report parliamentary committee draft, 13 December 2023
On the proposal for a regulation of the European Parliament and of the Council on a framework for Financial Data Access and amending Regulations (EU) No 1093/2010, (EU) No 1094/2010, (EU) No 1095/2010 and (EU) 2022/2554
Document ECON-PR-757355 · (COM(2023)0360 – C90215/2023 – 2023/0205(COD))
Committee on Economic and Monetary Affairs · Rapporteur: Michiel Hoogeveen
AI:In short
This is the rapporteur's draft report on the Commission proposal for a regulation on a framework for Financial Data Access (FiDA). It proposes amendments to the Commission text, including changes to recitals and articles. The draft report aims to strengthen customer control over financial data, align FiDA with the General Data Protection Regulation (GDPR) and the Data Act, and prevent gatekeepers under the Digital Markets Act from accessing data. It also proposes to exclude third-country providers from authorisation as financial information service providers, to enhance the role of the European Supervisory Authorities, and to introduce requirements for permission dashboards and compensation.
Position. The rapporteur welcomes the FiDA proposal and supports its objectives, but proposes amendments to enhance customer trust, promote innovation, and improve interoperability and supervision, including aligning with the GDPR and the Data Act and strengthening the role of the European Supervisory Authorities.
Key points
- Emphasises that customers keep ownership of their financial data and that access should be secure.
- Clarifies that FiDA should enable customers to access and re-use their data, and the financial sector to offer services based on that data.
- Excludes data related to sickness and health insurance, life insurance, and occupational pension schemes from the scope, and requires respect for trade secrets.
- Requires explicit customer permission for data access, prohibits gatekeepers from being data users, and mandates that data use be in the best interest of the customer.
- Introduces new definitions for 'financial information service', 'financial service', 'crowdfunding service provider', and 'trade secret'.
- Obliges data holders to provide data to customers via online or mobile interfaces, free of charge and in real-time.
- Requires data users to protect trade secrets, not transfer data without explicit permission, and not use data for direct marketing without consent.
- Mandates the European Supervisory Authorities to develop regulatory technical standards on credit scoring, risk assessment, and pricing for insurance products.
- Prohibits denying consumers access to financial products solely for refusing to give data access permission.
- Requires permission dashboards to be easily accessible, allow withdrawal and re-establishment of permissions, and not unduly influence customers.
- Tasks the European Supervisory Authorities with assessing financial data access schemes and maintaining a public register.
- Requires the European Supervisory Authorities to present an annual joint report on the application of the regulation.
Who is affected
- Customers of financial institutions, who gain rights to access and control their financial data.
- Financial institutions acting as data holders, required to provide data access and permission dashboards.
- Financial information service providers, subject to authorisation and obligations.
- Gatekeepers under the Digital Markets Act, prohibited from accessing data under FiDA.
- Third-country providers, excluded from authorisation as financial information service providers.
Figures and deadlines
- Initial capital of EUR 50 000 for financial information service providers as an alternative to professional indemnity insurance.
- Permission dashboard should include a record of withdrawn or expired permissions for a period of up to two years.
- Competent authority shall inform the applicant whether authorisation is granted or refused within 3 months of receipt of a complete application.
- Authorisation lapses if not used within 12 months or if business ceased for more than 6 months.
Legal basis. Article 294(2) and Article 114 of the Treaty on the Functioning of the European Union.
Written by AI from the full text · every figure comes from the text · ¶ opens the paragraph · 25 Sept 2026 · Report a problem
Full text
Jump to an amendment (155)
- Amendment 1
- Amendment 2
- Amendment 3
- Amendment 4
- Amendment 5
- Amendment 6
- Amendment 7
- Amendment 8
- Amendment 9
- Amendment 10
- Amendment 11
- Amendment 12
- Amendment 13
- Amendment 14
- Amendment 15
- Amendment 16
- Amendment 17
- Amendment 18
- Amendment 19
- Amendment 20
- Amendment 21
- Amendment 22
- Amendment 23
- Amendment 24
- Amendment 25
- Amendment 26
- Amendment 27
- Amendment 28
- Amendment 29
- Amendment 30
- Amendment 31
- Amendment 32
- Amendment 33
- Amendment 34
- Amendment 35
- Amendment 36
- Amendment 37
- Amendment 38
- Amendment 39
- Amendment 40
- Amendment 41
- Amendment 42
- Amendment 43
- Amendment 44
- Amendment 45
- Amendment 46
- Amendment 47
- Amendment 48
- Amendment 49
- Amendment 50
- Amendment 51
- Amendment 52
- Amendment 53
- Amendment 54
- Amendment 55
- Amendment 56
- Amendment 57
- Amendment 58
- Amendment 59
- Amendment 60
- Amendment 61
- Amendment 62
- Amendment 63
- Amendment 64
- Amendment 65
- Amendment 66
- Amendment 67
- Amendment 68
- Amendment 69
- Amendment 70
- Amendment 71
- Amendment 72
- Amendment 73
- Amendment 74
- Amendment 75
- Amendment 76
- Amendment 77
- Amendment 78
- Amendment 79
- Amendment 80
- Amendment 81
- Amendment 82
- Amendment 83
- Amendment 84
- Amendment 85
- Amendment 86
- Amendment 87
- Amendment 88
- Amendment 89
- Amendment 90
- Amendment 91
- Amendment 92
- Amendment 93
- Amendment 94
- Amendment 95
- Amendment 96
- Amendment 97
- Amendment 98
- Amendment 99
- Amendment 100
- Amendment 101
- Amendment 102
- Amendment 103
- Amendment 104
- Amendment 105
- Amendment 106
- Amendment 107
- Amendment 108
- Amendment 109
- Amendment 110
- Amendment 111
- Amendment 112
- Amendment 113
- Amendment 114
- Amendment 115
- Amendment 116
- Amendment 117
- Amendment 118
- Amendment 119
- Amendment 120
- Amendment 121
- Amendment 122
- Amendment 123
- Amendment 124
- Amendment 125
- Amendment 126
- Amendment 127
- Amendment 128
- Amendment 129
- Amendment 130
- Amendment 131
- Amendment 132
- Amendment 133
- Amendment 134
- Amendment 135
- Amendment 136
- Amendment 137
- Amendment 138
- Amendment 139
- Amendment 140
- Amendment 141
- Amendment 142
- Amendment 143
- Amendment 144
- Amendment 145
- Amendment 146
- Amendment 147
- Amendment 148
- Amendment 149
- Amendment 150
- Amendment 151
- Amendment 152
- Amendment 153
- Amendment 154
- Amendment 155
Draft european parliament legislative resolution 1,096 paragraphs
(COM(2023)0360 – C90215/2023 – 2023/0205(COD))
(Ordinary legislative procedure: first reading)
The European Parliament,
–having regard to the Commission proposal to Parliament and the Council (COM(2023)0360),
–having regard to Article 294(2) and Article 114 of the Treaty on the Functioning of the European Union, pursuant to which the Commission submitted the proposal to Parliament (C90215/2023),
–having regard to Article 294(3) of the Treaty on the Functioning of the European Union,
–having regard to Rule 59 of its Rules of Procedure,
–having regard to the report of the Committee on Economic and Monetary Affairs (A90000/2023),
1.Adopts its position at first reading hereinafter set out;
2.Calls on the Commission to refer the matter to Parliament again if it replaces, substantially amends or intends to substantially amend its proposal;
3.Instructs its President to forward its position to the Council, the Commission and the national parliaments.
Amendment 1
Read the rest (1,084 paragraphs)
Proposal for a regulation
Recital 2
| Text proposed by the Commission | Amendment |
|---|---|
| (2) Customers of financial institutions, both consumers and firms, should have effective control over their financial data and the opportunity to benefit from open, fair, and safe data-driven innovation in the financial sector. Those customers should be empowered to decide how and by whom their financial data is used and should have the option to grant firms access to their data for the purposes of obtaining financial and information services should they wish. | (2) Customers of financial institutions, both consumers and firms, should have effective ownership and control over their financial data and the opportunity to benefit from open, fair, and safe data-driven innovation in the financial sector. Those customers should be empowered to decide how and by whom their financial data is used and should have the option to grant firms secure access to their data for the purposes of obtaining financial and information services should they wish. |
Or. en
Justification
It is suggested to emphasise that customers keep ownership of their financial data, and that financial data access should be secure.
Amendment 2
Proposal for a regulation
Recital 3
| Text proposed by the Commission | Amendment |
|---|---|
| (3) The Union has a stated policy interest in enabling access of customers of financial institutions to their financial data. The Commission confirmed in its communication on a digital finance strategy and Communication on a capital markets union adopted in 2021 an intention to put in place a framework for financial data access to reap the benefits for customers of data sharing in the financial sector. Such benefits include the development and provision of data-driven financial products and financial services, made possible by the sharing of customer data. | (3) The Union has a stated policy interest in enabling access of customers of financial institutions to their financial data. The Commission confirmed in its communication on a digital finance strategy and Communication on a capital markets union adopted in 2021 an intention to put in place a framework for financial data access to reap the benefits for customers of unlocking their data in the financial sector. Such benefits include the development and provision by the financial sector of data-driven financial products and financial services, made possible by the re-use of customer data. By creating synergies with data from other relevant sectors, the innovative potential of such financial products and financial services could be further enhanced to the benefit of customers and the overall data economy. |
Or. en
Justification
It is suggested to use language that focuses more clearly on establishing data access rights for consumers and business customers. FiDA should first and foremost enable customers to take control over their data so that they can access and re-use it as they see fit. Furthermore, is is suggested to clarify that FiDA enables the financial sector to offer financial services and products on the basis of the accessed data.
Amendment 3
Proposal for a regulation
Recital 4
| Text proposed by the Commission | Amendment |
|---|---|
| (4) Within financial services, and as a result of the revised Directive (EU) 2015/2366 of the European Parliament and of the Council7 , the sharing of payments account data in the Union based on customer permission has begun to transform the way consumers and businesses use banking services. In order to build upon the measures in that Directive, a regulatory framework should be established for the sharing of customer data across the financial sector beyond payment account data. This should also be a building block for fully integrating the financial sector into the Commission’s strategy for data8 which promotes data sharing across sectors. | (4) Within financial services, and as a result of the revised Directive (EU) 2015/2366 of the European Parliament and of the Council7 , the access of payments account data in the Union based on customer permission has begun to transform the way consumers and businesses use banking services. In order to build upon the measures in that Directive, a regulatory framework should be established for the access of customer data across the financial sector beyond payment account data. This should also be a building block for fully integrating the financial sector into the Commission’s strategy for data8 which promotes data access across sectors. |
| 7 Directive (EU) 2015/2366 of the European Parliament and of the Council of 25 November 2015 on payment services in the internal market, amending Directive 2002/65/EC, 2009/110/EC and 2013/36/EU and Regulation (EU) No 1093/2010, and repealing Directive 2007/64/EC (OJ L 337, 23.12.2015, p. 35). | 7 Directive (EU) 2015/2366 of the European Parliament and of the Council of 25 November 2015 on payment services in the internal market, amending Directive 2002/65/EC, 2009/110/EC and 2013/36/EU and Regulation (EU) No 1093/2010, and repealing Directive 2007/64/EC (OJ L 337, 23.12.2015, p. 35). |
| 8 https://eur-lex.europa.eu/legal-content/EN/TXT/?qid=1593073685620&uri=CELEX%3A52020DC0066 | 8 https://eur-lex.europa.eu/legal-content/EN/TXT/?qid=1593073685620&uri=CELEX%3A52020DC0066 |
Or. en
Justification
It is suggested to use language that focuses more clearly on establishing data access rights for consumers and business customers. FiDA should first and foremost enable customers to take control over their data so that they can access and re-use it as they see fit.
