 2015/23663 (also known as the second Payment Services Directive; hereinafter: PSD2).3 The DPA issued its opinion regarding the Implementation Act on 22 August 2017. In essence, that opinion concludes that the bill does not sufficiently account for the relationship with the General Data Protection Regulation (hereafter: GDPR)4 and the Wbp.

In this advisory report, the DPA concludes that the draft Implementing Decree incorrectly addresses the relationship with the GDPR (and the Wbp). Partly in line with the advice on the Implementation Act, the present opinion will deal with three main aspects in relation to the draft Implementing Decree, namely (1) the accordance with the GDPR, (2) the consent requirement and (3) the allocation of the supervision of personal data protection under PSD2.

Read the full letter >