29 June 2017

EBA publishes report on consumer data and identifies a number of applicable requirements under EU law

The report looks at both the risks and potential benefits of this innovation and identifies a number of requirements under EU law applying to financial institutions, which mitigate many of the risks identified by the European Banking Authority (EBA).

The Report concludes that no additional, industry-specific legislative or regulatory requirements are needed at present, but the EBA will continue to monitor closely this innovation. The Report encourages cooperation between supervisory authorities across all relevant policy areas and contributes to fostering a consistent supervisory approach to innovation in the financial sector.

The EBA had observed that a growing number of financial institutions use consumer data in innovative ways, often combining data that they hold internally with data obtained from external data vendors, social media or other external sources.

After assessing the responses to a Discussion Paper it had published last year, and having carried out an extensive review of a number of EU directives and regulations that apply to the use of consumer data, the EBA considers that there is already an extensive set of legal requirements financial institutions must comply with, which mitigate many of the risks identified by the EBA.

Among these, the General Data Protection Regulation (GDPR) will provide a comprehensive legal framework on the processing of personal data applicable to all providers that process personal data of EU individuals, and financial institutions are expected to take all necessary measures to comply with its provisions by the date of its application (25 May 2018). The Report, therefore, concludes that no additional industry-specific legislative interventions are required at this stage, but, given the growth potential of this innovation, the EBA will continue to monitor closely its evolution. 

The Report acknowledges that further work will be carried out in 2017 jointly with ESMA and EIOPA on the topic of Big Data, and that the three European Supervisory Authorities (EBA, EIOPA and ESMA) will publish their conclusions on this particular topic within the context of the Joint Committee work. 

Press release

Report on Innovative uses of data

© EBA