Innleiðing PSD II og GDPR · GDPR - Overview - Most prominent impact areas Hrafnkell Óskarsson: 10:30. Kaffihlé: 10:45. GDPR IT infrastructure impacts. Mikko Viemerö. 11:20. Touchpoints

Innleiðing PSD II og GDPR

Málstofa SFF og KPMG

2© 2017 KPMG ehf. á Íslandi er aðili að alþjóðlegu neti KPMG, samtökum sjálfstæðra fyrirtækja sem aðild eiga að KPMG International Cooperative, svissnesku samvinnufélagi. Allur réttur áskilinn.

DagskráHefst Efni Fyrirlesari

08:30 Léttur morgunverður

08:45 Kynning Jóna Björk Guðnadóttir

08:55

PSD II- Impact areas- Uncertain areas- Coping strategies- Proposition setting model

Paul Koetsier

09:45GDPR- Overview- Most prominent impact areas

Hrafnkell Óskarsson

10:30 Kaffihlé

10:45 GDPR IT infrastructure impacts Mikko Viemerö

11:20Touchpoints PSD2 and GDPR- GDPR requirements for AISP services- Limitations / possibilities- Direction for set up from a service provisioning and service delivery perspective

Paul Koetsier

11:50 Samantekt12:00 Lok

PSD2 –Overview

September 2017


Agenda

— Introduction

— Trends in payments and banking…

— … and how PSD2 fits in

— Implications

— Next steps

Trends in payments and banking


Big global trends influence the future developments in banking and payments

Regulatory reformRegulation presents

challenges andopportunities, with asignificant focus on

innovation.

Technology developmentTechnology is

reinventing banking. Creating opportunities

for non-traditional players.

Mobile adoptionBy 2020 5bn people on

earth will have asmartphone.

Mobile drives newecosystems.

Megatrends

…given the speed of change, agility is a key condition in any future scenario

What does the future landscape of banking and payments look like? What value propositions are felt to be relevant?

1

What position(s) will you take in this future landscape?2

What are the implications to your target operating model?3

What are the next steps on the roadmap and how to ensure execution stays in line with the ambition and market developments?

4

KEY QUESTIONS


Regulation: is set to remain a driving factor; PSD2 is “just one of many”

2016 2017 2018 2019

Fourth Money Payment Services Electronic IdentificationLaundering Directive Directive II (PSD2) and Trusted Services(AML / ATF)June 2017

January 2018 (eIDAS) (mutualrecognition eIDs)Mid 2018

Mobile Payments SWIFT Customer Security Program BRRD General DataSecurity in Europe Q2 2017 2018 Protection RegulationFebruary 2017 AIFMD

2018(GDPR)May 2018

PSD2Q1 2017EBA RTS Submission

PSD2Exp. H2 2019Entry into force of EBA RTS

Target 2Q4 2017ISO20022 migrationassessment

Instant PaymentsNov 2017EPC SCTInst rulebooklive

... and more exist that impact payments: Basel IV, Intraday liquidity norms, etc.


Ecosystems change, mainly as a consequence of the mobile adoption and technology trends

New channels, greater

connectivity

Mobileadoption

Changing consumer behaviour

Payments become a

utility Enabled by technologies like: Cloud, Internet of Things and Blockchain

Banks (ASPSP’s)

Brick & Mortar Retailers

Challenger Banks

PSP’s andAcquirers

FinTech & RegTech

Aggregators

Online Retailers

Tech giants

Telcos

Processors

Schemes

Who orchestrates the ecosystem? The bank as a platform?

Content suppliers

Peers

How PSD2 fits in


PSD2: Revised and updated directive

Open bank account data to licensed third parties providers through an Interface, most possibly Application Program Interface (API), when requested by client

New and stricter requirements on security: stronger client authentication requirements

Higher level of consumer protection: limits on consumer responsibilities vs unauthorized transactions.

