Curiosity about PSD2 prevails among members and stakeholders

Following the General Meeting of Members on 6 June, the Dutch Payments Association organised a debate on privacy protection under the new PSD2.

Moderator Donatello Piras put searching questions about privacy and PSD2 to the audience and panellists Petra Hielkema of DNB, Nanda Troost of ANBO, Nadja van der Veer of PaymentCounsel and Alexander Baas of De Volksbank. This produced a lively discussion. Before the debate, almost half of the audience were concerned about their privacy under PSD2. Afterwards, those concerns had eased and curiosity prevailed among three-quarters of those present.

Thorough screening

Nadja van der Veer argued that privacy concerns are exaggerated: third parties must apply to DNB for a licence and complete a lengthy application form of around twelve pages. In her view, these parties are screened carefully. The GDPR also provides consumers with a range of safeguards and options to remain in control. Van der Veer believes that all the negative publicity prevents new providers—small fintechs—from having a fair opportunity to earn trust.

Good public information

Petra Hielkema also believes there are grounds for confidence. Consumers need to be well informed, so DNB is launching a campaign with the slogan ‘I decide’. Not everyone is convinced, however, that all consumers are sufficiently able to understand the consequences of their actions under PSD2. Consumers have become accustomed to big technology companies doing all sorts of things with their data and believe this is unavoidable.

A trust mark?

Alexander Baas believes this must be challenged. He is therefore pleased that the Minister is taking a cautious approach to introducing the legislation. It is better to introduce it a little later than to have to repair it afterwards. A trust mark showing that approved participants not only comply with the law but also provide additional safeguards could offer a solution and win consumers’ confidence. De Volksbank feels a responsibility towards its customers under PSD2. Through their bank, customers will also be asked whether they want to give a particular third party access to their payment account. They expect their bank to present that question only on behalf of reliable parties. Baas wants to be able to live up to that expectation.

No coercion

The right to access all registered personal data, the right to be forgotten and data minimisation are already provided for under the GDPR. Consumers can always rely on these rights. Complaints procedures are also laid down in both PSD2 and the GDPR. Every PSD2 party must comply with both laws. Nevertheless, Nanda Troost says ANBO advises its members to wait and see and not to consent too quickly to access to their accounts.

Unanswered questions

PSD2 certainly still raises uncertainties. For example, what happens to silent party data in the transaction records of someone who has given access to their payment account—data such as the names, account numbers, amounts and descriptions of beneficiaries and payers? Can a fintech complete and submit an application to DNB before the legislation enters into force, so that a licence can be granted more quickly afterwards? And what about an allowlist for PSD2 service providers? Consumer organisations are calling for a safeguard that works in the same way as an allowlist for direct debits. A PSD2 service provider would then be blocked unless the account holder had added it to their allowlist. According to DNB’s lawyers, such an allowlist for PSD2 services is not permitted by law. Consumer organisations would like to hear what a court has to say about that.

Addressing consumer concerns

At the end of the debate, Petra Hielkema again expressed her confidence in privacy protection under PSD2 in combination with the GDPR. The conclusion was that consumer protection appears sound on paper, but consumers do not yet see it that way. Good information and perhaps a trust mark could help address their concerns.