Amendment 4
Proposal for a regulation
Recital 5
| Text proposed by the Commission | Amendment |
|---|---|
| (5) Ensuring customer control and trust is imperative to build a well-functioning and effective data sharing framework in the financial sector. Ensuring effective customers’ control over data sharing contributes to innovation as well as customer confidence and trust in data sharing. As a result, effective control helps overcome customer reluctance to share their data. Under the current Union framework, the data portability right of a data subject in accordance with the Regulation (EU) 2016/679 of the European Parliament and of the Council9 is limited to personal data and can be relied upon only where it is technically feasible to port the data. Customer data and technical interfaces in the financial sector beyond payment accounts are not standardised, rendering data sharing more costly. Further, the financial institutions are only legally obliged to make the payment data of their customers available. | (5) Ensuring customer control and trust is imperative to build a well-functioning and effective data access framework in the financial sector. Ensuring effective customers’ control over their data contributes to innovation as well as customer confidence and trust in using alternative service providers. As a result, effective control helps overcome customer reluctance to re-use their data. Under the current Union framework, the data portability right of a data subject in accordance with the Regulation (EU) 2016/679 of the European Parliament and of the Council9 is limited to personal data and can be relied upon only where it is technically feasible to port the data. Customer data and technical interfaces in the financial sector beyond payment accounts are not standardised, rendering data access more costly. Further, the financial institutions are only legally obliged to make the payment data of their customers available. |
| 9 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1). | 9 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1). |
Or. en
Justification
It is suggested to use language that focuses more clearly on establishing data access rights for consumers and business customers. FiDA should first and foremost enable customers to take control over their data so that they can access and re-use it as they see fit.
Amendment 5
Proposal for a regulation
Recital 6
| Text proposed by the Commission | Amendment |
|---|---|
| (6) The Union’s financial data economy therefore remains fragmented, characterised by uneven data sharing, barriers, and high stakeholder reluctance to engage in data sharing beyond payments accounts. Customers accordingly do not benefit from individualised, data-driven products and services that may fit their specific needs. The absence of personalised financial products limits the possibility to innovate, by offering more choice and financial products and services for interested consumers who could otherwise benefit from data-driven tools that can support them to make informed choices, compare offerings in a user-friendly manner, and switch to more advantageous products that match their preferences based on their data. The existing barriers to business data sharing are preventing firms, in particular SMEs, to benefit from better, convenient and automated financial services. | (6) The Union’s financial data economy therefore remains fragmented, characterised by uneven data access, barriers, and high stakeholder reluctance to engage in unlocking and re-using data beyond payments accounts. Customers accordingly do not benefit from individualised, data-driven products and services that may fit their specific needs. The absence of personalised financial products limits the possibility to innovate, by offering more choice and financial products and services for interested consumers who could otherwise benefit from data-driven tools that can support them to make informed choices, compare offerings in a user-friendly manner, and switch to more advantageous products that match their preferences based on their data. The existing barriers to business data re-use are preventing firms, in particular small and medium-sized enterprises (SMEs), to benefit from better, convenient and automated financial services. |
Or. en
Justification
It is suggested to use language that focuses more clearly on establishing data access rights for consumers and business customers. FiDA should first and foremost enable customers to take control over their data so that they can access and re-use it as they see fit. Furthermore, introduction of the abbreviation "SME".
Amendment 6
Proposal for a regulation
Recital 7
| Text proposed by the Commission | Amendment |
|---|---|
| (7) Making data available by way of high-quality application programming interfaces is essential to facilitate seamless and effective access to data. Beyond the area of payment accounts, however, only a minority of financial institutions that are data holders indicate that they make data available through technical interfaces like application programming interfaces. As incentives to develop such innovative services are absent, market demand for data access remains limited. | (7) Making data available by way of high-quality technical interfaces like application programming interfaces is essential to facilitate seamless and effective access to data. Beyond the area of payment accounts, however, only a minority of financial institutions that are data holders indicate that they make data available through technical interfaces like application programming interfaces. As incentives to develop such innovative services are absent, market demand for data access remains limited. |
Or. en
Justification
To not be specific on the technology used (APIs are obviously the most prevalent form to date), it is suggested to use the same wording as in the second sentence of the recital.
Amendment 7
Proposal for a regulation
Recital 9
| Text proposed by the Commission | Amendment |
|---|---|
| (9) The data included in the scope of this Regulation should demonstrate high value added for financial innovation as well as low financial exclusion risk for consumers. This Regulation should therefore not cover data related to the sickness and health insurance of a consumer in accordance with Directive 2009/138/EC of the European Parliament and of the Council10 as well as data on life insurance products of a consumer in accordance with Directive 2009/138/EC other than life insurance contracts covered by insurance-based investment products. This Regulation should also not cover data collected as part of a creditworthiness assessment of a consumer. The sharing of customer data in the scope of this Regulation should respect the protection of confidential business data and trade secrets. | (9) The data included in the scope of this Regulation should demonstrate high value added for financial innovation as well as low financial exclusion risk for consumers. This Regulation should therefore not cover data related to the sickness and health insurance of a consumer in accordance with Directive 2009/138/EC of the European Parliament and of the Council10 as well as data on life insurance products of a consumer in accordance with Directive 2009/138/EC other than life insurance contracts covered by insurance-based investment products. This Regulation should not cover data related to sickness and health cover of a member or beneficiary in accordance with Directive 2016/234110a. This Regulation should also not cover data collected as part of a creditworthiness assessment of a consumer. The access and use of customer data in the scope of this Regulation should respect the protection of confidential business data and trade secrets in accordance with Directive (EU) 2016/94310b, including mathematical and methodological approaches. |
| 10 Directive 2009/138/EC of the European Parliament and of the Council of 25 November 2009 on the taking-up and pursuit of the business of Insurance and Reinsurance (Solvency II) (recast) (OJ L 335, 17.12.2009, p. 1). | 10 Directive 2009/138/EC of the European Parliament and of the Council of 25 November 2009 on the taking-up and pursuit of the business of Insurance and Reinsurance (Solvency II) (recast) (OJ L 335, 17.12.2009, p. 1). |
| 10a Directive (EU) 2016/2341 of the European Parliament and of the Council of 14 December 2016 on the activities and supervision of institutions for occupational retirement provision (IORPs) (OJ L 354, 23.12.2016, p. 37). | |
| 10b Directive (EU) 2016/943 of the European Parliament and of the Council of 8 June 2016 on the protection of undisclosed know-how and business information (trade secrets) against their unlawful acquisition, use and disclosure (OJ L 157, 15.6.2016, p. 1). |
Or. en
Justification
IORPs can also provide for benefits that cover sickness and health risks and are comparable to sickness and health insurance. As the financial exclusion risks are similar, it is suggested to also exclude such data from the scope of FiDA. See also the comments made in this regard by the EDPS in its opinion (point 13). Furthermore, it is suggested to include a reference to the Directive on the Protection of Trade Secrets.
Amendment 8
Proposal for a regulation
Recital 9 a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (9a) For the purpose of the provision of financial services and product in scope of this Regulation, data holders and data users should comply with existing Union rules and guidelines regarding the access to and use of personal data. This includes the rules applicable to carrying out consumer creditworthiness assessments as laid down in Directive [XXXX/XXXX] of the European Parliament and of the Council1a (Consumer Credits Directive) and Directive 2014/17/EU of the European Parliament and of the Council1b (Mortgage Credit Directive), or the duty of investment firms to act in the best interest of the customer when carrying out suitability assessments. | |
| 1a COM(2021)0347. | |
| 1b Directive 2014/17/EU of the European Parliament and of the Council of 4 February 2014 on credit agreements for consumers relating to residential immovable property and amending Directives 2008/48/EC and 2013/36/EU and Regulation (EU) No 1093/2010 (OJ L 60, 28.2.2014, p. 34). |
Or. en
Justification
As recommended by the EDPS in its opinion (point 29), it is worth recalling the existence of sector-specific legislation and guidelines applicable to the eligible entities listed in Article 2(2), including legislation that applies to consumer credits.
Amendment 9
Proposal for a regulation
Recital 10
| Text proposed by the Commission | Amendment |
|---|---|
| (10) The sharing of the customer data in the scope of this Regulation should be based on the permission of the customer. The legal obligation on data holders to share customer data should be triggered once the customer has requested their data to be shared with a data user. This request can be submitted by a data user acting on behalf of the customer. Where the processing of personal data is involved, a data user should have a valid lawful basis for processing under Regulation (EU) 2016/679. The customers data can be processed for the agreed purposes in the context of the service provided. The processing of personal data must respect the principles of personal data protection, including lawfulness, fairness and transparency, purpose limitation and data minimisation. A customer has the right to withdraw the permission given to a data user. When data processing is necessary for the performance of a contract, a customer should be able to withdraw permissions according to the contractual obligations to which the data subject is party. When personal data processing is based on consent, a data subject has the right to withdraw his or her consent at any time, as provided for in Regulation (EU) 2016/679. | (10) The access of customer data in the scope of this Regulation should be based on the explicit permission of the customer. Such permission should not solely be based on a “tick-the-box” approach or the use of generalising phrases. In seeking the explicit permission of the customer to use his or her data, the data users should specify what use they intend to make of the customer’s data, should the customer provide permission. The legal obligation on data holders to enable access to customer data should be triggered once the customer has explicitly requested their data to be made accessible to a data user. The data user should be able to demonstrate how the best interest of the customer will be served and preserved. In accordance with Regulation (EU) [XXXX/XXXX] of the European Parliament of the Council1a (Data Act), an undertaking providing core platform services that has been designated as a gatekeeper under Regulation (EU) 2022/19251b cannot be eligible as data user under this Regulation. The limitation on granting access to gatekeepers would not exclude them from the market and prevent them from offering its services, as voluntary agreements between them and the data holders remain unaffected. Where the processing of personal data is involved, a data user should rely on one of the valid lawful bases for processing under Article 6 of Regulation (EU) 2016/679. The customers data can be processed only for the agreed purposes in the context of the service provided. Under this Regulation, these purposes should be strictly limited to the provision of a financial product, a financial service or a financial information service. The processing of personal data must respect the principles of personal data protection, including lawfulness, fairness and transparency, purpose limitation and data minimisation. A customer has the right to withdraw the permission given to a data user at any time. For example, when data processing is necessary for the performance of a contract, a customer should be able to withdraw permissions according to the contractual obligations to which the data subject is party. Similarly, when personal data processing is based on consent, a data subject should be able to withdraw his or her consent at any time, as provided for in Regulation (EU) 2016/679. It should not be possible for the data user to transfer customer data to a third-party actor without this explicit permission, or even to another entity within the same group. |
| 1a Regulation (EU) 2023/... of the European Parliament and of the Council of 13 December 2023 on harmonised rules on fair access to and use of data and amending Regulation (EU) 2017/2394 and Directive (EU) 2020/1828 (Data Act) (OJ L ...). | |
| 1b Regulation (EU) 2022/1925 of the European Parliament and of the Council of 14 September 2022 on contestable and fair markets in the digital sector and amending Directives (EU) 2019/1937 and (EU) 2020/1828 (Digital Markets Act) (OJ L 265, 12.10.2022, p. 1). |
Or. en
Justification
Clarifications and suggestions: data use should always be in the best interest of the customer; access to consumer data held by data holders should be conditional; gatekeepers under the DMA should not be able to access data under FiDA; more precise references to GDPR; customer consent should be required for any transfer of data. Furthermore, point (40) of the EDPS opinion is included.
