Data Access and Automated Decision-Making in European Financial Law

Abstract

This article examines the regulatory landscape of financial data access within the European Union, emphasising the implications and effectiveness of recent legislative initiatives. It provides an in-depth analysis of the Financial Data Access Regulation (FIDA) proposal and its relationship with existing laws, focusing on the possibilities for data access and utilisation in the context of Open Finance. The discussion evaluates the regulatory framework for automated decision-making (ADM) in European financial law, highlighting its strengths and identifying areas for improvement. By exploring the intersections of tech resilience, financial regulation, and data protection, the article aims to clarify the practical implications of current and proposed rules, emphasising effective practices and areas needing further legislative attention.

I. Introduction

In an era characterised by rapid technological advancements and an ever-expanding digital landscape, the intersection of regulating financial data access and automated decision-making (ADM) in European Financial Law has emerged as a critical focal point for legal scholars, policymakers, and industry stakeholders alike. The profound impact of data-driven decision-making on the financial services sector necessitates a nuanced understanding of the regulatory framework governing data access and ADM within the European Union. This article explores this intricate landscape comprehensively, particularly emphasising the implications and effectiveness of recent critical legislative initiatives.

The financial industry has undergone a transformative evolution in recent years, driven by advancements in technology and data analytics, leading to increased datafication. ¹ Financial institutions increasingly rely on vast datasets to streamline operations, enhance risk management, and personalise customer services and products. As these data-driven practices become more prevalent, the need for a robust regulatory framework governing financial data access, utilisation, and protection has become paramount. Recognising the challenges and opportunities of digital transformation, the European Union has introduced the Financial Data Access Regulation (FIDA) proposal to tackle crucial issues surrounding data sharing and interoperability within the EU’s financial sector. ²

The proposal for the Financial Data Access Regulation framework expands upon the foundation laid by the Open Banking framework ³ initiated under the Payment Services Directive 2 (PSD2). ⁴ PSD2 focused on facilitating the sharing of payment account data with customer consent, which will be replaced by the PSD3 ⁵ and Payment Services Regulation (PSR), ⁶ broadening the scope in light of the comprehensive Open Finance framework. ⁷ Part of the Open Finance framework is the FIDA proposal, which includes amendments to existing regulations such as (EU) No 1093/2010, ⁸ (EU) No 1094/2010, ⁹ and (EU) No 1095/2010, ¹⁰ which respectively established the European Banking Authority, the European Insurance and Occupational Pensions Authority, and the European Securities and Markets Authority, alongside Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA), which aims to tackle ICT related incidents and covers most financial actors, including those covered by FIDA. ¹¹ The initiatives under Open Finance address tech resilience, financial regulation, and data protection, and will play a decisive role in shaping the trajectory of EU financial law.

The FIDA proposal includes various financial data beyond mere payment accounts, encompassing insurance, savings accounts, loans, investments, and pension products. ¹² Under the FIDA proposal, clear rights and obligations would be established, allowing customers to share their data with authorised data users. ¹³ Importantly, customers retain full control over access to their data, dictating its usage and purpose, with standardisation of data and technical interfaces ensuring interoperability. ¹⁴ A pivotal component of FIDA is the designation of financial information service providers (FISP) as authorised data users, ¹⁵ akin to account information service providers (AISP) under PSD2. ¹⁶ Furthermore, the proposed amendments would impact existing laws, including those governing European financial authorities and digital operational resilience within the sector, ¹⁷ marking a significant legislative evolution towards a more regulated financial data ecosystem. Against the backdrop of the FIDA proposal, this article delves into the broader European legal landscape, scrutinises the interplay between the FIDA proposal and related existing and proposed laws, and assesses the role of ADM.

The present Article proceeds as follows. Section II introduces the proposed Financial Data Access Regulation framework, delving into the legislative proposal by the European Commission aimed at addressing challenges in the EU financial sector and fostering a harmonised European response regarding data access. It discusses the empowerment of customers through control over their financial data, the operational framework for data access, sharing, and use, and the supervision framework with competent authorities ensuring compliance and risk management. Section III explores financial data access and automated decision-making, starting with an introduction to ADM in European Financial Law, highlighting its evolution and intersections with the FIDA proposal. It discusses the challenges and implications of integrating ADM into financial data access, emphasising the need to balance innovation with consumer rights and business interests. Section IV addresses stakeholders’ critiques on the FIDA proposal and provides policy recommendations for improvement. Finally, Section V provides concluding remarks and an outlook.

