(a)

strengthen user protection and confidence in payments, notably by: improving the application of Strong Customer Authentication (SCA); creating a legal basis for exchange of information on fraud; extending International Bank Account Number (‘IBAN’) verification to all credit transfers; and improving user rights and information;

(b)

improve the competitiveness of open banking services by: (i) requiring account servicing payment service providers (‘ASPSPs’) to put in place a dedicated data access interface and ‘permissions dashboards’ to allow users to manage their granted open banking access permissions; and (ii) setting out more detailed specifications of minimum requirements for open banking data interfaces;

(c)

improve enforcement and implementation of the legal framework for payment services in Member States, notably by: replacing the PSD2 with a directly applicable Regulation (‘PSR Proposal’) clarifying aspects of the PSD2 which are unclear; and improving cooperation between competent authorities and other authorities; and

(d)

improve (direct or indirect) access to payment systems and bank accounts for non-bank PSPs, including payment initiation service providers (PISPs) and account initiation service providers (AISPs).

(a)

establish requirements on transparency of conditions and information requirements for payment services (8);

(b)

establish rights and obligations in relation to the provision and use of payment services, including rules on data access interfaces for account information services and payment initiation services (9) and on data access management by payment service users (10); on data protection (11); on fraud reporting and transaction monitoring mechanisms and fraud data sharing (12); on SCA (13); on enforcement procedures, competent authorities and penalties (14); on intervention powers by the European Banking Authority (EBA) (15).

(1)

to clearly differentiate between the term ‘permission’ and the legal basis for processing under the GDPR, by clarifying in Recital 62 of the PSR Proposal that ‘permission should not be construed as “consent” or “explicit consent” or “necessity for the performance of a contract” as defined in Regulation (EU) 2016/679’;

(2)

to clarify, by way of a recital, that the granting of permission by the payment service user is without prejudice in particular to the obligations of payment initiation service providers and account information service providers under Article 6 and Article 9 of Regulation (EU) 2016/679;

(3)

to reconsider the prohibition applicable to ASPSPs to verify the permission under Article 49(4) of the PSR Proposal or to introduce appropriate alternative safeguards in the enacting terms of the PSR Proposal to protect payment service users against the risk of potential unlawful sharing of personal data by ASPSPs that this prohibition may entail;

(4)

to amend Articles 46(2)(a) and 47(2)(a) of the PSR Proposal to state that payment initiation service providers and account information service providers shall not access personalised security credentials;

(5)

to clarify the definition of ‘sensitive payment data’ under Article 3(38) of the PSR Proposal, notably specifying the types of personal data covered by this definition;

(6)

to specify in relation to which specific type(s) of designated payment service(s) the payment systems and the payment service provider would be entitled to process (which categories of) special categories of personal data in Article 80 of the PSR Proposal;

(7)

to provide justifications (in a recital) as to why the processing of the special categories of personal data for the designated payment service(s) in Article 80 of the PSR Proposal is necessary and proportionate and cannot be avoided via alternative technical means;

(8)

to include a reference to log in registration (to verify if undue access took place) among the data protection safeguards referred to in Article 80 of the PSR Proposal;

(9)

to add to Article 43(2)(a) a reference to the designated payment service(s) for which the permission is granted by the payment service user;

(10)

to add to Article 47(2), concerning the obligations of account information service providers, the requirement under Article 46(2)(b), according to which payment service providers can request from the payment service user only the data that are necessary to provide the requested service;

(11)

to require payment service providers and account information service providers under Article 43(4)(b) to inform account servicing payment service providers about the customer account to which access is being sought and about the legal basis under Article 6(1) GDPR and (if applicable) the exception under Article 9(2) GDPR that they would rely on to access the personal data of the payment service user;

(12)

to specify in Article 43(b) that the dashboard should not be designed in a way that would encourage or unduly influence payment service users to grant or withdraw permissions;

(13)

to clearly determine the categories of personal data that payment service providers would be allowed to process in the context of transaction monitoring mechanisms (notably, providing a definition of ‘information on the payment service user’ referred to in Article 83(2)(a));

(14)

to define appropriate data storage periods for the personal data collected under Article 83;

(15)

to include a definition of ‘information sharing agreement’ in Article 3 of the PSR Proposal;

(16)

to provide in the PSR Proposal that any processing of personal data for the purpose of complying with the fraud prevention legal obligations under Article 83 can only occur for this specific purpose and cannot lead to termination of customer relationship with the payment service provider or affect the on-boarding of the payment service user with another payment service provider;

(17)

to explicitly mention supervisory authorities responsible for monitoring and enforcing data protection law in Article 93(3) of the PSR Proposal.