Amendment 10
Proposal for a regulation
Recital 11
| Text proposed by the Commission | Amendment |
|---|---|
| (11) Enabling customers to share their data on their current investments can encourage innovation in the provision of retail investment services. Primary data collection to complete a suitability and appropriateness assessment of a retail investor is time-intensive for a customer and constitutes a significant cost factor for advisors and distributors of investment, pension, and insurance-based investment products. The sharing of customer data on holdings of savings and investments in financial instruments including insurance-based investment products and data collected for the purposes of carrying out a suitability and appropriateness assessment can improve investment advice for consumers and has strong innovative potential, including in the development of personalised investment advice and investment management tools that can make retail investment advice more efficient. Such management tools are already being developed in the market and can develop more effectively in the context where a customer can share their investment-related data. | (11) Enabling customers to unlock and re-use their data on their current investments can encourage innovation in the provision of retail investment services. Primary data collection to complete a suitability and appropriateness assessment of a retail investor is time-intensive for a customer and constitutes a significant cost factor for advisors and distributors of investment, some types of pension, and insurance-based investment products. The re-use of customer data on holdings of savings and investments in financial instruments including insurance-based investment products and data collected for the purposes of carrying out a suitability and appropriateness assessment can improve investment advice for consumers and has strong innovative potential, including in the development of personalised investment advice and investment management tools that can make retail investment advice more efficient. Such management tools are already being developed in the market and can develop more effectively in the context where a customer can re-use their investment-related data. |
Or. en
Justification
It is suggested to use language that focuses more clearly on establishing data access rights for consumers and business customers. FiDA should first and foremost enable customers to take control over their data so that they can access and re-use it as they see fit.
Amendment 11
Proposal for a regulation
Recital 12
| Text proposed by the Commission | Amendment |
|---|---|
| (12) Customer data on balance, conditions or transaction details related to mortgages, loans and savings can enable customers to gain a better overview of their deposits and better meet their savings needs based on credit data. This Regulation should cover customer data beyond payment accounts defined in Directive (EU) 2015/2366. Credit accounts covered by a credit line which cannot be used for the execution of payment transactions to third parties should be within the scope of this Regulation. It should therefore be understood that this Regulation covers the access to the balance, conditions or transaction details related to mortgage credit agreements, loans, and savings accounts as well as the types of accounts not falling withing the scope of the Directive (EU) 2015/236611 . | (12) Customer data on balance, conditions or transaction details related to mortgages, loans and savings can enable customers to gain a better overview of their deposits and better meet their savings needs based on credit data. This Regulation should cover customer data beyond payment accounts defined in Directive (EU) 2015/236611 . This Regulation should not cover data on balance, conditions or transaction details related to accounts that can be used for the execution of payment transactions to and from a third party and that are covered by Regulation (EU) [XXXX/XXXX] of the European Parliament of the Council11a (PSR/PSD3). |
| 11 Directive (EU) 2015/2366 of the European Parliament and of the Council of 25 November 2015 on payment services in the internal market, amending Directives 2002/65/EC, 2009/110/EC and 2013/36/EU and Regulation (EU) No 1093/2010, and repealing Directive 2007/64/EC (OJ L 337 23.12.2015, p. 35). | 11 Directive (EU) 2015/2366 of the European Parliament and of the Council of 25 November 2015 on payment services in the internal market, amending Directives 2002/65/EC, 2009/110/EC and 2013/36/EU and Regulation (EU) No 1093/2010, and repealing Directive 2007/64/EC (OJ L 337 23.12.2015, p. 35). |
| 11a COM(2023)0367. |
Or. en
Justification
Payment accounts are regulated under PSD. The suggestion addition aims at ensuring legal certainty by more explicitly delineating which regime (PSD/FiDA) applies to which data set. The suggested deletion aims at signalling that such credit accounts should be covered by PSD as well, which would then enable the initiation of transactions between them by the customer. Covering them in the scope of FIDA would only allow AIS, and not customers to use PIS to transfer money between their own accounts.
Amendment 12
Proposal for a regulation
Recital 13
| Text proposed by the Commission | Amendment |
|---|---|
| (13) The customer data included in the scope of this Regulation should include sustainability-related information that should enable customers to more easily access financial services that are aligned with their sustainability preferences and sustainable finance needs, in line with the Commission’s strategy for financing the transition to a sustainable economy12 . Access to data relating to sustainability which may be contained in balance or transaction details related to a mortgage, credit, loan and savings account, as well as access to customer data relating to sustainability held by investment firms, can contribute to facilitating access to data needed to access sustainable finance or make investments into the green transition. Moreover, customer data in the scope of this Regulation should include data which forms part of a creditworthiness assessment related to firms, including small and medium sized enterprises, and which can provide greater insight into the sustainability objectives of small firms. The inclusion of data used for the creditworthiness assessment related to firms should improve access to financing and streamline the application for loans. Such data should be limited to data on firms and should not infringe intellectual property rights. | (13) The customer data included in the scope of this Regulation should include available information on sustainability-related preferences that should enable customers to more easily access financial services that are aligned with their sustainability preferences and sustainable finance needs, in line with the Commission’s strategy for financing the transition to a sustainable economy12 . Access to data relating to sustainability which may be contained in balance or transaction details related to a mortgage, credit, loan and savings account, insurance-based investment products, as well as access to customer data relating to sustainability held by investment firms, such as a customer’s initital sustainability preferences, can contribute to facilitating access to data needed to access sustainable finance or make investments into the green transition. Moreover, customer data in the scope of this Regulation should include data which forms part of a creditworthiness assessment related to firms, including small and medium sized enterprises, and which can provide greater insight into the sustainability objectives of small firms. The inclusion of data used for the creditworthiness assessment related to firms should improve access to financing and streamline the application for loans. Such data should be limited to data on firms and should not infringe intellectual property rights. Sustainability preferences should include sustainability preferences of a customer collected by insurance intermediaries distributing insurance-based investment products as defined in Article 2(4) of Commission Delegated Regulation (EU) 2021/125712a, and sustainability preferences collected by investment firms as defined in Article 2(7) of Commission Delegated Regulation (EU) 2017/56512b. |
| 12 Communication From the Commission to the European Parliament, the Council, the European Economic And Social Committee and the Committee of the Regions, Strategy for Financing the Transition to a Sustainable Economy, COM/2021/390 final | 12 Communication From the Commission to the European Parliament, the Council, the European Economic And Social Committee and the Committee of the Regions, Strategy for Financing the Transition to a Sustainable Economy, COM/2021/390 final |
| 12a Commission Delegated Regulation (EU) 2021/1257 of 21 April 2021 amending Delegated Regulations (EU) 2017/2358 and (EU) 2017/2359 as regards the integration of sustainability factors, risks and preferences into the product oversight and governance requirements for insurance undertakings and insurance distributors and into the rules on conduct of business and investment advice for insurance-based investment products (OJ L 277, 2.8.2021, p. 18). | |
| 12b Commission Delegated Regulation (EU) 2017/565 of 25 April 2016 supplementing Directive 2014/65/EU of the European Parliament and of the Council as regards organisational requirements and operating conditions for investment firms and defined terms for the purposes of that Directive (OJ L 87, 31.3.2017, p. 1). |
Or. en
Justification
It is suggested to add insurance-based investment products to this list as they are in scope of Article 2(1)(b). Moreover, sustainability preferences could be a potentially promising use case of FiDA.As sustainability preferences are defined in two Delegated Regulations that are product specific (MiFID and IBIPs), it is suggested to refer to those Delegated Regulations in this recital.
Amendment 13
Proposal for a regulation
Recital 14
| Text proposed by the Commission | Amendment |
|---|---|
| (14) Customer data related to the provision of non-life insurance are essential to enable insurance products and services important to the needs of customer like the protection of homes, vehicles, and other property. At the same time, the collection of such data is often burdensome and costly and can act as a deterrent against seeking optimal insurance coverage by customers. To address this problem, it is therefore necessary to include such financial services within the scope of this Regulation. Customer data on insurance products within scope of this Regulation should include both insurance product information such as detail on an insurance coverage and data specific to the consumers’ insured assets which are collected for the purposes of a demands and needs test. The sharing of such data should allow for the development of personalised tools for customers, such as insurance dashboards that could help consumers better manage their risks. It could also help customers to obtain products that are better targeted to their demands and needs, including through more valuable advice. This can contribute to more optimal insurance coverage for customers and increased financial inclusion of otherwise underserved consumers, by offering new or increased coverage. Moreover, the sharing of insurance data can be beneficial for more efficient supply of insurance including, in particular, at the stages of product design, underwriting, contract execution, including claims management, and risk mitigation. | (14) Customer data related to the provision of non-life insurance are essential to enable insurance products and services important to the needs of customer like the protection of homes, vehicles, and other property. At the same time, the collection of such data is often burdensome and costly and can act as a deterrent against seeking optimal insurance coverage by customers. To address this problem, it is therefore necessary to include such financial services within the scope of this Regulation. Customer data on insurance products within scope of this Regulation should include both insurance product information such as detail on an insurance coverage and data specific to the consumers’ insured assets which are collected for the purposes of a demands and needs test. The access to and re-use of such data should allow for the development of personalised tools for customers, such as insurance dashboards that could help consumers better manage their risks. It could also help customers to obtain products that are better targeted to their demands and needs, including through more valuable advice. This can contribute to more optimal insurance coverage for customers and increased financial inclusion of otherwise underserved consumers, by offering new or increased coverage. Moreover, the unlocking and re-use of insurance data can be beneficial for more efficient supply of insurance including, in particular, at the stages of product design, underwriting, contract execution, including claims management, and risk mitigation. |
Or. en
Justification
It is suggested to use language that focuses more clearly on establishing data access rights for consumers and business customers. FiDA should first and foremost enable customers to take control over their data so that they can access and re-use it as they see fit.
Amendment 14
Proposal for a regulation
Recital 15
| Text proposed by the Commission | Amendment |
|---|---|
| (15) The sharing of data on occupational and personal pension savings has strong innovative potential for consumers. Pension savers often lack sufficient knowledge about their pension rights, which is related to the fact that data on such rights are often dispersed across different data holders. The sharing of data related to occupational and personal pension savings should contribute to the development of pension tracking tools that provide savers with a comprehensive overview of their entitlements and retirement income both within specific Member States and cross-border in the Union. Data on pension rights concerns in particular accrued pension entitlements, projected levels of retirement benefits, risks and guarantees of members and beneficiaries of occupational pension schemes. Access to data related to occupational pensions is without prejudice to national social and labour law on the organisation of pension systems, including membership of schemes and the outcomes of collective bargaining agreements. | (15) The access to data on occupational and personal pension savings has strong innovative potential for consumers that are current members or beneficiaries of occupational pension schemes. Pension savers often lack sufficient knowledge about their pension rights, which is related to the fact that data on such rights are often dispersed across different data holders. The access to and re-use of data related to occupational and personal pension savings should contribute to the development of pension tracking tools that provide savers with a comprehensive overview of their entitlements and retirement income both within specific Member States and cross-border in the Union. Data on pension rights concerns in particular accrued pension entitlements, projected levels of retirement benefits, risks and guarantees of members and beneficiaries of occupational pension schemes. Access to data related to occupational pensions is without prejudice to national social and labour law on the organisation of pension systems, including membership of schemes and the outcomes of collective bargaining agreements, and should take due regard to constraints in the payroll declaration and the cyclicality of pension administration processing time. To avoid duplicative data management costs, data holders that contribute to existing national pension tracking schemes should be permitted to use existing technical interfaces and common standards that have already been developed as part of these schemes in order to fulfil the obligations under this Regulation. |
Or. en
Justification
Survivors’ pensions provide a pension to family members of deceased pension fund members. It is clarified that only ‘current’ members of a pension funds should be regarded as consumers within the FiDA framework. Furthermore, pension data depend on the payroll declaration chain, which involves employers, pension funds and tax authorities. Such data cannot be updated continuously and in real-time. Lastly, it is suggested to avoid an unnecessary duplication of existing pension tracking services.
