Proposed Open Finance framework/FIDA: Bird & Bird’s initial thoughts

 “Data users”, i.e. all the entities listed in Article 2(2) FIDA, which includes AISPs but also a new category of entities created by FIDA called “financial information service providence” (FISPs). With “permission” from the customer.

In addition “The data holder shall, upon request from a customer submitted by electronic means, make the data listed in Article 2(1) available to the customer without undue delay, free of charge, continuously and in real-time” (Art. 4)

 “data holders”, i.e. financial institutions, i.e. the entities listed in Art. 2(2) (a) to (n) except AISPs (i.e. AISPs aren’t required to make data available to data users or customers), as long as they collect, store and otherwise process the data listed in Article 2(1).

A FISP doesn’t qualify as a “financial institution”, therefore doesn’t qualify as a “data holder”, therefore isn’t required to make data available to “data users” or the customer.

 “The customer data shall be made available to the data user without undue delay, continuously and in real-time.” (Art. 5(1)).

It should also be made available to the customer “without undue delay, free of charge, continuously and in real-time” (Art. 4).

“… data holders and data users shall become members of a financial data sharing scheme governing access to the customer data in compliance with Article 10. 2. Data holders and data users may become members of more than one financial data sharing schemes. …”

See Art. 10 FIDA for more details on schemes (e.g. members, rules, participation, transparency, common standards for the data and technical interfaces, reasonable compensation, contractual liability, dispute resolution system, notification to NCAs, etc).

“EBA shall develop, operate and maintain an electronic central register which contains the following information: … (c) the financial data sharing schemes agreed between data holders and data users.” (Art. 15(1)(c)).

Which technology

/interface?

FIDA does not provide specific provisions on quality requirements of interfaces. The “financial data sharing scheme shall include the common standards for the data and the technical interfaces to allow customers to request data sharing in accordance with Article 5(1). The common standards for the data and technical interfaces that scheme members agree to use may be developed by scheme members or by other parties or bodies;” (Art. 10(1)(g)).

“A financial data sharing scheme … shall be notified to the competent authority of establishment of the three most significant data holders which are members of that scheme at the time of establishment of the scheme. … the competent authority shall assess whether the financial data sharing scheme’s governance modalities and characteristics are in compliance with paragraph 1.”

Art. 32(3) RTS on SCA and CSC and EBA Opinion on obstacles here.

In particular see para. 43 of the EBA opinion on obstacles: “Article 32(3) RTS explicitly mentions additional checks of the consent given by PSUs to AISPs/PISPs as a potential obstacle. The EBA clarified in paragraph 13 of the EBA Opinion on the implementation of the RTS (EBA-Op-2018-04)14 and the final report on the EBA Guidelines on the exemption from the contingency mechanism under Article 33(6) RTS (EBA/GL/2018/07) that it is the obligation of the PISP/AISP to ensure that it has obtained the PSU’s explicit consent in accordance with Article 66(2) of PSD2 and, respectively, Article 67(2)(a) of PSD2, and that the ASPSP should not check the consent given by the PSU to the PISP/AISP. This was also confirmed by the European Commission in its response to Q&A 4309.”

FIDA does not provide for specific provisions on the prohibited obstacles to data access data.

Art. 5(3)(c): “When making data available pursuant to paragraph 1, the data holder shall: … (c) request data users to demonstrate that they have obtained the permission of the customer to access the customer data held by the data holder”. Interestingly, this seems contrary to the regime under PSD2 and PSR as stated in the two columns on the left!?

 “A data holder may claim compensation from a data user for making customer data available pursuant to paragraph 1 only if the customer data is made available to a data user in accordance with the rules and modalities of a financial data sharing scheme, as provided in Articles 9 and 10, or if it is made available pursuant to Article 11.” (Art. 5(2)). The methodology of calculating the amount of compensation will be determined by the financial data sharing scheme.

Data has to be made available to the customer free of charge.

 “... for the purposes for which the customer has granted permission to the data user” (Art. 5(1)).

“A data user shall only access customer data made available under Article 5(1) for the purposes and under the conditions for which the customer has granted its permission. A data user shall delete customer data when it is no longer necessary for the purposes for which the permission has been granted by a customer.” (Art. 6(2)).

“... a data user shall: (a) not process any customer data for purposes other than for performing the service explicitly requested by the customer; … (e) not process customer data for advertising purposes, except for direct marketing in accordance with Union and national law;” (Art. 6(4)(a) and (e)).

“The processing of customer data referred to in Article 2(1) of this Regulation that constitutes personal data shall be limited to what is necessary in relation to the purposes for which they are processed” (Art. 7(1)).

Article 43 PSR requires ASPSPs to provide the PSU with a “dashboard … to monitor and manage the permissions the [PSU] has given [to TPPs] ”. In particular, the ASPSP and the TPP are required to “cooperate to make information available to the [PSU] via the dashboard in real-time”.

Under Article 48(2) PSR, NCAs shall take, without undue delay, any necessary actions (including sanctions) to preserve account access for AISPs and PISPs. Under Art. 48(3), NCAs must ensure that TPPs comply at all times with their obligations regarding the use of the data access interface. NCAs may request that ASPSPs provide them with data on access by the AISPs and PISPs they service (Art. 48(7) PSR). Likewise, NCAs may request AISPs and PISPs to provide data on their operations.

Article 91 PSR lists the various powers that a NCA should have (e.g. require all necessary information including from non-PSPs (e.g. TSP, payment system operators); conduct all necessary investigations including request documents, examine books, interview individuals, etc; inspections at business premises; etc).

According to Article 45(d), NCAs may request from AISPs all data accessed from accounts (the AISP must log this data and keep it for a 3 year period).
NCAs may also conclude an ongoing investigation through settlement agreements and create expedited enforcement procedures (Art. 96 PSR).

NCAs may impose periodic penalty payments in case of an ongoing breach, until the infringement is terminated (Art. 98 PSR).

Art. 100 PSR provides for a right of appeal against decisions and enforcement actions of NCAs under the PSR.

Very similar provisions to PSR, in Art. 18 to 24 FIDA. NCA are given the right to require all necessary information and conduct all necessary investigations as in Art. 91 PSR. However FIDA also grants NCAs the power to remove content, restrict access to online interfaces, as well as order hosting services to remove, disable or restrict access and domain registries to delete domain names (Art. 18 FIDA).

Similar to PSR, Art. 19-21 FIDA lay down rules for settlements of ongoing investigations, expedited procedures, administrative procedures and penalties, as well as periodic penalty payments.

Under Article 24 FIDA, entities and natural persons who are subject to an adverse decision have a right of appeal.