The European Banking Authority (EBA) published today a Report presenting the conclusions of its assessment on the topic of innovative uses of consumer data by financial institutions. The Report looks at both the risks and potential benefits of this innovation and identifies a number of requirements under EU law applying to financial institutions, which mitigate many of the risks identified by the EBA. The Report concludes that no additional, industry-specific legislative or regulatory requirements are needed at present, but the EBA will continue to monitor closely this innovation. The Report encourages cooperation between supervisory authorities across all relevant policy areas and contributes to fostering a consistent supervisory approach to innovation in the financial sector.
The EBA had observed that a growing number of financial institutions use consumer data in innovative ways, often combining data that they hold internally with data obtained from external data vendors, social media or other external sources.
After assessing the responses to a Discussion Paper it had published last year, and having carried out an extensive review of a number of EU directives and regulations that apply to the use of consumer data, the EBA considers that there is already an extensive set of legal requirements financial institutions must comply with, which mitigate many of the risks identified by the EBA.
Among these, the General Data Protection Regulation (GDPR) will provide a comprehensive legal framework on the processing of personal data applicable to all providers that process personal data of EU individuals, and financial institutions are expected to take all necessary measures to comply with its provisions by the date of its application (25 May 2018). The Report, therefore, concludes that no additional industry-specific legislative interventions are required at this stage, but, given the growth potential of this innovation, the EBA will continue to monitor closely its evolution.
The Report acknowledges that further work will be carried out in 2017 jointly with ESMA and EIOPA on the topic of Big Data, and that the three European Supervisory Authorities (EBA, EIOPA and ESMA) will publish their conclusions on this particular topic within the context of the Joint Committee work.
Legal basis
The EBA is mandated under Article 9 of its founding Regulation to monitor financial innovation across the EU and to foster a consistent supervisory approach to innovation in the financial sector.
Following a preliminary analysis of the particular innovation of the use of consumer data by financial institutions, the EBA published, on 4 May 2016, a Discussion Paper (DP) that presented the EBA's preliminary assessment on the topic. The DP asked market participants to comment on whether the EBA's analysis fairly reflected current market practices, in order to allow the EBA to make a better informed decision on what regulatory and/or supervisory response, if any, the EBA should take or propose. The EBA received 35 responses to the DP, from a wide variety of stakeholders.
