Data Protection Authority opinion concerning implementation of PSD2 and GDPR
Written By
Partner
Belgium
I am a partner in the Brussels office of Bird & Bird where, as an expert in payments regulation and competition law, I work closely with our Finance & Financial Regulation group, our EU & Competition law team, as well as our Public Affairs team.
Related
Practices
- Finance & Financial Regulation
- Privacy and Data Protection
- General Data Protection Regulation
- Payment Services
Trending Topics
Countries
Offices
English translation of letter sent by Dutch data protection authority to Dutch Ministry of Finance on the interaction between PSD2 and GDPR:
Dear,
In the letter dated 28 September 2017, you requested the Personal Data Authority (hereinafter referred to as the DPA) on the grounds of Section 51, second paragraph, of the Dutch Personal Data Protection Act (hereinafter referred to as: the Wbp) to issue an opinion concerning the draft Implementing Decree of PSD2 (hereafter referred to as the "Draft Implementing Decree")1. Together with the Implementation Act of PSD2 (hereafter: the" Implementation Act")2, the Implementing Decree is intended to provide for the national transposition of Directive (EU) 2015/23663 (also known as the second Payment Services Directive; hereinafter: PSD2).3 The DPA issued its opinion regarding the Implementation Act on 22 August 2017. In essence, that opinion concludes that the bill does not sufficiently account for the relationship with the General Data Protection Regulation (hereafter: GDPR)4 and the Wbp.
In this advisory report, the DPA concludes that the draft Implementing Decree incorrectly addresses the relationship with the GDPR (and the Wbp). Partly in line with the advice on the Implementation Act, the present opinion will deal with three main aspects in relation to the draft Implementing Decree, namely (1) the accordance with the GDPR, (2) the consent requirement and (3) the allocation of the supervision of personal data protection under PSD2.