Reduce hidden cost of electronic payments:surcharges for card payments are forbidden

Broader scope of regulation: transactions involving currencies different than EUR and so called one leg transactions PSD2

1

2

3

4

5

The revised Payment Services Directive (PSD2) has five primary objectives:


PSD2: Most prominent aspects

LiabilityRegime

Information Require-

mentsBlocking of

Payment Instruments

FraudStatistics

Currency conversion

Terms and Conditions

Major IncidentsReporting

PaymentTransaction Processing

1) Third Party Payment Service Provider

Payment Initiation Services

EBA-Register

Operational & Sec. Risk

Management

Cards

Payment Initiation Services

Account Information

Services

External Card Issuer

Account Information

Services

Call-Center

Other channels

LiabilityTransparencySecurity2-FAAccess TPP1

Self-Service Banking

Terminals

Extended Application

Online Banking/

App


PSD2: XS2A

Audit trail

Documentation of every operation between the bank, TPP and the customer:• Session ID• Timestamp• Relevant

transaction data

Interface

• Identification of the TPP against the bank

• Secure communication

• Service-Level equals Online-Banking

• Test environment must be provided by the bank

• No explicit standards set yet (ISO20022)

Identification

• TPP uses qualified website certificates iDAS1

• 3 Potential roles of the TPP (PISP2, AISP3, external cards)

• Name of the authority, where the TPP is registered

• Authorisationnumber

Security

Duty of the TPP:• The personal

security features must not be accessible for TPP at any time

• TPP can rely on the SCA processes of the bank

Data Exchange

• Equal treatment of TPP and client during information provision

• Access to account information four times a day for the AISP or on an active request

Bank TPP Client

1) Regulation for electronic identification and trusted services2) Payment Initiation Service Provider3) Account Information Service Provider


— Dynamic interlinking between the authentication code with value and the payment recipient

— Display of value/recipient and initiating the payment separately on the channel, device or app

2-FA with dynamic link (Remote payment process)

2-FA1 (Online-access, electric CT, remote actions with risk potential)

— Generation of a one-time accepted authentication code

— Mechanism for time-out (max. 5 mins.) and max. number of failed attempts (max. 5 attempts)

— Fraud detection with regards to amongst others malware-infection, risk profiles, known fraud scenarios and historic patterns

— Audit of 2-FA process documen-tation and report to be made available when desired

Multipurpose-Device

Independent Review

— Separate, secure environment necessary if authen-ticationcode is used

Property:— Consideration of the algorithm and key length

— Prevention of the replication through third-party

Knowledge:— Consideration of length, complexity and expiry date

— Restricted disclosure towards third parties

Inherence:— Consideration of biometric sensors and algorithms

— Access restrictions for third parties

Authentication methods have to include at least 2 of 3 factors

Strong customer authentication

1) 2 Factor Authentication

PSD2: Strong Customer Authentication


2-FA with dynamic interlink

2-FA

Electronic remote payment process: No 2-FA, if amount < 30 EUR and the cumulated value of prior transactions without 2-FA < 100 EUR or 5 consecutive individual remote payment transactions

Contactless electronic payments (EMV) at the POS1: No 2-FA, if the value does not exceed the limit of < 50 EUR and the cumulated value of the prior transactions without 2-FA < 150 EUR or 5 consecutive individual payment transactions.

Payer and recipient are identical and the account is registered with the same financial institution (In-house).

Compiling and extension of a standing order requires 2-FA; non-related individual orders without the 2-FA (common practice).

Compiling and adjusting a list of trusted recipients using 2-FA; money transfer to a recipient from the list without 2-FA (Whitelist).

Access to online accounts: Only access to account information and 90 days transaction information without 2-FA possible (without discloser of sensitive payment data); but 2-FA necessary while accessing the information for the first time and after 90 days.

PSD2: Exemptions of 2-FA*

1) Point of Sale

Transaction Risk Analysis (TRA): No 2-FA, if the transaction is identified as low risk, the amount does not exceed a Exemption Treshold Value, real-time risk analysis is performed, lower than reference fraud rate, fraud rate calculations are audited, authorities are informed upfront.

Transport & parking fares: No 2-FA where the payer initiates an electronic payment transaction at an unattended payment terminal for the purpose of paying a transport or parking fare.