Amendment 15
Proposal for a regulation
Recital 17
| Text proposed by the Commission | Amendment |
|---|---|
| (17) As this Regulation is meant to oblige financial institutions to provide access to defined categories of data at the request of the customer when acting as data holders, and allow the sharing of data based on customer permission when financial institutions act as data users, it should provide a list of the financial institutions that may act as either a data holder, a data user or both. Financial institutions should therefore be understood to mean those entities that provide financial products and financial services or offer relevant information services to customers in the financial sector. | (17) As this Regulation is meant to oblige financial institutions to provide access to defined categories of data at the expressed request of the customer when acting as data holders, and allow the access to and re-use of data based on customer explicit permission when financial institutions act as data users, it should provide a list of the financial institutions that may act as either a data holder, a data user or both. Financial institutions should therefore be understood to mean those entities that provide financial products and financial services or offer relevant information services to customers in the financial sector. A data user should be able to receive any category of customer data listed in Article 2(1) of this Regulation and does not become a data holder by virtue of accessing or otherwise receiving customer data from a data holder. |
Or. en
Justification
It is suggested to more clearly delineate the roles and responsibilities of the data holder and the data user by explicitly stating that a data user does not become a data holder by virtue of accessing customer data, as this would create an unlimited chain and could potentially lead to a massive and uncontrolled spread of FIDA data.
Amendment 16
Proposal for a regulation
Recital 18
| Text proposed by the Commission | Amendment |
|---|---|
| (18) Practices employed by data users to combine new and traditional customer data sources in the scope of this Regulation must be proportionate to ensure that they do not lead to financial exclusion risks for consumers. Practices that lead to a more sophisticated or comprehensive analysis of certain vulnerable segments of consumers, such as persons with a low income, may increase the risk of unfair conditions or differential pricing practices like the charging of differential premiums. The potential for exclusion is increased in the provision of products and services that are priced according to the profile of a consumer, notably in credit scoring and the assessment of creditworthiness of natural persons as well for products and services related to the risk assessment and pricing of natural persons in the case of life and health insurance. Given the risks, the use of data for these products and services should be subject to specific requirements to protect consumers and their fundamental rights. | (18) Practices employed by data users to combine new and traditional customer data sources in the scope of this Regulation must be in the best interest of the customer and proportionate to ensure that they do not lead to financial exclusion risks for consumers. Practices that lead to a more sophisticated or comprehensive analysis of certain vulnerable segments of consumers, such as persons with a low income, may increase the risk of unfair conditions or differential pricing practices like the charging of differential premiums. The potential for exclusion is increased in the provision of products and services that are priced according to the profile of a consumer, notably in credit scoring and the assessment of creditworthiness of natural persons as well for products and services related to the risk assessment and pricing of natural persons in the case of life and health insurance. Given the risks, the use and re-use of data for these products and services should be subject to specific requirements to protect consumers and their fundamental rights. |
Or. en
Justification
Data use should always be in the best interest of the customer.
Amendment 17
Proposal for a regulation
Recital 21
| Text proposed by the Commission | Amendment |
|---|---|
| (21) Customers must have effective control over their data and confidence in managing permissions they have granted in accordance with this Regulation. Data holders should therefore be required to provide customers with common and consistent financial data access permission dashboards. The permission dashboard should empower the customer to manage their permissions in an informed and impartial manner and give customers a strong measure of control over how their personal and non-personal data is used. It should not be designed in a way that would encourage or unduly influence the customer to grant or withdraw permissions. The permission dashboard should take into account, where appropriate, the accessibility requirements under Directive (EU) 2019/882 of the European Parliament and of the Council14 . When providing a permission dashboard, data holders could use a notified electronic identification and trust service, such as a European Digital Identity Wallet issued by a Member State as introduced by the proposal amending Regulation (EU) No 910/2014 as regards establishing a framework for a European Digital Identity15 . Data holders may also rely on data intermediation service providers under Regulation (EU) 2022/868 of the European Parliament and of the Council16 , to provide permission dashboards that fulfil the requirements of this Regulation. | (21) Customers must have effective control over their data and confidence in managing permissions they have granted in accordance with this Regulation. Data holders should therefore be required to provide customers with common and consistent financial data access permission dashboards. The permission dashboard should empower the customer to manage their permissions in an informed and impartial manner and give customers a strong measure of control over how their personal and non-personal data is used. It should not be designed in a way that would encourage or unduly influence the customer to grant or withdraw permissions. For example, the procedure to withdraw permission should not be made more difficult than the procedure to give permission for access to data. The permission dashboard should take into account, where appropriate, the accessibility requirements under Directive (EU) 2019/882 of the European Parliament and of the Council14 . When providing a permission dashboard, data holders could use a notified electronic identification and trust service, such as a European Digital Identity Wallet issued by a Member State as introduced by the proposal amending Regulation (EU) No 910/2014 as regards establishing a framework for a European Digital Identity15 . Data holders may also rely on data intermediation service providers under Regulation (EU) 2022/868 of the European Parliament and of the Council16 , to provide permission dashboards that fulfil the requirements of this Regulation. |
| 14 Directive (EU) 2019/882 of the European Parliament and of the Council of 17 April 2019 on the accessibility requirements for products and services (OJ L 151, 7.6.2019, p. 70–115) | 14 Directive (EU) 2019/882 of the European Parliament and of the Council of 17 April 2019 on the accessibility requirements for products and services (OJ L 151, 7.6.2019, p. 70–115) |
| 15 COM(2021) 281 final, 2021/0136(COD) | 15 COM(2021) 281 final, 2021/0136(COD) |
| 16 Regulation (EU) 2022/868 of the European Parliament and of the Council of 30 May 2022 on European data governance and amending Regulation (EU) 2018/1724 (Data Governance Act) (OJ L 152, 3.6.2022, p. 1). | 16 Regulation (EU) 2022/868 of the European Parliament and of the Council of 30 May 2022 on European data governance and amending Regulation (EU) 2018/1724 (Data Governance Act) (OJ L 152, 3.6.2022, p. 1). |
Or. en
Justification
The procedure to withdraw a permission should not be more cumbersome than the procedure to grant a permission.
Amendment 18
Proposal for a regulation
Recital 22
| Text proposed by the Commission | Amendment |
|---|---|
| (22) The permission dashboard should display the permissions given by a customer, including when personal data are shared based on consent or are necessary for the performance of a contract. The permission dashboard should warn a customer in a standard way of the risk of possible contractual consequences of the withdrawal of a permission, but the customer should remain responsible for managing such risk. The permission dashboard should be used to manage existing permissions. Data holders should inform data users in real-time of any withdrawal of a permission. The permission dashboard should include a record of permissions that have been withdrawn or have expired for a period of up to two years to allow the customer to keep track of their permissions in an informed and impartial manner. Data users should inform data holders in real-time of new and re-established permissions granted by customers, including the duration of validity of the permission and a short summary of the purpose of the permission. The information provided on the permission dashboard is without prejudice to the information requirements under Regulation (EU) 2016/679. | (22) The permission dashboard should display the permissions given by a customer, including when personal data are accessed based on consent or are necessary for the performance of a contract. The permission dashboard should warn a customer in a standard way of the risk of possible contractual consequences of the withdrawal of a permission, but the customer should remain responsible for managing such risk. The permission dashboard should be used to manage existing permissions. Data holders should inform data users in real-time of any withdrawal of a permission. When a permission is re-established, data holders should inform customers, or enable data users to inform customers, of the terms and conditions applicable at that time. The permission dashboard should include a record of permissions that have been withdrawn or have expired for a period of up to two years to allow the customer to keep track of their permissions in an informed and impartial manner. Data users should inform data holders in real-time of new and re-established permissions granted by customers, including the duration of validity of the permission and a short summary of the purpose of the permission. The information provided on the permission dashboard is without prejudice to the requirements under Regulation (EU) 2016/679, in particular the information requirement. |
Or. en
Justification
The permission provided by a customer creates a legal relationship between a data user and the customer, which is subject to the terms agreed to between the data user and the customer at the time of the permission. A customer should be informed of the applicable terms also when a permission is re-established. Furthermore, all GDPR requirements should be taken into account.
Amendment 19
Proposal for a regulation
Recital 24
| Text proposed by the Commission | Amendment |
|---|---|
| (24) This Regulation introduces a new legal obligation on financial institutions acting as data holders to share defined categories of data at request of the customer. The obligation on data holders to share data at the request of the customer should be specified by making available generally recognised standards to also ensure that the data shared is of a sufficiently high quality. The data holder should make customer data available continuously for the purposes and under the conditions for which the customer has granted permission to a data user. Continuous access could consist of multiple requests to make customer data available to fulfil the service agreed with the customer. It could also consist of a one-off access to customer data. While the data holder is responsible for the interface to be available and for the interface to be of adequate quality, the interface may be provided not only by the data holder but also by another financial institution, an external IT provider, an industry association or a group of financial institutions, or by a public body in a member state. For institutions for occupational retirement provisions, the interface can be integrated into pension dashboards that cover a broader range of information, as long as it complies with the requirements of this Regulation. | (24) This Regulation introduces a new legal obligation on financial institutions, when members of a financial data access scheme are acting as data holders, to provide data users with access to defined categories of data which are available in digital form. The obligation on data holders to provide access to data at the expressed request of the customer should be specified by making available generally recognised standards to also ensure that the data accessed is of a sufficiently high quality. The data holder should make customer data available only for the purposes and under the conditions for which the customer has explicitly granted permission to a data user for a specific service which is clearly identified by the customer, where relevant and technically feasible, on a continuous basis and in real-time. Continuous access could consist of multiple requests to make customer data available to fulfil the service agreed with the customer. It could also consist of a one-off access to customer data. While the data holder is responsible for the interface to be available and for the interface to be of adequate quality, the interface may be provided not only by the data holder but also by another financial institution, an external IT provider, an industry association or a group of financial institutions, or by a public body in a member state. For institutions for occupational retirement provision, the interface can be integrated into pension dashboards or existing pension tracking services that cover a broader range of information, as long as it complies with the requirements of this Regulation. |
Or. en
Justification
Customers should give explicit permission to grant access to their data. Furthermore, data should be available in digital form. Lastly, it is suggested to avoid an unnecessary duplication of existing pension tracking services.
Amendment 20
Proposal for a regulation
Recital 25
| Text proposed by the Commission | Amendment |
|---|---|
| (25) In order to enable the contractual and technical interaction necessary for implementing data access between multiple financial institutions, data holders and data users should be required to be part of financial data sharing schemes. These schemes should develop data and interface standards, joint standardised contractual frameworks governing access to specific datasets, and governance rules related to data sharing. In order to ensure that schemes function effectively, it is necessary to establish general principles for the governance of these schemes, including rules on inclusive governance and participation of data holders, data users and customers (to ensure balanced representation in schemes), transparency requirements, and a well-functioning appeal and review procedure (notably around the decision-making of schemes). Financial data sharing schemes must comply with Union rules in the area of consumer protection and data protection, privacy, and competition. The participants in such schemes are also encouraged to draw up codes of conduct similar to those prepared by controllers and processors under Article 40 of Regulation (EU) 2016/679. While such schemes may build upon existing market initiatives, the requirements set out in this Regulation should be specific to financial data sharing schemes or parts thereof which market participants use to fulfil their obligations under this Regulation after the data of application of these obligations. | (25) In order to enable the contractual and technical interaction necessary for implementing data access between multiple financial institutions, data holders and data users should be required to be part of financial data access schemes. These schemes should develop data and interface standards, joint standardised contractual frameworks governing access to specific datasets, and governance rules related to data access and re-use. In order to ensure that schemes function effectively, it is necessary to establish general principles for the governance of these schemes, including rules on inclusive governance and participation of data holders, data users and customers (to ensure balanced representation in schemes), transparency requirements, and a well-functioning appeal and review procedure (notably around the decision-making of schemes). Financial data access schemes must comply with Union rules in the area of consumer protection and data protection, privacy, and competition. The participants in such schemes are also encouraged to draw up codes of conduct in accordance with Article 40 of Regulation (EU) 2016/679. While such schemes may build upon existing market initiatives, the requirements set out in this Regulation should be specific to financial data access schemes or parts thereof which market participants use to fulfil their obligations under this Regulation after the data of application of these obligations. |
Or. en
Justification
The “in accordance with” follows a suggestion made by the EDPS in its opinion (point 47). The clarification aims at improving clarity and consistency.
