PSD2 och GDPR – fiender eller fränder? - En utredning av PSD2:s påverkan på tredjepartsleverantörer och direktivets förhållande till GDPR
(2019) JURM02 20192Department of Law
Faculty of Law
- Abstract
- In 2018 the new payment service directive, PSD2, was implemented within the EU. The goals of the directive is to harmonize the payment service market and to strengthen the consumers role on the market. In the directive the definition of a payment service is extended to include two new types of services; Account Information Services and Payment Initiation Services, as well as the providers of these services commonly referred to as Third Party Providers. The directive also introduces the XS2A-rules (Access to Account) which gives Third Party Providers the right to access customers payments accounts and payment accounts information from the customers bank, if the customer explicitly approves of this.
In 2018 the General Data Protection... (More) - In 2018 the new payment service directive, PSD2, was implemented within the EU. The goals of the directive is to harmonize the payment service market and to strengthen the consumers role on the market. In the directive the definition of a payment service is extended to include two new types of services; Account Information Services and Payment Initiation Services, as well as the providers of these services commonly referred to as Third Party Providers. The directive also introduces the XS2A-rules (Access to Account) which gives Third Party Providers the right to access customers payments accounts and payment accounts information from the customers bank, if the customer explicitly approves of this.
In 2018 the General Data Protection Regulation, GDPR, was also implemented within the EU, with the goal to strengthen the right of the individual and protect their personal data. Even though both PSD2 and GDPR are applicable when using and providing payment services, it is not yet entirely clear how the regulations relate to each other and if they are able to coexist. The purpose of this essay is to examine how the regulation in PSD2 that allows Third Party Providers to offer new innovative payment services relates to the rules on personal data processing in GDPR.
PSD2 creates opportunities for new entrants to establish themselves in the payment service market, which will increase competition in the market and ultimately lead to a better customer offer as well as increased innovation and Third Party Providers development of new services. The main problem with the regulations is that they clearly have not been worked out together, which has given rise to some difficulties in interpretation and application. However, there seems to be no direct conflict of rules leading to the conclusion that the regulations cannot coexist. In some parts the regulations actually seem to complement each other to achieve its common purpose; giving the individual greater control over their own data and choices. (Less) - Abstract (Swedish)
- 2018 infördes det andra betaltjänstdirektivet, PSD2. Direktivet har till syfte att skapa en harmoniserad och öppen betaltjänstmarknad, samt att stärka konsumentens roll på marknaden. I och med PSD2 utvidgades begreppet betaltjänst och omfattar nu betalningsinitieringstjänster och kontoinformationstjänster, samt leverantörer av dessa betaltjänster, så kallade tredjepartsleverantörer. Med PSD2 kom också XS2A-reglerna, som innebär att banker måste tillhandahålla kunders betalkontoinformation till tredjepartsleverantörer, om kunden samtycker.
År 2018 infördes även GDPR med syftet att stärka enskildas rätt till skydd av personuppgifter. Betalkontoinformation som i och med XS2A-reglerna nu får delas mellan aktörer utgör många gånger... (More) - 2018 infördes det andra betaltjänstdirektivet, PSD2. Direktivet har till syfte att skapa en harmoniserad och öppen betaltjänstmarknad, samt att stärka konsumentens roll på marknaden. I och med PSD2 utvidgades begreppet betaltjänst och omfattar nu betalningsinitieringstjänster och kontoinformationstjänster, samt leverantörer av dessa betaltjänster, så kallade tredjepartsleverantörer. Med PSD2 kom också XS2A-reglerna, som innebär att banker måste tillhandahålla kunders betalkontoinformation till tredjepartsleverantörer, om kunden samtycker.
År 2018 infördes även GDPR med syftet att stärka enskildas rätt till skydd av personuppgifter. Betalkontoinformation som i och med XS2A-reglerna nu får delas mellan aktörer utgör många gånger personuppgifter enligt definitionen i GDPR, varför regelverket aktualiseras vid användning och tillhandahållande av betaltjänster. Trots att både PSD2 och GDPR ska tillämpas vid tillhandahållandet av betaltjänster är det inte helt klarlagt hur regelverken förhåller sig till varandra. Syftet med denna uppsats är att undersöka hur regleringen i PSD2 som ger tredjepartsleverantörer möjligheter att erbjuda nya innovativa betaltjänster förhåller sig till reglerna om personuppgiftshantering i GDPR.
Sammantaget skapar PSD2 möjligheter för nya aktörer att etablera sig på betaltjänstmarknaden vilket kommer att öka konkurrensen på marknaden och i förlängningen leda till ett större kundutbud och sänkta kostnader för konsumenten, samt ökad innovation och utveckling av nya betaltjänster. Den huvudsakliga problematiken med regelverken är att de inte har utarbetats tillsammans vilket gett upphov till vissa svårigheter i tolkning och tillämpning. Däremot föreligger ingen direkt regelkonflikt och därmed inget som tyder på att regelverken inte skulle kunna samexistera. I vissa delar kompletterar regelverken varandra för att nå ett gemensamt syfte; att ge den enskilda individen större kontroll över sin egen data. (Less)
Please use this url to cite or link to this publication:
http://lup.lub.lu.se/student-papers/record/9000324
- author
- Schulz, Asta LU
- supervisor
- organization
- alternative title
- PSD2 and GDPR - friends or foes?
- course
- JURM02 20192
- year
- 2019
- type
- H3 - Professional qualifications (4 Years - )
- subject
- keywords
- EU-rätt, IT-rätt
- language
- Swedish
- id
- 9000324
- date added to LUP
- 2020-01-31 17:20:33
- date last changed
- 2020-01-31 17:20:33
@misc{9000324,
abstract = {{In 2018 the new payment service directive, PSD2, was implemented within the EU. The goals of the directive is to harmonize the payment service market and to strengthen the consumers role on the market. In the directive the definition of a payment service is extended to include two new types of services; Account Information Services and Payment Initiation Services, as well as the providers of these services commonly referred to as Third Party Providers. The directive also introduces the XS2A-rules (Access to Account) which gives Third Party Providers the right to access customers payments accounts and payment accounts information from the customers bank, if the customer explicitly approves of this.
In 2018 the General Data Protection Regulation, GDPR, was also implemented within the EU, with the goal to strengthen the right of the individual and protect their personal data. Even though both PSD2 and GDPR are applicable when using and providing payment services, it is not yet entirely clear how the regulations relate to each other and if they are able to coexist. The purpose of this essay is to examine how the regulation in PSD2 that allows Third Party Providers to offer new innovative payment services relates to the rules on personal data processing in GDPR.
PSD2 creates opportunities for new entrants to establish themselves in the payment service market, which will increase competition in the market and ultimately lead to a better customer offer as well as increased innovation and Third Party Providers development of new services. The main problem with the regulations is that they clearly have not been worked out together, which has given rise to some difficulties in interpretation and application. However, there seems to be no direct conflict of rules leading to the conclusion that the regulations cannot coexist. In some parts the regulations actually seem to complement each other to achieve its common purpose; giving the individual greater control over their own data and choices.}},
author = {{Schulz, Asta}},
language = {{swe}},
note = {{Student Paper}},
title = {{PSD2 och GDPR – fiender eller fränder? - En utredning av PSD2:s påverkan på tredjepartsleverantörer och direktivets förhållande till GDPR}},
year = {{2019}},
}