* Based on Final draft Regulatory Technical Standards

Implications


Banks are not the only entities in the payment market anymore

• Visa, MasterCard and AmericanExpessshare their origin in the bank environment and they have been key players of the development of standards card payments

• Nowadays, their main strategy focuses on developing proprietary technologies to stimulate best practices of digital payments, with strong investments and partnerships in and with diverse new and established parties

ICS(*)

• The main objective is the access to big data to increase customer knowledge and improve the buying experience

• They start through the development of their own wallets. Companies such as Google or Paypalhave launched wallets that are a threat for banks

Bigtechs Fintechs

• Recent financial services companies use the latest technology to offer products and innovative financial servicesand improve the customer experience

• Initially, they are dependent of the deposit bank account but some initiatives already have their own licenses

• The SMS technology only succeeded in emerging countries where the bulk majority of the population was unbanked

• Since then, phone companies have been promoting other payment methods such as the payments using the NFC technology or wallets over the last years

Phoneoperators

Vodafon e Wallet

• Companies that manufacture mobile phones as Apple or Samsung have developed their own payment platforms to satisfy the need of the mobile phones owners

• The closed solutions do not allow the user to use other payment tools

Manufacturersdevices

• Big retailers are betting for payment methods achieving desintermediation of the market

• Companies as Inditex in Spain, offers a mobile payment solution based in QR codes allowing the customer to make a payment without the need of a physical card

Retailers

(*) ICS: International Card Services


The winners of tomorrow are not a given

There is no end state, it will evolve over time, what role and what services do you offer?

Harmonised standardised APIsDisparate non standardised APIs

Traditional parties are dominant

Non traditional parties are dominant

Banks earned the relationship

BigTech on a roll

Status quo

Specialisation pays off


Organisations dealing with PSD2 need to ensure that they don’t underestimate the complexity of the changes and the need for a holistic approach in responding to this disruptive regulation.

Without a top down strategic approach there is a risk of organisations missing out on strategic opportunities to competition. It all starts with understanding your strategic appetite to compete for the opportunities presented by PSD2 and Open Banking.

What is your organisations’ strategic appetite?

As an organization we view PSD2 and Open Banking as a regulatory requirement and have defined a regulatory action plan. Although we recognize the disruptive elements, we do not have any ambitions to leverage this industry wide change at a competitive level.

We have defined an Executive sponsored strategy to defend ground against new challengers and heritage institutions seeking to disintermediate us from our customers. We have identified elements of our operational functions that may need to change but have not assessed our organizational design and interdependencies in their entirety.

COMPLY

COMPETE

INNOVATE Our organization has a strategy to extract a competitive advantage from this change. Open Banking is an opportunity to assess and re-align our operating model and technology capabilities to this new strategy, ensuring we are able to respond as an agile and innovative organization.


Define propositions for your customer engagement strategy

Rol

esc

ope

ASPS

P(“

Ban

k”)

AISP

PISP

AISP

&PI

SP

Payments services(Compliance scope)

Other banking services Beyond banking

— Comply to XS2A

requirements

— Remote payment initiation

— Multi bank dashboard— Payment account

Aggregator— Accounting package /

ERP integrator

— Multi bank cash management

— PSP services— Merchant one stop shop

— Personal finance management

— Multi bank dashboard — Banking account

aggregator— Treasury management

solutions

— Financial services portal, incl. lending,

FX, MM— Working capital

solutions— eBilling / eInvoicing

— Active cash management from other accounts to

perform payment

— Open banking

— Google / Facebook (financial) services’

— Loyalty— Crowdfunding

— Invisible banking

— Open banking platform

— Monetised API’s

— Open banking platform

— Monetised API’s

EVA

ABN AMRO

Retail

SME

Large corporates

Breadth of services scope

The journey ahead


Design your PSD2 program

Your PSD Program

February 2017RTS from EBA EC

January 2018PSD 2 transposed

Exp. H2 2019RTS in force

Principles and starting points

Interpretation, gap and solution identification Gap closure PSD 2 + strategic propositions Solution implementation for RTS

Regulatory and market development and interpretation tracking

3,5 monthsTime left to

implement PSD 2

Timing

July 2013PSD 2 announced

October 2015PSD 2 approved

August 2016 RTS for consultation

~20 monthsTime left to implement

XS2A

January 2018PSD 2 transposed

Exp. H2 2019RTS in force

February 2017RTS publication

Set strategic direction

— Determine strategic positioning

— Determine value propositions to develop; defensive and offensive

— Determine timeframe (i.e. before or beyond PSD 2 deadline)

— Determine principles and starting points for compliance project including strategic directions set

— Principles to be set on way of working, risk based compliance assessment, marketing, etc.