Amendment 21
Proposal for a regulation
Recital 26
| Text proposed by the Commission | Amendment |
|---|---|
| (26) A financial data sharing scheme should consist of a collective contractual agreement between data holders and data users with the objective of promoting efficiency and technical innovation in financial data sharing to the benefit of customers. In line with Union rules on competition, a financial data sharing scheme should only impose on its members restrictions which are necessary to achieve its objectives and which are proportionate to those objectives. It should not afford its members the possibility of preventing, restricting or distorting competition in respect of a substantial part of the relevant market. | (26) A financial data access scheme should consist of a collective contractual agreement between data holders and data users with the objective of promoting efficiency and technical innovation in financial data access to the benefit of customers. In line with Union rules on competition, a financial data access scheme should only impose on its members restrictions which are necessary to achieve its objectives and which are proportionate to those objectives. It should not afford its members the possibility of preventing, restricting or distorting competition in respect of a substantial part of the relevant market. |
Or. en
Justification
It is suggested to use language that focuses more clearly on establishing data access rights for consumers and business customers. FiDA should first and foremost enable customers to take control over their data so that they can access and re-use it as they see fit.
Amendment 22
Proposal for a regulation
Recital 28
| Text proposed by the Commission | Amendment |
|---|---|
| (28) Data holders and data users should be allowed to use existing market standards when developing common standards for mandatory data sharing. | (28) Data holders and data users should be allowed to use existing market standards and infrastructures for technical interfaces like application programming interfaces when developing common standards for mandatory data access. |
Or. en
Justification
It is suggested that the industry may build on existing infrastructures for technical interfaces, as this could be a cost-efficient method to ensure an efficient transition for financial institutions that may be out of scope of PSD3 but in scope of FiDA.
Amendment 23
Proposal for a regulation
Recital 29
| Text proposed by the Commission | Amendment |
|---|---|
| (29) To ensure that data holders have an interest in providing high quality interfaces for making data available to data users, data holders should be able to request reasonable compensation from data users for putting in place application programming interfaces. Facilitating data access against compensation would ensure a fair distribution of the related costs between data holders and data users in the data value chain. In cases where the data user is an SME, proportionality for smaller market participants should be ensured by limiting compensation strictly to the costs incurred for facilitating data access. The model for determining the level of compensation should be defined as part of the financial data sharing schemes as provided in this Regulation. | (29) To ensure that data holders have an interest in investing in and providing high quality interfaces for making data available to data users, while at the same time avoiding excessive burdens on access to and the use of data which make data access no longer commercially viable, data holders should be able to request reasonable compensation from data users for costs incurred in providing access to the data, including the costs related to putting in place and maintaining application programming interfaces. Facilitating data access against compensation would ensure a fair distribution of the related costs between data holders and data users in the data value chain. In cases where the data user is an SME, proportionality for smaller market participants should be ensured by limiting compensation strictly to the costs incurred for facilitating data access, while ensuring that there are sufficient incentives to foster market adoption and effective competition. The model for determining the level of compensation should be defined as part of the financial data access schemes as provided in this Regulation. In accordance with Regulation (EU) [XXXX/XXXX] (Data Act), the Commission should adopt guidelines on the calculation of reasonable compensation. |
Or. en
Justification
Closer alignment with Data Act (recital 46).
Amendment 24
Proposal for a regulation
Recital 30
| Text proposed by the Commission | Amendment |
|---|---|
| (30) Customers should know what their rights are in case problems arise when data is shared and who to approach to seek compensation. Financial data sharing scheme members, including data holders and data users, should therefore be required to agree on the contractual liability for data breaches as well as how to resolve potential disputes between data holders and data users regarding liability. Those requirements should focus on establishing, as part of any contract, liability rules as well as clear obligations and rights to determine liability between the data holder and the data user. Liability issues related to the consumers as data subjects should be based on Regulation (EU) 2016/679, notably the right to compensation and liability under Article 82 of that Regulation. | (30) Customers should know what their rights are in case problems arise when data is accessed and who to approach to seek compensation. Financial data access scheme members, including data holders and data users, should therefore be required to agree on the contractual liability for data breaches, customer compensation when data is misused, including when it is transferred to a third-party without the customer’s explicit permission, as well as how to resolve potential disputes between data holders and data users regarding liability. Those requirements should focus on establishing, as part of any contract, liability rules as well as clear obligations and rights to determine liability between the data holder and the data user. Liability issues related to the consumers as data subjects should be based on Regulation (EU) 2016/679, notably the right to compensation and liability under Article 82 of that Regulation. |
Or. en
Justification
Financial data access schemes should provide compensation to customers in case of misuse of customer data.
Amendment 25
Proposal for a regulation
Recital 32
| Text proposed by the Commission | Amendment |
|---|---|
| (32) Data users within the scope of this Regulation should be subject to the requirements of Regulation (EU) 2022/2554 of the European Parliament and of the Council18 and therefore be obliged to have strong cyber resilience standards in place to carry out their activities. This includes having comprehensive capabilities to enable a strong and effective ICT risk management, as well as specific mechanisms and policies for handling all ICT-related incidents and for reporting major ICT-related incidents. Data users authorised and supervised as financial information service providers under this Regulation should follow the same approach and the same principle-based rules when addressing ICT risks taking into account their size and overall risk profile, and the nature, scale and complexity of their services, activities and operations. Financial information service providers should therefore be included in the scope of Regulation (EU) 2022/2554. | (32) Data users within the scope of this Regulation should be subject to the requirements of Regulation (EU) 2022/2554 of the European Parliament and of the Council18 and therefore be obliged to have strong cyber resilience standards in place to carry out their activities. This includes having comprehensive capabilities to enable a strong and effective information and communication technology (ICT) risk management, as well as specific mechanisms and policies for handling all ICT-related incidents and for reporting major ICT-related incidents. Data users authorised and supervised as financial information service providers under this Regulation should follow the same approach and the same principle-based rules when addressing ICT risks taking into account their size and overall risk profile, and the nature, scale and complexity of their services, activities and operations. Financial information service providers should therefore be included in the scope of Regulation (EU) 2022/2554. |
| 18 Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011 (OJ L 333, 27.12.2022, p. 1). | 18 Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011 (OJ L 333, 27.12.2022, p. 1). |
Or. en
Justification
Introduction of the abbreviation “ICT”.
Amendment 26
Proposal for a regulation
Recital 33
| Text proposed by the Commission | Amendment |
|---|---|
| (33) In order to enable effective supervision and to eliminate the possibility of evading or circumventing supervision, financial information service providers must be either legally incorporated in the Union or in case they are incorporated in a third country appoint a legal representative in the Union. An effective supervision by the competent authorities is necessary for the enforcement of requirements under this Regulation to ensure integrity and stability of the financial system and to protect consumers. The requirement of legal incorporation of financial information service providers in the Union or the appointment of a legal representative in the Union does not amount to data localisation since this Regulation does not entail any further requirement on data processing including storage to be undertaken in Union. | (33) In order to enable effective supervision and to eliminate the possibility of evading or circumventing supervision, financial information service providers must only be provided by legal persons that have a registered office in a Member State in which they intend to carry out or do carry out substantive business activities . An effective supervision by the competent authorities is necessary for the enforcement of requirements under this Regulation to ensure integrity and stability of the financial system and to protect consumers. The requirement of legal incorporation of financial information service providers in the Union does not amount to data localisation since this Regulation does not entail any further requirement on data processing including storage to be undertaken in Union. |
Or. en
Justification
To maintain a level playing field, in order not to jeopardise effective supervision of these new actors, and to protect customers against possible misuse of their data, is suggested to remove the possibility for undertakings that are not established in the EU to benefit from an authorisation as a FISP. Third country providers should not be allowed to conduct activities if they are not properly licensed for such activities in a specific member state. Such option does not exist under PSD2 either for e.g. AISPs and would therefore result in a discriminatory situation between FISPs and AISPs.
Amendment 27
Proposal for a regulation
Recital 34
| Text proposed by the Commission | Amendment |
|---|---|
| (34) A financial information service provider should be authorised in the jurisdiction of the Member State where its main establishment is located, that is, where the financial information service provider has its head office or registered office within which the principal functions and operational control are exercised. In respect of financial information service providers that do not have an establishment in the Union but require access to data in the Union and therefore fall within the scope of this Regulation, the Member State where those financial information service providers have appointed their legal representative should have jurisdiction, considering the function of legal representatives under this Regulation. | (34) A financial information service provider should be authorised in the jurisdiction of the Member State where its main establishment is located, that is, where the financial information service provider intends to carry out substantive business activities and where it has its head office or registered office within which the principal functions and operational control are exercised. |
Or. en
Justification
In order to maintain a level playing field, not to jeopardise effective supervision of these new actors, and to protect customers against possible misuse of their data, is suggested to remove the possibility for undertakings that are not established in the EU to benefit from an authorisation as a FISP. Third country providers should not be allowed to conduct activities if they are not properly licensed for such activities in a specific member state. Such option does not exist under PSD2 either for e.g. AISPs and would therefore result in a discriminatory situation between FISPs and AISPs.
Amendment 28
Proposal for a regulation
Recital 35
| Text proposed by the Commission | Amendment |
|---|---|
| (35) To facilitate transparency regarding data access and financial information service providers, EBA should establish a register of financial information service providers authorised under this Regulation, as well as financial data sharing schemes agreed between data holders and data users. | (35) To facilitate transparency regarding data access and financial information service providers, the European Supervisory Authorities should establish a register of financial information service providers authorised under this Regulation, as well as financial data access schemes agreed between data holders and data users. |
Or. en
Justification
It is suggested that the ESAs should be jointly responsible for the register.
Amendment 29
Proposal for a regulation
Recital 47
| Text proposed by the Commission | Amendment |
|---|---|
| (47) The proposal for a Data Act [Regulation (EU) XX] establishes a horizontal framework for access to and use of data across the Union. This Regulation complements and specifies the rules laid down in the proposal for a Data Act [Regulation (EU) XX] Therefore those rules also apply to the sharing of data governed by this Regulation. This includes provisions on the conditions under which data holders make data available to data recipients, on compensation, dispute settlement bodies to facilitate agreements between data sharing parties, technical protection measures, international access and transfer of data and on authorised use or disclosure of data. | (47) The Data Act [Regulation (EU) XX] establishes a horizontal framework for access to and use of data across the Union. This Regulation complements and specifies the rules laid down in the Data Act [Regulation (EU) XX] Therefore those rules also apply to the access of data governed by this Regulation. This includes provisions on the conditions under which data holders make data available to data recipients, on compensation, dispute settlement bodies to facilitate agreements between data access parties, technical protection measures, international access and transfer of data and on authorised use or disclosure of data. |
Or. en
Justification
The Data Act has meanwhile been adopted; publication in the OJ is forthcoming. Furthermore, it is suggested to use language that focuses more clearly on establishing data access rights for consumers and business customers. FiDA should first and foremost enable customers to take control over their data so that they can access and re-use it as they see fit.