II. The Proposed Financial Data Access Regulation Framework

The proposed Financial Data Access Regulation framework is a legislative proposal introduced by the European Commission to address emerging challenges in the EU financial sector and provide a harmonised European response to them. The FIDA proposal is part of the European Commission’s wider European Finance Strategy ¹⁸ and European Data Strategy, ¹⁹ based on the foundations of the Data Governance Act, ²⁰ the Digital Markets Act, ²¹ and the Data Act. ²² The Commission hopes that the FIDA proposal fosters greater innovation in financial products and services, thereby enhancing the array of options available to consumers. ²³ Additionally, they anticipate that it increases competition within the financial sector, promoting a more dynamic and responsive marketplace. ²⁴ According to the European Commission, the FIDA proposal aims to achieve these goals by establishing a framework that facilitates data-driven finance by enabling efficient access and sharing of financial data while ensuring high privacy, security, safety, and ethical standards. ²⁵ The legislative proposal for the FIDA framework is thus driven by the European Commission’s commitment to fostering a data-driven economy. The proposal seeks to empower customers by providing better control over access to their financial data with the objective of enhancing economic outcomes for financial services customers and firms, allowing for personalised, data-powered products and services and creating new business opportunities for data-driven third-party service providers. ²⁶ The legislative intent is also to strike a balance between facilitating the flow and wide use of data in the financial sector while preserving robust standards for privacy, security, and risk management. ²⁷ The proposal has cleared the first reading stage in the Council, with the potential for minor adjustments as it progresses through the legislative process. ²⁸

The proposed FIDA framework ultimately concerns accessing, sharing, and using customers’ financial data, including natural or legal persons. ²⁹ Its scope is narrowed down to particular categories of customer data in Article 2, including mortgage credit agreements ³⁰ and non-life insurance products. ³¹ The FIDA proposal would also apply to other institutions that act as data holders or users, including e.g. credit institutions ³² and crypto-asset service providers. ³³

Concerning data access, the data holder must make specific data available to the customer upon the customer’s request. ³⁴ This includes continuously providing the data without undue delay, free of charge, and in real-time. ³⁵ The data holder must make customer data available to a data user based on the customer’s permission. ³⁶ Compensation may be claimed by the data holder from a data user only under specific conditions, such as compliance with financial data sharing scheme rules or other specified circumstances. ³⁷ Additionally, when making data available, the data holder must ensure the use of recognised standards, ³⁸ communicate securely with the data user, ³⁹ verify customer permissions, ⁴⁰ provide a permission dashboard to the customer, ⁴¹ and respect confidentiality and intellectual property rights. ⁴² The FIDA proposal outlines further obligations on data users. Data users can access customer data if they are authorised as a financial institution or financial information service provider by a competent authority. ⁴³ Data users can only access customer data for the specified purposes and conditions granted by the customer, and they must delete it when no longer necessary. ⁴⁴ Further to that, the FIDA proposal grants customers the right to withdraw their permission, especially in contractual obligations. ⁴⁵

Another duty is that data users must process customer data only for the explicitly requested service, ⁴⁶ implement security measures, ⁴⁷ respect confidentiality and intellectual property rights, ⁴⁸ prevent unlawful transfer or access to non-personal customer data, ⁴⁹ and refrain from processing customer data for advertising purposes unless allowed by EU and national law. ⁵⁰ If data users are part of a group of companies, customer data is limited to the entity acting as the data user within the group. ⁵¹ Further responsible data use is ensured by the data use perimeter ⁵² and the Financial Data Access permission dashboards. ⁵³ The FIDA proposal would thus significantly open data access while protecting the relevant interests of data customers, holders, and users. Customers would have a variety of choices to customise their experience in the dashboard:

‘A permission dashboard shall:

1. a) provide the customer with an overview of each ongoing permission given to data users, including:

   1. (i) the name of the data user to which access has been granted

   2. (ii) the customer account, financial product or financial service to which access has been granted;

   3. (iii) the purpose of the permission;

   4. (iv) the categories of data being shared;