— Complete interpretation of PSD 2

— Determine gaps in current landscape

— Identify solutions to close the gaps

— Determine solutions and decide on solution to be implement

— Close gaps in line with set solutions

— Capability definition, sourcing strategy

— Implement value propositions chosen in strategic direction setting

— Complete specific gap closure with regards to the RTS: strong customer authentication and communication with TPP’s.

— Optional: connections to other banks when playing TPP role itself

— Keep constant sight on regulatory and market developments that could impact strategic directions, interpretations and/or specific solutions.

— Adapt approach where needed.

Contacts

The contacts at KPMG in connection with this presentation are:Sigurvin SigurjónssonSenior managerMob: +354 857 5559Mail: [email protected]

Paul KoetsierSenior managerMob: +31 6204 3963 4Mail: [email protected]

https://kpmgbrandcentral.brandwizard.net/app/asset/asset_search.aspx?catid=757&libid=2








08:55


Paul Koetsier



10:30 Kaffihlé



Paul Koetsier


Ný persónuverndar-löggjöf2018Hrafnkell Óskarsson, LL.M.


Dagskrá

1

2

3

4

Ný Evrópureglugerð um persónuvernd (GDPR): Hvers vegna og hvenær?

Umfangsmiklar breytingar og tækifæri

Helstu áhrif á fjármálafyrirtæki

Samantekt

Ný Evrópureglugerð um persónuvernd: Hvers vegna og hvenær?


Ný persónuverndarlöggjöf – hvers vegna? Ný Evrópureglugerð um persónuvernd: Hvers vegna og hvenær?

Tímabil stafrænnarvæðingar

Samræming reglnamilli allra ríkja ESB og

EES

Réttur einstaklingastyrktur


— Vinnsla sé lögmæt og málefnaleg.

— Gögn aðeins fengin í tilteknum, lögmætum tilgangi og aðeins unnin í samræmi við hann.

— Vinnsla sé viðeigandi og í samræmi við meðalhóf.

— Efnislega réttar og uppfærðar upplýsingar.

— Gögn ekki geymd lengur en nauðsynlegt er.

— Vinnsla í samræmi við réttindi skráðra einstaklinga.

— Gögn vistuð með öruggum hætti.

— Ekki flutt út fyrir EES-svæðið nema fullnægjandi öryggisráðstafanir séu fyrir hendi.

Ný Evrópureglugerð um persónuvernd: Hvers vegna og hvenær?

Átta grundvallarreglur persónuverndar


Minna en ár til þess að standast nýju kröfurnarNý Evrópureglugerð um persónuvernd: Hvers vegna og hvenær?

Lög um persónuvernd og meðferðpersónuupplýsinga nr. 77/2000

Í dag

Núgildandi löggjöf

GDPR tekur gildi

25. maí 2018

Framundan

Umfangsmiklarbreytingar ogtækifæri


Umfangsmiklar breytingar og tækifæri

Helstu breytingarPersónuverndarfulltrúi (PVF)Skipa, þjálfa og virkja PVF (þegar við á).

Ábyrgðarskylda Innleiða þarf viðeigandi ferla til þess að ná fram samræmingu við kröfur GDPR. Fyrirtæki þurfa að geta sýnt fram á hvernig þau telji sig uppfylla reglurnar.

Innbyggð persónuvernd Fella þarf persónuvernd inn í hönnun vinnslu og kerfisþróun.

Tilkynna um öryggisbresti Innleiða ferla til þess að geta brugðist við tímanlega (innan 72 klst.) og á viðeigandi máta.

GagnaverndaráhættumatFramkvæma áhættumat áður en nýrri tækni/þjónustu er bætt við eða hagnýtt í starfsemi.

SektirStjórnvaldssektir geta numið allt að 4% af ársveltu eða 20 milljónum evra.


Hvernig skapast samkeppnisforskot með samræmingu? Umfangsmiklar breytingar og tækifæri

Markaðssetning Með því að setja persónuvernd starfsmanna og viðskiptavina í forgang og markaðssetja fyrirtækið í samræmi við það skapast samkeppnisforskot.

Efla traust Góð persónuverndarstjórnun eflir traust viðskiptavina, starfsmanna og samstarfsaðila á fyrirtækinu.

Auka vilja viðskiptavina

Gagnsæ persónuverndarnálgun mun auka vilja viðskiptavinatil þess að veita samþykki sitt fyrir vinnslu persónuupplýsinga.