Amendment 30
Proposal for a regulation
Recital 48
| Text proposed by the Commission | Amendment |
|---|---|
| (48) Regulation (EU) 2016/679 applies when personal data are processed. It provides for the rights of a data subject, including the right of access and right to port personal data. This Regulation is without prejudice to the rights of a data subject provided under Regulation (EU) 2016/679, including the right of access and right to data portability. This Regulation creates a legal obligation to share customer personal and non-personal data upon customer’s request and mandates the technical feasibility of access and sharing for all types of data within the scope of this Regulation. The granting of permission by a customer is without prejudice to the obligations of data users under Article 6 of Regulation (EU) 2016/679. Personal data that are made available and shared with a data user should only be processed for services provided by a data user where there is a valid legal basis under Article 6(1) of Regulation (EU) 2016/679 and, when applicable, where the requirements of Article 9 of that Regulation on the processing of special categories of data are met. | (48) Processing of personal data in the context of this Regulation should be carried out in accordance with Regulation (EU) 2016/679 and Regulation (EU) 2018/1725, as well as, where applicable, with Directive 2002/58/EC of the European Parliament and of the Council1a (ePrivacy Directive). Regulation (EU) 2016/679 provides for the rights of a data subject, including the right of access and right to port personal data. This Regulation is without prejudice to the rights of a data subject provided under Regulation (EU) 2016/679, including the right of access and right to data portability. This Regulation creates a legal obligation to provide access to and enable re-use of customer personal and non-personal data upon customer’s request and mandates the technical feasibility of access for all types of data within the scope of this Regulation. The granting of permission by a customer is without prejudice to the obligations of data users under Article 6 of Regulation (EU) 2016/679. Permission should not be construed as ‘consent’ or ‘necessity for the performance of a contract’ as defined in Regulation (EU) 2016/679. Personal data that are made available to a data user should only be processed for services provided by a data user where there is a valid legal basis under Article 6(1) of Regulation (EU) 2016/679 and, when applicable, where the requirements of Article 9 of that Regulation on the processing of special categories of data are met. |
| 1a Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) (OJ L 201, 31.7.2002, p. 37). |
Or. en
Justification
Suggestions made by the EDPS in its opinion (points 9 and 18). It is useful to add clearer guidance on the interaction between the FiDA permission mechanism and the GDPR legal basis.
Amendment 31
Proposal for a regulation
Recital 50
| Text proposed by the Commission | Amendment |
|---|---|
| (50) This Regulation does not affect the provisions related to data access and data sharing in Union financial services legislation, namely the following: (i) the provisions on access to benchmarks and the access regime for exchange-traded derivatives between trading venues and Central Counterparties laid down in Regulation (EU) No 600/2014 of the European Parliament and of the Council22 ; (ii) the rules on access of creditors to the database under Directive 2014/17/EU of the European Parliament and of the Council23 ; (iii) the rules on access to securitisation repositories under Regulation (EU) 2017/2402 of the European Parliament and of the Council24 ; (iv) the rules on the right to request from the insurer a claims history statement and on the access to central repositories to basic data necessary for the settlement of claims under Directive 2009/103/EC of the European Parliament and of the Council25 ; (v) the right to access and transfer all necessary personal data to a new pan-European Personal Pension Product provider under Regulation (EU) 2019/1238 of the European Parliament and of the Council26 ; and (vi) the provisions on outsourcing and reliance under Directive (EU) 2018/843 of the European Parliament and of the Council27 . Furthermore, this Regulation does not affect the application of EU or national rules of competition of the Treaty on the Functioning of the European Union and any secondary Union acts. This Regulation is also without prejudice to accessing, sharing and using data without making use of the data access obligations established by this Regulation on a purely contractual basis. | (50) This Regulation does not affect the provisions related to data access in Union financial services legislation, namely the following: (i) the provisions on access to benchmarks and the access regime for exchange-traded derivatives between trading venues and Central Counterparties laid down in Regulation (EU) No 600/2014 of the European Parliament and of the Council22 ; (ii) the rules on access of creditors to the database under Directive 2014/17/EU of the European Parliament and of the Council23 ; (iii) the rules on access to securitisation repositories under Regulation (EU) 2017/2402 of the European Parliament and of the Council24 ; (iv) the rules on the right to request from the insurer a claims history statement and on the access to central repositories to basic data necessary for the settlement of claims under Directive 2009/103/EC of the European Parliament and of the Council25 ; (v) the right to access and transfer all necessary personal data to a new pan-European Personal Pension Product provider under Regulation (EU) 2019/1238 of the European Parliament and of the Council26 ; and (vi) the provisions on outsourcing and reliance under Directive (EU) 2018/843 of the European Parliament and of the Council27 . Furthermore, this Regulation does not affect the application of EU or national rules of competition of the Treaty on the Functioning of the European Union and any secondary Union acts. This Regulation is also without prejudice to accessing and using data without making use of the data access obligations established by this Regulation on a purely contractual basis. |
| 22 Regulation (EU) No 600/2014 of the European Parliament and of the Council of 15 May 2014 on markets in financial instruments and amending Regulation (EU) No 648/2012 (OJ L 173 12.6.2014, p. 84). | 22 Regulation (EU) No 600/2014 of the European Parliament and of the Council of 15 May 2014 on markets in financial instruments and amending Regulation (EU) No 648/2012 (OJ L 173 12.6.2014, p. 84). |
| 23 Directive 2014/17/EU of the European Parliament and of the Council of 4 February 2014 on credit agreements for consumers relating to residential immovable property and amending Directives 2008/48/EC and 2013/36/EU and Regulation (EU) No 1093/2010 (OJ L 060 28.2.2014, p. 34). | 23 Directive 2014/17/EU of the European Parliament and of the Council of 4 February 2014 on credit agreements for consumers relating to residential immovable property and amending Directives 2008/48/EC and 2013/36/EU and Regulation (EU) No 1093/2010 (OJ L 060 28.2.2014, p. 34). |
| 24 Regulation (EU) 2017/2402 of the European Parliament and of the Council of 12 December 2017 laying down a general framework for securitisation and creating a specific framework for simple, transparent and standardised securitisation, and amending Directives 2009/65/EC, 2009/138/EC and 2011/61/EU and Regulations (EC) No 1060/2009 and (EU) No 648/2012 (OJ L 347 28.12.2017, p. 35). | 24 Regulation (EU) 2017/2402 of the European Parliament and of the Council of 12 December 2017 laying down a general framework for securitisation and creating a specific framework for simple, transparent and standardised securitisation, and amending Directives 2009/65/EC, 2009/138/EC and 2011/61/EU and Regulations (EC) No 1060/2009 and (EU) No 648/2012 (OJ L 347 28.12.2017, p. 35). |
| 25 Directive 2009/103/EC of the European Parliament and of the Council of 16 September 2009 relating to insurance against civil liability in respect of the use of motor vehicles, and the enforcement of the obligation to insure against such liability (OJ L 263, 7.10.2009, p. 11). | 25 Directive 2009/103/EC of the European Parliament and of the Council of 16 September 2009 relating to insurance against civil liability in respect of the use of motor vehicles, and the enforcement of the obligation to insure against such liability (OJ L 263, 7.10.2009, p. 11). |
| 26 Regulation (EU) 2019/1238 of the European Parliament and of the Council of 20 June 2019 on a pan-European Personal Pension Product (PEPP) (OJ L 198, 25.7.2019, p. 1). | 26 Regulation (EU) 2019/1238 of the European Parliament and of the Council of 20 June 2019 on a pan-European Personal Pension Product (PEPP) (OJ L 198, 25.7.2019, p. 1). |
| 27 Directive (EU) 2018/843 of the European Parliament and of the Council of 30 May 2018 amending Directive (EU) 2015/849 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing, and amending Directives 2009/138/EC and 2013/36/EU (OJ L 156, 19.6.2018, p. 43). | 27 Directive (EU) 2018/843 of the European Parliament and of the Council of 30 May 2018 amending Directive (EU) 2015/849 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing, and amending Directives 2009/138/EC and 2013/36/EU (OJ L 156, 19.6.2018, p. 43). |
Or. en
Justification
It is suggested to use language that focuses more clearly on establishing data access rights for consumers and business customers. FiDA should first and foremost enable customers to take control over their data so that they can access and re-use it as they see fit.
Amendment 32
Proposal for a regulation
Recital 51
| Text proposed by the Commission | Amendment |
|---|---|
| (51) As the sharing of data related to payment accounts is regulated under a different regime set out in Directive (EU) 2015/2366, it is deemed appropriate to set, in this Regulation, a review clause for the Commission to examine whether the introduction of the rules under this Regulation impacts the way AISPs access data and whether it would be appropriate to streamline the rules governing the sharing of data applicable to AISPs. | (51) As the access to data related to payment accounts is regulated under a different regime set out in Directive (EU) 2015/2366, it is deemed appropriate to set, in this Regulation, a review clause for the Commission to examine whether the introduction of the rules under this Regulation impacts the way AISPs access data and whether it would be appropriate to streamline the rules governing the access of data applicable to AISPs. |
Or. en
Justification
It is suggested to use language that focuses more clearly on establishing data access rights for consumers and business customers. FiDA should first and foremost enable customers to take control over their data so that they can access and re-use it as they see fit.
Amendment 33
Proposal for a regulation
Recital 52
| Text proposed by the Commission | Amendment |
|---|---|
| (52) Given that EBA, EIOPA and ESMA should be mandated to make use of their powers in relation to financial information service providers, it is necessary to ensure that they are able to exercise all of their powers and tasks in order to fulfil their objectives of protecting the public interest by contributing to the short, medium and long-term stability and effectiveness of the financial system, for the Union economy, its citizens and businesses and to ensure that financial information service providers are covered by Regulations (EU) No 1093/201028 , (EU) No 1094/201029 and (EU) No 1095/201030 of the European Parliament and of the Council. Those Regulations should therefore be amended accordingly. | (52) Given that EBA, EIOPA and ESMA should govern all objectives of this Regulation and be mandated to make use of their powers in relation to financial information service providers, it is necessary to ensure that they are able to exercise all of their powers and tasks in order to fulfil their objectives of protecting the public interest by contributing to the short, medium and long-term stability and effectiveness of the financial system, for the Union economy, its citizens and businesses and to ensure that financial information service providers are covered by Regulations (EU) No 1093/201028 , (EU) No 1094/201029 and (EU) No 1095/201030 of the European Parliament and of the Council. Those Regulations should therefore be amended accordingly. |
| 28 Regulation (EU) No 1093/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Banking Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/78/EC (OJ L 331, 15.12.2010, p. 12). | 28 Regulation (EU) No 1093/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Banking Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/78/EC (OJ L 331, 15.12.2010, p. 12). |
| 29 Regulation (EU) No 1094/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Insurance and Occupational Pensions Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/79/EC (OJ L 331, 15.12.2010, p. 48). | 29 Regulation (EU) No 1094/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Insurance and Occupational Pensions Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/79/EC (OJ L 331, 15.12.2010, p. 48). |
| 30 Regulation (EU) No 1095/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Securities and Markets Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/77/EC (OJ L 331, 15.12.2010, p. 84). | 30 Regulation (EU) No 1095/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Securities and Markets Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/77/EC (OJ L 331, 15.12.2010, p. 84). |
Or. en
Justification
It is important that the ESAs govern all the FiDA objectives. This was not or insufficiently the case for the EBA and PSD2, which created significant difficulties with the implementation of that Directive.
Amendment 34
Proposal for a regulation
Recital 54
| Text proposed by the Commission | Amendment |
|---|---|
| (54) The European Data Protection Supervisor was consulted in accordance with Article 42(2) of Regulation (EU) 2018/1725 of the European Parliament and of the Council31 and delivered an opinion on [……….] | (54) The European Data Protection Supervisor was consulted in accordance with Article 42(2) of Regulation (EU) 2018/1725 of the European Parliament and of the Council31 and delivered an opinion on 22 August 2023. |
| 31 Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39). | 31 Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39). |
Or. en
Justification
See https://edps.europa.eu/data-protection/our-work/publications/opinions/2023-08-22-edps-opinion-382023-regulation-framework-financial-data-access_en.
Amendment 35
Proposal for a regulation
Article 1 – paragraph 1
| Text proposed by the Commission | Amendment |
|---|---|
| This Regulation establishes rules on the access, sharing and use of certain categories of customer data in financial services. | This Regulation establishes rules on the access and re-use of categories of customer data in financial services listed in Article 2(1) of this Regulation. |
Or. en
Justification
It is suggested to use language that focuses more clearly on establishing data access rights for consumers and business customers. FiDA should first and foremost enable customers to take control over their data so that they can access and re-use it as they see fit. Furthermore, is is suggested to clarify that FiDA enables the financial sector to offer financial services and products on the basis of the accessed data. Furthermore, more precise reference to the categories of customer data.