   5. (v) the period of validity of the permission

2. b) allow the customer to withdraw a permission given to a data user;

3. c) allow the customer to re-establish any permission withdrawn;

4. d) include a record of perm’ ⁵⁴

To facilitate data sharing, the FIDA proposal would establish financial data sharing schemes. It outlines that within 18 months of the FIDA proposal’s entry into force, data holders and users must become members of one or multiple financial data-sharing schemes. ⁵⁵ The proposal also outlines how such schemes should look like, namely it must include members representing a significant market share with fair and equal representation in decision-making processes as well as customer and consumer associations. ⁵⁶ Several provisions in Article 10 govern the exact procedural and substantive rules that govern such schemes, including dispute resolution. ⁵⁷ The Commission might intervene on the absence of a financial data sharing scheme for specific categories of customer data listed in Article 2(1) of the FIDA proposal. ⁵⁸

The FIDA proposal also outlines eligibility requirements for data access and organisation. Article 12 of the proposed FIDA proposal outlines the process for financial information service providers to obtain authorisation to access customer data, requiring them to submit a detailed set of documents and hold professional indemnity insurance. The proposal also covers the granting and potential withdrawal of authorisations, considering compliance, conditions for third-country providers, and the role of competent authorities in overseeing outsourcing arrangements. ⁵⁹ To facilitate this, Article 15 outlines the establishment of a central register by the European Banking Authority, containing information on authorised providers, their intentions, and financial data-sharing schemes. ⁶⁰ It outlines organisational requirements for financial information service providers, including policies for compliance, continuity, and risk management. ⁶¹ The framework would thus allow for cross-border access to data by financial information service providers. ⁶²

Finally, the proposed FIDA framework establishes a sophisticated supervision framework. It establishes competent authorities in Member States responsible for ensuring compliance with the Regulation, with the obligation to notify the Commission of these authorities and ensure they possess necessary powers and resources. ⁶³ Several investigatory powers would be transferred to the competent authorities, including the ability to require information, conduct investigations, and take various measures to address breaches. ⁶⁴ Articles 19 and 20 allow for settlement agreements, expedited enforcement procedures, and the imposition of administrative penalties, respectively, with detailed provisions on the types and levels of penalties. ⁶⁵ The FIDA proposal would safeguard fundamental rights by granting the right of appeal against decisions of competent authorities. ⁶⁶ In addition, while the proposed FIDA framework would foster cooperation and information exchange between competent authorities, ⁶⁷ they must ensure data protection. ⁶⁸

The proposed FIDA framework would notably harmonise and propel data access within the EU, facilitating the personalisation of current financial products and services and potentially fostering the emergence of new ones. It is poised to emerge as a cornerstone initiative in Open Finance, promoting decentralised control over data rather than centralisation. Some scholars have generally characterised Open Finance as antitrust, arguing that data-centric enterprises leverage their large datasets and tend to monopolise market share. ⁶⁹ The FIDA proposal could thus serve as a potential remedy to address such tendencies, offering a path towards greater competition. Another noteworthy aspect of FIDA is its focus on the intersection of tech resilience – connected to DORA – financial regulation, and data protection, which is crucial for ensuring a robust, secure, and compliant financial ecosystem in the EU.

III. Financial Data Access, Data Protection, and Automated Decision-Making

Automated decision-making, utilised by data users, holders, and supervising authorities, is rapidly advancing within the context of European financial law. As generative AI technologies advance, ADM increasingly utilises software to support or replace human decision-making processes, leveraging the abundance of data available in the technology age. This is especially used in European financial law, where the 2008 financial crisis resulted in further data reporting requirements, for instance, to monitor compliance, ⁷⁰ mostly in real-time. ⁷¹ This section delves into the intricate relationship between the FIDA proposal, data protection, and automated decision-making, examining its implications and regulatory elements.

The Data Protection Directive of 1995 contained some of the first rules on ADM, prohibiting the use of solely automated decision-making in individual cases without human involvement. ⁷² The right to data protection is a fundamental human right protected by Article 8(1) of the European Convention on Human Rights, Article 8(1) of the EU Charter of Fundamental Rights, and Article 16(1) of the Treaty on the Functioning of the European Union. ⁷³ It is thus no surprise that the GDPR took on the restrictive approach in the Data Protection Directive. ⁷⁴ However, the GDPR outlines exceptions in Article 22:

1. a) ‘is necessary for entering into, or performance of, a contract between the data subject and a data controller;

2. b) is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests; or

3. c) is based on the data subject’s explicit consent.’