Lágmörkun lagalegrar áhættu

Með því að fylgja kröfum GDPR er dregið úr lagalegri áhættu fyrirtækisins, þ.m.t. hættu á stjórnvaldssektum.

Önnur áhætta Með því að draga úr persónuverndar- og öryggisáhættu minnka líkur á að orðspor, vörumerki, eða viðskiptasamböndverði fyrir skaða vegna öryggisbresta.

Lágmörkun kostnaðar

Með því að samræma núverandi eða fyrirhugaða ferla, tæknibreytingar, eða verkefni fyrirtækisins við kröfur GDPR er samhliða dregið úr kostnaði.



Helstu heimildir:1. Samþykki fyrir vinnslu:

– í þágu eins eða fleiri tiltekinna markmiða– frjálst– skýrt orðað– afturkallanlegt

2. Framkvæmd samnings / ráðstafanir að beiðni skráðs áður en samningur er gerður 3. Uppfylling lagaskyldu sem hvílir á ábyrgðaraðila4. Varsla lögmætra hagsmuna, nema hagsmunir hins skráða vegi þyngra


Heimild til vinnslu, 6. gr. GDPR


1. Skráður einstaklingur skal eiga rétt á að fá persónuupplýsingar er varða hann sjálfan, sem hann hefur látið ábyrgðaraðila í té, á skipulegu, algengu, tölvulesanlegu sniði og eiga rétt á að senda þessar upplýsingar til annars ábyrgðaraðila án þess að ábyrgðaraðilinn, sem veittar voru persónuupplýsingarnar, hindri það ef:a) vinnslan byggist á samþykki skv. a-lið 1. mgr. 6. gr. eða a-lið 2. mgr. 9. gr. eða samningi

skv. b-lið 1. mgr. 6. gr. ogb) vinnslan er sjálfvirk.

2. Þegar skráði einstaklingurinn neytir réttar síns til þess að flytja eigin gögn skv. 1. mgr. skal hann eiga rétt á að láta senda persónuupplýsingarnar beint frá einum ábyrgðaraðila til annars ef það er tæknilega framkvæmanlegt.

3. Það að neyta réttarins, sem um getur í 1. mgr. þessarar greinar, skal ekki hafa áhrif á 17. gr. [réttur til eyðingar].

4. Rétturinn, sem um getur í 1. mgr., skal ekki skerða réttindi og frelsi annarra.


Réttur til flytja eigin gögn, 20. gr. GDPR


Skráður einstaklingur á rétt á að ábyrgðaraðilinn eyði persónuupplýsingum án ótilhlýðilegrar tafar ef:

a) persónuupplýsingarnar eru ekki lengur nauðsynlegar í þeim tilgangi sem lá að baki söfnun þeirra eða annarri vinnslu þeirra,

b) hinn skráði dregur til baka samþykkið sem vinnslan byggist á, og ekki er annar lagagrundvöllur fyrir vinnslunni,

c) hinn skráði andmælir vinnslunni og ekki eru fyrir hendi lögmætar ástæður fyrir vinnslunni sem ganga framar,

d) vinnsla persónuupplýsinganna var ólögmæt,

e) eyða þarf persónuupplýsingunum til að uppfylla lagaskyldu sem hvílir á ábyrgðaraðila,

f) persónuupplýsingunum var safnað í tengslum við boð um þjónustu í upplýsingasamfélaginu sem um getur í 1. mgr. 8. gr. [börn]


Réttur til eyðingar, 17. gr. GDPR


„Gerð persónusniðs“ er hvers kyns sjálfvirk vinnsla persónuupplýsinga sem felst í því að notapersónuupplýsingar til að meta ákveðna þætti er varða hagi einstaklings, einkum að greina eðaspá fyrir um þætti er varða frammistöðu hans í starfi, fjárhagsstöðu, heilsu, smekk, áhugamál,áreiðanleika, hegðun, staðsetningu eða hreyfanleika.

Skráður einstaklingur á rétt á að ekki sé tekin ákvörðun eingöngu á grundvelli sjálfvirkrargagnavinnslu, þ.m.t. gerðar persónusniðs, sem hefur réttaráhrif að því er hann sjálfan varðar eðasnertir hann á sambærilegan hátt að verulegu leyti.

Undantekningar:• sjálfvirk ákvörðun nauðsynleg við samningsgerð eða efndir samnings;• lagaheimild (sem þarf jafnframt að tryggja réttindi og hagsmuni hins skráða);• beint samþykki.