Amendment 36
Proposal for a regulation
Article 2 – paragraph 3 a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| 3a. This Regulation does not apply to special categories of data referred to in Article 9(1) of Regulation (EU) 2016/679. |
Or. en
Justification
As recommended by the EDPS in its opinion (points 32 and 33), it is suggested to explicitly exclude sensitive data (GDPR Article 9 data) from the scope of FiDA.
Amendment 37
Proposal for a regulation
Article 2 – paragraph 4
| Text proposed by the Commission | Amendment |
|---|---|
| 4. This Regulation does not affect the application of other Union legal acts regarding access to and sharing of customer data referred to in paragraph 1, unless specifically provided for in this Regulation. | 4. This Regulation does not affect the application of other Union legal acts regarding access to and re-use of customer data referred to in paragraph 1, unless specifically provided for in this Regulation. |
Or. en
Justification
It is suggested to use language that focuses more clearly on establishing data access rights for consumers and business customers. FiDA should first and foremost enable customers to take control over their data so that they can access and re-use it as they see fit.
Amendment 38
Proposal for a regulation
Article 2 – paragraph 4 a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| 4a. The Commission is empowered to adopt delegated acts in accordance with Article 30 to supplement the list of categories of customer data in scope of this Regulation set out in paragraph 1 of this Article to allow potential other use cases in the interest of customers and after consultation with the European Supervisory Authorities. |
Or. en
Justification
To make the FiDA framework future-proof, it is suggested that the European Commission, after consulting the ESAs, should be able to review the data scope established in the Regulation trough a delegated act.
Amendment 39
Proposal for a regulation
Article 2 – paragraph 4 b (new)
| Text proposed by the Commission | Amendment |
|---|---|
| 4b. This Regulation is without prejudice to Union law and national law on the protection of personal data, privacy and confidentiality of communications and integrity of terminal equipment, which shall apply to personal data processed in connection with the rights and obligations laid down herein, in particular Regulations (EU) 2016/679 and (EU) 2018/1725 and Directive 2002/58/EC, including the powers and competences of supervisory authorities and the rights of data subjects. Insofar as users are data subjects, the rights laid down in Chapter II of this Regulation shall complement the rights of access by data subjects and rights to data portability under Articles 15 and 20 of Regulation (EU) 2016/679. In the event of a conflict between this Regulation and Union law on the protection of personal data or privacy, or national legislation adopted in accordance with such Union law, the relevant Union or national law on the protection of personal data or privacy shall prevail. |
Or. en
Justification
It seems appropriate to refer more clearly to data protection regulation. This paragraph is copied from the Data Act (as adopted; publication in OJ forthcoming), Article 1(5).
Amendment 40
Proposal for a regulation
Article 3 – paragraph 1 – point 1
| Text proposed by the Commission | Amendment |
|---|---|
| (1) ‘consumer’ means a natural person who is acting for purposes other than his or her trade, business or profession; | (1) ‘consumer’ means a consumer as defined in Article 2(1) of Directive 2011/83/EU of the European Parliament and of the Council1a; |
| 1a Directive 2011/83/EU of the European Parliament and of the Council of 25 October 2011 on consumer rights, amending Council Directive 93/13/EEC and Directive 1999/44/EC of the European Parliament and of the Council and repealing Council Directive 85/577/EEC and Directive 97/7/EC of the European Parliament and of the Council (OJ L 304, 22.11.2011, p. 64). |
Or. en
Justification
It is suggested to cross-refer to the definition of ‘consumer’ in the consumer rights Directive (Directive 2011/83/UE).
Amendment 41
Proposal for a regulation
Article 3 – paragraph 1 – point 2
| Text proposed by the Commission | Amendment |
|---|---|
| (2) ‘customer’ means a natural or a legal person who makes use of financial products and services; | (2) ‘customer’ means a natural or a legal person residing in the Union who makes use of financial products and services; |
Or. en
Justification
It is suggested to insert a geographical limitation in line with other EU financial services legislation (such as PSD, GDPR, Data Act).
Amendment 42
Proposal for a regulation
Article 3 – paragraph 1 – point 2 a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (2a) ‘data’ means any digital representation of acts, facts or information and any compilation of such acts, facts or information, including in the form of sound, visual or audiovisual recording; |
Or. en
Justification
Definition of data taken from Data governance act (Regulation (EU) 2022/868) and Data Act (as adopted; publication in OJ forthcoming).
Amendment 43
Proposal for a regulation
Article 3 – paragraph 1 – point 3
| Text proposed by the Commission | Amendment |
|---|---|
| (3) ‘customer data’ means personal and non-personal data that is collected, stored and otherwise processed by a financial institution as part of their normal course of business with customers which covers both data provided by a customer and data generated as a result of customer interaction with the financial institution; | (3) ‘customer data’ means personal and non-personal data that is collected, stored and otherwise processed by a financial institution as part of its normal course of business and existing direct relationship with its customers in connection with its authorised activities. This covers both data provided by a customer and data generated as a result of customer interaction with the financial institution; |
Or. en
Justification
Consistent with the EDPS opinion, it is suggested to exclude from the FiDA scope any data that a data holder derived or inferred from data provided by a customer as a result of profiling. Furthermore, it is suggested to explicitly link the data access obligation to those categories of customer data that the data holder collects, stores or processes in connection with the activity for which it is licensed.
Amendment 44
Proposal for a regulation
Article 3 – paragraph 1 – point 4
| Text proposed by the Commission | Amendment |
|---|---|
| (4) ‘competent authority’ means the authority designated by each Member State in accordance with Article 17 and for financial institutions it means any of the competent authorities listed in Article 46 of Regulation (EU) 2022/2554; | (4) ‘competent authority’ means the authority designated by each Member State in accordance with Article 17; |
Or. en
Justification
Deletion of part-sentence that is unnecessary in view of Article 17 paragraph 4.
Amendment 45
Proposal for a regulation
Article 3 – paragraph 1 – point 5
| Text proposed by the Commission | Amendment |
|---|---|
| (5) ‘data holder’ means a financial institution other than an account information service provider that collects, stores and otherwise processes the data listed in Article 2(1) ; | (5) ‘data holder’ means a financial institution that collects, stores or otherwise processes the data listed in Article 2(1) which relates to a customer in the context of the financial institution’s direct relationship with that customer; |
Or. en
Justification
Deletion of part-sentence that is unnecessary in view of the definition of “financial institution” in Article 3 paragraph 8. Furthermore, clarification that a data holder is an entity that collects the data from a customer with whom it has a direct relationship.
Amendment 46
Proposal for a regulation
Article 3 – paragraph 1 – point 6 a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (6a) ‘financial information service‘ means the online service of collecting, consolidating, storing and processing customer data to customers; |
Or. en
Justification
It is suggested to introduce a definition of ‘financial information service’. This helps to align FiDA better with PSD and gives FISPs a similar role to account information service providers. The EDPS also advocates introducing such a definition in its opinion (point 43). The suggested definition links explicitly refers to ‘financial service’, to avoid that customer data under the FiDA framework would be used for purposes that have no connection whatsoever with financial services.
Amendment 47
Proposal for a regulation
Article 3 – paragraph 1 – point 6 b (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (6b) ‘financial service’ means any service of a banking, credit, insurance, personal pension, investment or payment nature; |
Or. en
Justification
This is linked to the suggested introduction of a definition of ‘financial information service’. The definition is taken from Article 2(b) of Directive 2002/65/EC on distance marketing of consumer financial services.
Amendment 48
Proposal for a regulation
Article 3 – paragraph 1 – point 7
| Text proposed by the Commission | Amendment |
|---|---|
| (7) ‘financial information service provider’ means a data user that is authorised under Article 14 to access the customer data listed in Article 2(1) for the provision of financial information services; | (7) ‘financial information service provider’ means an entity providing a financial information service that is authorised under Article 14 to access the customer data listed in Article 2(1) for the provision of financial information services; |
Or. en
Justification
This clarification also aims at contributing a level playing field and data access reciprocity.
Amendment 49
Proposal for a regulation
Article 3 – paragraph 1 – point 9
| Text proposed by the Commission | Amendment |
|---|---|
| (9) ‘investment account’ means any register managed by an investment firm, credit institution or an insurance broker about the current holdings in financial instruments or insurance-based investment products of their client, including past transactions and other data points relating to lifecycle events of that instrument | deleted |
Or. en
Justification
This definition seems unnecessary, as the term “investment account” is not used anywhere in the Regulation.
Amendment 50
Proposal for a regulation
Article 3 – paragraph 1 – point 10
| Text proposed by the Commission | Amendment |
|---|---|
| (10) ‘non-personal data’ means data other than personal data as defined in Article 4(1) of Regulation (EU) 2016/679; | (10) ‘non-personal data’ means data other than personal data; |
Or. en
Justification
To fully align with definitions as in Data governance act (Regulation (EU) 2022/868) and Data Act (as adopted; publication in OJ forthcoming).
Amendment 51
Proposal for a regulation
Article 3 – paragraph 1 – point 28 a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (28a) ‘crowdfunding service provider’ means a crowdfunding service provider as defined in Article 2(1), point (e), of Regulation (EU) 2020/1503 of the European Parliament and of the Council1a; | |
| 1a Regulation (EU) 2020/1503 of the European Parliament and of the Council of 7 October 2020 on European crowdfunding service providers for business, and amending Regulation (EU) 2017/1129 and Directive (EU) 2019/1937 (OJ L 347, 20.10.2020, p. 1). |
Or. en
Justification
It is suggested to include a definition of 'crowdfunding service provider', as such providers are listed in Article 2 (2).
Amendment 52
Proposal for a regulation
Article 3 – paragraph 1 – point 28 b (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (28b) ‘trade secret’ means trade secret as defined in Article 2, point (1), of Directive (EU) 2016/943; |
Or. en
Justification
Is is suggested to include a definition of 'trade secret', as the term appears in the Regulation. This definition is aligned with the Data Act (as voted, publication in OJ forthcoming.)
Amendment 53
Proposal for a regulation
Article 3 – paragraph 1 – point 29
| Text proposed by the Commission | Amendment |
|---|---|
| (29) ‘legal representative’ means a natural person domiciled in the Union or a legal person with its registered office in the Union, and which, expressly designated by a financial information service provider established in a third country, acts on behalf of such financial information service provider vis-à-vis the authorities, clients, bodies and counterparties to the financial information service provider in the Union with regard to the financial information service provider’s obligations under this Regulation; | deleted |
Or. en
Justification
This definition is no longer needed if Article 13 is deleted.
Amendment 54
Proposal for a regulation
Article 4 – title
| Text proposed by the Commission | Amendment |
|---|---|
| Obligation to make available data to the customer | Obligation on a data holder to make data available to the customer |
Or. en
Justification
To mirror the title of Article 5.
Amendment 55
Proposal for a regulation
Article 4 – paragraph 1
| Text proposed by the Commission | Amendment |
|---|---|
| The data holder shall, upon request from a customer submitted by electronic means, make the data listed in Article 2(1) available to the customer without undue delay, free of charge, continuously and in real-time. | The data holder shall, upon request from a customer submitted by electronic means, make the readily available data listed in Article 2(1) available to the customer via an online or mobile customer interface in an easily readable format, without undue delay, free of charge, and where relevant and technically feasible, continuously and in real-time. |
Or. en
Justification
It seems useful to specify explicitly, for the avoidance of any doubt, that data holders shall make available data to the customers via online or mobile interfaces. Furthermore, closer alighment with Data Act (as adopted; publication in OJ forthcoming).