Decisions by the EU and national data protection authorities suggest that the prohibition applies to very few circumstances. ⁷⁵ Nevertheless, the GDPR duties apply to private and public bodies, ⁷⁶ including data holders, users, and supervising authorities under the FIDA proposal. ⁷⁷ The Court of Justice also clarified that calculating a credit score constitutes an automated individual decision under Article 22(1) of the GDPR. ⁷⁸

Additionally, the GDPR introduced other duties, including an obligation to ensure data protection through the design of technology, so-called privacy by design. ⁷⁹ The FIDA proposal requires such a design feature, for instance, in the permission dashboard. ⁸⁰ The GDPR sets forth stringent requirements for data processing, including provisions related to automated decision-making and profiling (Aarticle 22). Financial institutions must ensure that their automated decision-making processes comply with the principles of fairness, transparency, and accountability enshrined in the GDPR. ⁸¹ Moreover, individuals have rights under the GDPR to access, rectify, and object to automated decisions that significantly affect them. ⁸² The AI Act will further restrict the use of certain ADM mechanisms that deploy “high risk” AI systems. ⁸³ Profiling AI systems are always considered “high risk,” ⁸⁴ and it is thus inevitable that AI systems need a number of safeguards like transparency and audits. ⁸⁵

If customers choose to share their data with data holders and users by granting permission in the dashboard, their data will be utilised for personalised products and services. The Commission highlights several use cases, such as personalised investment advice and automated creditworthiness assessments for SMEs. ⁸⁶ Financial institutions may deploy ADM to assess the needs and opportunities of customers, leveraging data analytics and machine learning algorithms to gain deeper insights into customer behaviour to personalise marketing, services, and products or identify risks like fraud. ⁸⁷ Furthermore, as pointed out in the previous section, the FIDA proposal does not apply to all kind of data but it is limited to an exhaustive list of industries and products. ⁸⁸ It also provides customers with a choice on whether and how much data they want to share, including the option to withdraw it. ⁸⁹ In any case, data holders and users must ensure that they do not use the data contrary to Article 9(1) of the GDPR, dealing with processing sensitive information like ethnic origin or religious beliefs, which could be deduced from transaction activities, and lead to unwanted consequences like price discrimination. ⁹⁰ Customers also have a right to be informed under Articles 13 and 14 of the GDPR and to receive information about the existence ADM under Article 15 of the GDPR, which includes profiling. ⁹¹

The FIDA proposal also requires an automated transmission of data to regulators. Article 15 establishes a central register by the European Banking Authority containing information on authorised providers and their intentions. The provision for establishing such a register implies the need for computerised systems to manage and maintain this information efficiently. Furthermore, Title VI of the FIDA proposal pertains to the supervision and enforcement framework of the FIDA proposal, including the powers of competent authorities to investigate breaches and impose penalties. The investigatory powers granted to competent authorities will most likely involve scrutiny of automated decision-making processes to ensure compliance of data holders and users with the FIDA regulation. ⁹² Both maintaining the register and ensuring compliance of supervised entities must align with the GDPR. Regarding the data of natural persons, EU regulators must also ensure they comply with the EDPR. ⁹³

In summary, the integration of automated decision-making into financial data access marks a substantial advancement in European financial law. While it presents opportunities for efficiency and innovation, it also introduces intricate challenges related to data protection, fairness, and accountability. Regulatory interventions like the FIDA proposal are pivotal in overseeing the implementation of automated systems, safeguarding consumer rights, and industry interests. Looking ahead, it is imperative for policymakers, regulators, and industry stakeholders to collaborate continuously in evolving the framework within the swiftly changing technological terrain.

IV. Policy Considerations

The FIDA proposal ambitiously addresses the intersections of tech resilience, financial regulation, and data protection. While the FIDA proposal offers benefits to customers and financial firms, it also presents several shortcomings. For instance, the European Economic and Social Committee (EESC), the European Commission’s Regulatory Scrutiny Board, and BEUC have already highlighted various contentious points within the FIDA proposal.