Notkun persónusniðs (profiling), 22. gr. GDPR


B-liður 1. mgr. 37. gr. GDPR:

„Ábyrgðaraðili og vinnsluaðili skulu tilnefna persónuverndarfulltrúa í sérhverju tilviki þar semmeginstarfsemi ábyrgðaraðila eða vinnsluaðila felst í vinnsluaðgerðum sem krefjast, sakir eðlissíns, umfangs og/eða tilgangs, umfangsmikils, reglubundins og kerfisbundins eftirlits með skráðumeinstaklingum.“

Lykilatriði:

- Meginstarfsemi

- Umfang (fjöldi skráðra, gagnamagn)

- Reglubundið og kerfisbundið eftirlit


Persónuverndarfulltrúar (DPO)


—Útvistun og önnur miðlun til þriðja aðila– Skyldur ábyrgðaraðila og vinnsluaðila

—Gagnaflutningar til landa utan EES aðeins heimilir að uppfylltum skilyrðum V. kafla reglugerðarinnar


Gagnaflutningar


—Miðlæg umsjón persónuupplýsinga—Breyta persónuupplýsingum í almennar upplýsingar

– upplýsingar gerðar ónafngreinanlegar– dulkóðun o.fl.– ákvæði 11. gr. GDPR

—Hátternisreglur skv. 40.- 41. gr. GDPR—Vottun skv. 42.-43. gr. GDPR


Nokkrar leiðir til að auðvelda hlítingu

Samantekt


Samantekt

Fjármálageirinn – möguleg SVÓT greiningStyrkur

- Fyrirtækjamenning (bankaleynd)- Traust virðist til staðar- Reynsla af ferlum- Hæft starfslið

Veikleiki

- Stór fyrirtæki með margþætta starfsemi og marga skráða

- Mörg (gömul?) kerfi

Ógnanir

- Stjórnvaldssektir vegna brota á reglum eða ófullnægjandi innleiðingar

- Talsverðar líkur á tjóni ef öryggisbrestur

- Aukin orðsporsáhætta

Tækifæri

- Vönduð meðferð upplýsinga byggir ofan á traust sem er til staðar

- Nýta upplýsingar til að þróa nýjar afurðir eða aðlaga þær betur viðskiptavini

Vinsamlegast verið í sambandi við eftirfarandiaðila varðandi efni þessarar kynningar:Hrafnkell ÓskarssonManagerGSM: 860 8628Póstur: [email protected]









08:55


Paul Koetsier



10:30 Kaffihlé



Paul Koetsier


GDPR – IT infrastructure impactsIFSA, 26 September 2017

Mikko Viemerö (CIPP/E, CIPM, CIPT, CISA, CISM)


▬ The controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including inter alia as appropriate:

a. the pseudonymisation and encryption of personal data;

b. the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services;

c. the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident;

d. a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing.

Security of processing (GDPR art. 32)


Security of processing in practice

Security of data at rest & data in transit

System & network security

Pseudonymization / anonymization if necessary

Access controls

Logging

Backups

Continuity planning

Disaster Recovery

Incident Management

Regular testing and evaluation of technical measures & systems


Data mapping Master data

management Data & system

classification

Privacy by Design – implications on IT capabilities

5. Destruction

4. Disclosure

3. Retention

2. Use

1. Collection

Consent / objectionsmanagement

Quality of data User & access

management

Pseudonymization Anonymization Encryption

Data seggregation Data transfer security

Secure deletion Clean-up operations

Storage limitationRight to erasure

AccountabilityData minimization

Integrity & confidentiality

Right to object/restrictRight to rectify

AccuracyPurpose limitationData minimization

Archiving req’sIntegrity &

confidentiality

Right of accessRight of data portability

Integrity & confidentiality


▬ Part of requirements in the GDPR are vague and require interpretation

▬ Responsibility of Controller to determine sufficientcourse of action

▬ Risk-based approach shall be applied regardinggovernance, process design, security, assessmentsetc.

▬ The selected measures and controls shall be basedon risk assessment, considering inter alia

▬ the nature and sensitivity of the personal data processed,

▬ the scope, context and purposes of processing,

▬ available resources, and

▬ the state of technology.