The primary and foremost critique directed at the FIDA proposal revolves around its inadequate evidential support and integration of consumer protection theories. ⁹⁴ The Commission’s call for evidence garnered minimal engagement, receiving a mere seventy-nine responses. ⁹⁵ While the majority of these responses were from citizens (fifty-seven), contributions also stemmed from trade associations (fourteen), businesses (three), consumer organisations (one), unions (one), and other entities (three). Geographically, the bulk of the responses originated from Slovakia (twenty-four), Germany (twenty-two), and Belgium (eight). According to the impact assessment, citizen responses generally conveyed a negative sentiment towards Open Finance and those from businesses exhibited a more positive outlook. The public consultation attracted slightly more feedback with fifty-five citizens and thirty-seven professional responses. ⁹⁶ Citizens highlighted their concerns about privacy and data protection. Professionals were more optimistic in the consultation, highlighting the benefits of innovation and competition for customers. The Commission’s cost/benefit analysis is positive, although it is difficult to quantify the estimated impact. ⁹⁷

The European Commission’s Regulatory Scrutiny Board also expressed criticism regarding the impact assessment. ⁹⁸ They contended that the assessment places excessive reliance on stakeholder feedback, urging for the inclusion of insights from initiatives in different jurisdictions. Additionally, the European Commission’s Regulatory Scrutiny Board highlighted the ambiguity surrounding the existence of customer demand for new financial services and products, emphasising the absence of concrete examples of innovation. The European Commission should thus conduct further research on the potential impact of the FIDA proposal.

Another concern relates to data protection. While data minimisation in accordance with the GDPR appears to be adhered to, ⁹⁹ some actors point out that more could be done. BEUC, a consumer organisation, emphasises the importance of including only financially relevant data and excluding profiling activities, as both could lead to a high risk of exclusion. ¹⁰⁰ Furthermore, BEUC suggests that data perimeters should be binding and cover additional areas such as retail banking and insurance products, which also pose a high risk of exclusion. ¹⁰¹ The European Economic and Social Committee (EESC) also proposes refinements concerning data minimisation ¹⁰² and raises further considerations. Regarding customer data categories, the EESC notes a persistent risk of “misuse and illegitimate interference.” ¹⁰³ Consequently, the EESC recommends proper training for staff, ¹⁰⁴ additional bans on the use of personal data within the FIDA proposal, ¹⁰⁵ and ensuring that data holders refrain from restrictive practices concerning the dashboards that provide customers with consent and transparency. ¹⁰⁶ The sentiment regarding dashboards is also emphasised by BEUC, which underscores the importance of ensuring easy accessibility to dashboards. ¹⁰⁷ Moreover, BEUC emphasises that dashboard design and the information presented must comply with data protection and consumer law rules. ¹⁰⁸ The European Commission’s Regulatory Scrutiny Board further highlighted that it is unclear how the FIDA proposal would protect vulnerable customers and ensure customers are not pressured into data sharing. ¹⁰⁹ The intricate nature of utilising ADM AI mechanisms necessitates experience requirements, which the FIDA proposal should mandate for both data holders and users. ¹¹⁰

In addition to the previous concerns, the European Economic and Social Committee suggests that there might be an imbalance in the regulatory environment between heavily regulated financial institutions and other participants in the market. ¹¹¹ This is also debated by BEUC. ¹¹² On the one hand, BEUC emphasises the potential benefits of the proposal’s introduction of Financial Information Service Providers (FISPs), which could offer tailored and innovative solutions to consumers, enhancing competition and consumer outcomes in Open Finance. One the other hand, BEUC cautions against the risks associated with financial data sharing, particularly the possibility of exploitation by powerful companies. They advocate for clear delineation of the role of FISPs and propose that entities designated as gatekeepers under the Digital Markets Act should be barred from accessing data under Open Finance to mitigate these risks. The impact assessment, and potentially the FIDA proposal, should consider this power imbalance and aim to rectify it.

There are also deficiencies concerning supervision and enforcement within the proposed framework. Specifically, the European Economic and Social Committee emphasises the necessity for the European Banking Authority and the European Insurance and Occupational Pensions Authority to receive a clear mandate for developing guidelines regarding the processing of consumer data. These guidelines would pertain to various financial products and services, including credit level assessment and risk evaluation for consumers, as well as life, health, and sickness insurance products. ¹¹³ Regarding the enforcement of consumer rights, the FIDA proposal would allow individuals to seek compensation when their rights are violated, ¹¹⁴ and entities found responsible for such violations could face administrative penalties imposed by the Competent Authority. ¹¹⁵ One criticism highlighted by BEUC is that it should be incorporated into the Annex of the Representative Actions Directive. ¹¹⁶ The legislators should take these concerns seriously and carefully assess whether to take them on board during the legislative process.

BEUC further emphasises that data users, data holders, consumer organisations, and consumer associations must collaborate to establish data sharing schemes, where the content and governance will be determined by scheme members themselves. ¹¹⁷ While BEUC appreciates the inclusion of consumer representation, they urge policymakers to ensure a balanced representation, emphasising that consumer presence should not merely serve to legitimise financial data sharing schemes. They thus argue that customer organisations and consumer associations should be granted full voting rights within these schemes. Additionally, the European Commission’s Regulatory Scrutiny Board recommends that the FIDA proposal report provides a clearer description of the intended compensation measures, including the governance model and the methodology for calculating “reasonable compensation.” ¹¹⁸ Furthermore, it should address how compensation measures will not impede innovative open finance services and how the risk of anticompetitive effects resulting from data reuse will be mitigated.

Another point to consider is the time to implement the measure. ¹¹⁹ The EESC highlighted that the 18-month period for technical features should be prolonged by another six months. ¹²⁰ Industry associations, like the Association of the Luxembourg Fund Industry, equally pointed out that the anticipated timeframe is unrealistic. ¹²¹ The Commission should thus assess whether this timeline is realistic and feasible.

The critique of the FIDA proposal is warranted, particularly due to the absence of evidence or consumer theories in the impact assessment. The FIDA proposal must heed all the outlined concerns as certain aspects necessitate additional refinement for it to succeed, ensuring a delicate balance between innovation and consumer protection, particularly regarding automated decision-making. Overall, the FIDA proposal took some principles proposed by the academic community into account, without directly listing them in the impact assessments. ¹²² The concentration of power by digital platforms will potentially be remedied by FIDA, serving as antitrust and strengthening consumer choice. However, as previously mentioned, the European Commission should have initiated a broader public discourse and justified its legislative choices with scientific evidence. It is hoped that the European Commission will employ an evidence-based approach when assessing the ex-post impact of FIDA on the financial industry and consumer protection. ¹²³

V. Conclusion

This article has scrutinised the intricate landscape surrounding financial data access and automated decision-making in the European Union, focusing on the proposed Financial Data Access Regulation. It has highlighted the critical necessity of regulating financial data access and ADM within the EU’s legal framework, especially in a digital era marked by a rapid influx of financial data. The FIDA proposal signifies a significant stride towards tackling these challenges, aiming to balance innovation with consumer rights and business interests.

As pointed out, a noteworthy aspect of FIDA is its focus on the intersection of tech resilience – connected to DORA – financial regulation, and data protection. A key consideration regarding the FIDA proposal is thus whether it aligns more closely with the trajectory of EU financial law or primarily serves as a specialised form of data protection regulation. It seems that FIDA attempts to satisfy both perspectives without fully committing to either domain. While it is an ambitious endeavour with potential antitrust effects on digital finance platforms, mere transparency in data processing does not automatically lead to enhanced consumer protection.

Moving forward, it is imperative for the European Commission to conduct further research on the potential impacts of the FIDA proposal and to mandate experience requirements for both data holders and users engaging in such ADM systems. Additionally, there is a pressing need to address power imbalances, particularly concerning entities designated as gatekeepers under the Digital Markets Act, to ensure fair access to data under Open Finance. It is essential for legislators to take these concerns into account and integrate them into the legislative process, while also assessing the feasibility of proposed timelines. Ultimately, the FIDA proposal has the potential to fortify the FinTech sector, amplify consumer choice, and foster healthy competition. It could be seen as an antitrust measure, decentralising data access and reducing centralisation, thereby promoting a more balanced financial ecosystem. However, it is crucial to remember that the contents of the FIDA proposal are subject to potential revisions and adjustments throughout the ongoing legislative process.