One size doesn’t fit all – the risk-based approach


Notification of a personal data breach (GDPR art. 33-34)

The controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory

authority Notification is required also to the data subjects, if the personal data breach is likely

to result in a high risk to the rights and freedoms of natural persons

However, notification of the personal data breach is not required, if it is unlikely to result in a risk to the rights and freedoms of natural persons

Implications: Capabilities to detect, investigate, document required Risk-based preventive action and documenting required

Contract requirements incl. reporting crucial


Personal data outsourcing – vital points to agree on

Location of & access to data

Scope of processing

Data classification vs. system requirements

Private Cloud / Public Cloud?

Security measures and monitoring

Reporting

Onward transfers (sub-processors)

Measures after contract termination

Assistance in fulfilling the duties laid out by the GDPR

The contacts at KPMG in connection with this presentation are:

Ingi TómassonSenior managerMob: +354 840 2001Mail: [email protected]

Mikko ViemeröManagerMob: +358 40 129 6163Mail: [email protected]









08:55


Paul Koetsier



10:30 Kaffihlé



Paul Koetsier


PSD2 – GDPRRelation

IFSA, 26 September 2017


Agenda

— Introduction

— The relationship between PSD2 and GDPR

— Specific attention points

— Advised actions


GDPR is a basis for PSD2, financial institutions need to comply to both

GDPR

PSD2

— Scope differs— GDPR applies to Payment Service

Providers— PSD2 refers to current privacy

Directive— GDPR is particularly relevant when

data based payment services are provided, e.g. in the case of Account Information Services


Specific attention points

Consent, purpose and

duration

— Addressed in both PSD2 and GDPR.— GDPR describes the need for the explicit and informed consent from customers regarding the purpose and duration of

data processing, specified in a transparent way in any agreement or terms and conditions.— Challenge: ability of an ASPSP, as a data controller, to validate consent was supplied to a third party and to stay in

compliance to GDPR advice to request consent as well and to keep an audit trail.— Challenge: Customers shall be able to request that all their personal data be removed. Although some information is

required to keep due to regulatory reporting requirements.

Sensitive payments data

— Third party may not request sensitive payments data according to PSD2.— Sensitive payment data: data, including personalised security credentials which can be used to carry out fraud. For the

activities of payment initiation service providers and account information service providers, the name of the account owner and the account number do not constitute sensitive payment data.

— What about data in context, where a payment service provider is not aware of other data elements?

Silent party data

— Silent party data: the data concerning “the other side of a payment transaction”: account number, name, remittance information.

— Other side has not supplied explicit consent to process and distribute its data e.g. in the light of an AISP service.— If this data should be anonymised, the value of AISP services will be drastically reduced.

Multiple account owners

— How can explicit consent be given in the case of joint account holders?— And how about power of attorney accounts?

The implementation will impact the customer journey


A list of elements to be catered for in the design of solutions for PSD2 and GDPR and its specificities is at least the following (non-exhaustive):

Banks need to design their solutions carefully

Ensure purpose and duration of personal data processing are captured for in terms & conditions for payment services.1

Ensure power of attorney and joint account holder consent is arranged for through terms & conditions to allow for future flexibility.2

As a party that uses personal data for the provision of a specific payment service, explicitly request consent with the (first) use of the service3

As an ASPSP ensure that consent is captured by the ASPSP itself as well when a customer uses a third party.4

Above all: keep a close eye on the local interpretation of the PSD2, any potential guidance from e.g. EBA, the market and jurisprudence developments, and the development of standards..5

Contacts

The contacts at KPMG in connection with this presentation are:Sigurvin SigurjónssonSenior managerMob: +354 857 5559Mail: [email protected]

Paul KoetsierSenior managerMob: +31 6204 3963 4Mail: [email protected]





KPMG on social media KPMG app

© 2017 KPMG ehf. á Íslandi er aðili að alþjóðlegu neti KPMG, samtökum sjálfstæðra fyrirtækja sem aðild eiga að KPMG International Cooperative, svissnesku samvinnufélagi. Allur réttur áskilinn.

The KPMG name and logo are registered trademarks of KPMG International.

Documents

Innleiðing PSD II og GDPR · GDPR - Overview - Most prominent impact areas Hrafnkell Óskarsson: 10:30. Kaffihlé: 10:45. GDPR IT infrastructure impacts. Mikko Viemerö. 11:20. Touchpoints