Amendment 56
Proposal for a regulation
Article 5 – paragraph 1
| Text proposed by the Commission | Amendment |
|---|---|
| 1. The data holder shall, upon request from a customer submitted by electronic means, make available to a data user the customer data listed in Article 2(1) for the purposes for which the customer has granted permission to the data user. The customer data shall be made available to the data user without undue delay, continuously and in real-time. | 1. The data holder shall, upon explicit request from a customer submitted by electronic means, make available to a data user acting on behalf of the customer the customer data listed in Article 2(1) only for the purposes relating to the specific service for which the customer has given explicit permission for the use of their data. The customer data shall be made available to the data user without undue delay, and where relevant and technically feasible, continuously and in real-time. |
Or. en
Justification
Before enabling access to their data, customers should give explicit permission for clearly specified purposes.
Amendment 57
Proposal for a regulation
Article 5 – paragraph 1 a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| 1a. Any undertaking designated as a gatekeeper, pursuant to Article 3 of Regulation (EU) 2022/1925, shall not be an eligible data user under this Regulation. |
Or. en
Justification
It is suggested to introduce a provision to prevent gatekeepers under the Digital Markets Act to access data under FiDA. The wording is inspired by Article 5 paragraph 3 of the Data Act (as adopted; publication on OJ forthcoming).
Amendment 58
Proposal for a regulation
Article 5 – paragraph 3 – point e
| Text proposed by the Commission | Amendment |
|---|---|
| (e) respect the confidentiality of trade secrets and intellectual property rights when customer data is accessed in accordance with Article 5(1). | (e) protect the confidentiality of trade secrets and intellectual property rights. |
Or. en
Justification
A data user should at all times protect the confidentiality of trade secrets and intellectual property rights.
Amendment 59
Proposal for a regulation
Article 6 – paragraph 1
| Text proposed by the Commission | Amendment |
|---|---|
| 1. A data user shall only be eligible to access customer data pursuant to Article 5(1) if that data user is subject to prior authorisation by a competent authority as a financial institution or is a financial information service provider pursuant to Article 14. | 1. A data user shall only be eligible to provide financial information services within the Union if that data user is a financial institution or a legal person established in the Union that has been authorised as financial information service provider pursuant to Article 14. |
Or. en
Justification
To maintain a level playing field, in order not to jeopardise effective supervision of these new actors, and to protect customers against possible misuse of their data, is suggested to remove the possibility for undertakings that are not established in the EU to benefit from an authorisation as a FISP. Third country providers should not be allowed to conduct activities if they are not properly licensed for such activities in a specific member state. Such option does not exist under PSD2 either for e.g. AISPs and would therefore result in a discriminatory situation between FISPs and AISPs.
Amendment 60
Proposal for a regulation
Article 6 – paragraph 2
| Text proposed by the Commission | Amendment |
|---|---|
| 2. A data user shall only access customer data made available under Article 5(1) for the purposes and under the conditions for which the customer has granted its permission. A data user shall delete customer data when it is no longer necessary for the purposes for which the permission has been granted by a customer. | 2. A data user shall only request and access any type of customer data made available under Article 5(1) that is adequate, relevant and necessary for the purposes and under the conditions for which the customer has granted its permission. Those purposes shall be strictly limited to the provision of a financial product or a financial service. They shall relate only to the specific service for which the customer has given its explicit permission. The permission granted by the customer shall be free, specific, informed and unequivocal. A data user shall delete received customer data, including any backups, without undue delay when it is no longer necessary for the purposes for which the permission has been granted by a customer. |
Or. en
Justification
As recommended by the EDPS in its opinion (point 24). Furthermore it is suggested to add “without undue delay" to align more closely with the "right to be forgotten" in Regulation 2018/1725.
Amendment 61
Proposal for a regulation
Article 6 – paragraph 2 a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| 2a. A data user shall ensure that any data access request to a customer provides the customer with fair, transparent and adequate information that is easily understandable for the target audience of the financial product or service, including on the specific types of customer data the data user seeks access to. |
Or. en
Justification
This amendment aims at improving customer protection, including by taking into account a recommendation made by the EDPS in its opinion (point 23).
Amendment 62
Proposal for a regulation
Article 6 – paragraph 2 b (new)
| Text proposed by the Commission | Amendment |
|---|---|
| 2b. A data user shall ensure that any data access request to a customer is not designed in a way that would encourage or unduly influence the customer to grant access, in a way that is not in the best interest of the customer, or in a way that materially distorts or impairs the ability of the customer to make free and informed decisions. |
Or. en
Justification
Data users should be left no possibility to request permission from the customer for an unspecified purpose, as this could lead to data being used for more purposes than intended by the customer. Any use of data should always be in the best interest of the customer.
Amendment 63
Proposal for a regulation
Article 6 – paragraph 2 c (new)
| Text proposed by the Commission | Amendment |
|---|---|
| 2c. The European Supervisory Authorities may develop draft regulatory technical standards on the implementation of this paragraph for specific practices, including pre-ticked boxes and behavioural nudges. |
Or. en
Justification
This provision might benefit from further guidance at level 2.
Amendment 64
Proposal for a regulation
Article 6 – paragraph 4 – introductory part
| Text proposed by the Commission | Amendment |
|---|---|
| 4. To ensure the effective management of customer data, a data user shall: | 4. To ensure the effective management of data, a data user shall: |
Or. en
Justification
Trade secrets could be seen as outside customer data.
Amendment 65
Proposal for a regulation
Article 6 – paragraph 4 – point -a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (-a) identify itself and securely communicate with the data holder when accessing customer data; |
Or. en
Justification
Analogous to PSD2/3, FISPs should be obliged to identify themselves and communicate securely with the data holder.
Amendment 66
Proposal for a regulation
Article 6 – paragraph 4 – point a
| Text proposed by the Commission | Amendment |
|---|---|
| (a) not process any customer data for purposes other than for performing the service explicitly requested by the customer; | (a) not process any customer data for purposes other than for performing the service explicitly requested by the customer in the best interest of the customer; |
Or. en
Justification
It is suggested to specify that processing the customer data for performing the service should be “in the best interest of the customer”.
Amendment 67
Proposal for a regulation
Article 6 – paragraph 4 – point b
| Text proposed by the Commission | Amendment |
|---|---|
| (b) respect the confidentiality of trade secrets and intellectual property rights when customer data is accessed in accordance with Article 5(1); | (b) protect the confidentiality of trade secrets and intellectual property rights when customer data is made available in accordance with Article 5(1); |
Or. en
Justification
It is suggested that the data user should “protect” and not only “respect” trade secrets and intellectual property rights. Furthermore, Article 5(1) refers to making data available instead of being accessed.
Amendment 68
Proposal for a regulation
Article 6 – paragraph 4 – point b a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (ba) respect the data protection rights of consumers and the level of protection guaranteed by General Data Protection Regulation. |
Or. en
Justification
It seems adequate to also refer to data protection regulation in this list of obligations to data users to ensure the effective management of customer data.
Amendment 69
Proposal for a regulation
Article 6 – paragraph 4 – point c
| Text proposed by the Commission | Amendment |
|---|---|
| (c) put in place adequate technical, legal and organisational measures in order to prevent the transfer of or access to non-personal customer data that is unlawful under Union law or the national law of a Member State; | (c) put in place adequate technical, legal and organisational measures in order to prevent the transfer of or access to customer data that is unlawful under Union law or the national law of a Member State; |
Or. en
Justification
It is suggested not to limit the scope of this provision to only non-personal customer data only.
Amendment 70
Proposal for a regulation
Article 6 – paragraph 4 – point c a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (ca) not transfer customer data to any third party without the customer’s explicit permission. |
Or. en
Justification
The customer's permission is required for the transfer of data to another group entity as per point (f) in this paragraph. A fortiori, such permission should also be required prior to any transfer to another entity that is not part of the group.
Amendment 71
Proposal for a regulation
Article 6 – paragraph 4 – point d
| Text proposed by the Commission | Amendment |
|---|---|
| (d) take necessary measures to ensure an appropriate level of security for the storage, processing and transmission of non-personal customer data; | (d) take necessary measures to ensure an appropriate level of security for the storage, processing and transmission of customer data; |
Or. en
Justification
It is suggested not to limit the scope of this provision to only non-personal customer data.
Amendment 72
Proposal for a regulation
Article 6 – paragraph 4 – point e
| Text proposed by the Commission | Amendment |
|---|---|
| (e) not process customer data for advertising purposes, except for direct marketing in accordance with Union and national law; | (e) only contact customers for direct marketing purposes subject to their prior consent or with offers for products or services similar to the ones for which they have accessed customer data and under the conditions provided by Article 13(2) of the ePrivacy Directive; |
Or. en
Justification
As recommended by the EDPS in its opinion (point 25), this suggestion aims a increasing legal certainty and reducing the risks of targeted advertising which is not expected by the data subject.
Amendment 73
Proposal for a regulation
Article 6 – paragraph 4 – point e a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (ea) not make the data it receives available to an undertaking designated as a gatekeeper pursuant to Article 3 of Regulation (EU) 2022/1925. |
Or. en
Justification
It is suggested to introduce a provision to prevent gatekeepers under the Digital Markets Act to access data under FiDA. The wording is inspired by Article 6 paragraph 2 point (d) of the Data Act (as adopted; publication on OJ forthcoming).
Amendment 74
Proposal for a regulation
Article 6 – paragraph 4 – point f
| Text proposed by the Commission | Amendment |
|---|---|
| (f) where the data user is part of a group of companies, customer data listed in Article 2(1) shall only be accessed and processed by the entity of the group that acts as a data user. | (f) where the data user is part of a group of companies, customer data listed in Article 2(1) shall only be made available to and processed by the entity of the group that acts as a data user. |
Or. en
Justification
Article 5(1) refers to making data available instead of being accessed.
Amendment 75
Proposal for a regulation
Article 7 – paragraph 1
| Text proposed by the Commission | Amendment |
|---|---|
| 1. The processing of customer data referred to in Article 2(1) of this Regulation that constitutes personal data shall be limited to what is necessary in relation to the purposes for which they are processed. | 1. The processing of customer data referred to in Article 2(1) of this Regulation shall be limited to what is necessary in relation to the purposes for which they are processed. |
Or. en
Justification
It is suggested not to limit the scope of this provision to only personal data. This is also in line with Article 6(4) point (a), which relates to both personal and non-personal customer data.
Amendment 76
Proposal for a regulation
Article 7 – paragraph 1 a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| 1a. [EBA, ESMA and EIOPA] shall develop draft regulatory technical standards the implementation of paragraph 1 of this Article for products and services related to the credit score of the consumer. | |
| [EBA, ESMA and EIOPA] shall submit those draft regulatory technical standards to the Commission by ... [12 months from the date of entry into force of this amending Regulation]. | |
| Power is delegated to the Commission to supplement this Regulation by adopting regulatory technical standards referred to in the first subparagraph of this paragraph in accordance with Articles 10 to 14 of Regulation (EU) No 1093/2010. |
Or. en
Justification
Guidance at level 2 is useful to prevent the risk of consumer data being misused.
Amendment 77
Proposal for a regulation
Article 7 – paragraph 2
| Text proposed by the Commission | Amendment |
|---|---|
| 2. In accordance with Article 16 of Regulation (EU) No 1093/2010, the European Banking Authority (EBA) shall develop guidelines on the implementation of paragraph 1 of this Article for products and services related to the credit score of the consumer. | 2. In accordance with Article 16 of Regulation (EU) No 1093/2010, the European Banking Authority (EBA) shall develop guidelines on the implementation of paragraph 1 of this Article for products and services related to the credit score of the consumer, to mortgage credit agreements, to the provision of payment services and to investment products. |
Or. en
Justification
Guidance at level 2 is useful to prevent the risk of consumer data being misused.
Amendment 78
Proposal for a regulation
Article 7 – paragraph 3
| Text proposed by the Commission | Amendment |
|---|---|
| 3. In accordance with Article 16 of Regulation (EU) No 1094/2010, the European Insurance and Occupational Pensions Authority (EIOPA) shall develop guidelines on the implementation of paragraph 1 of this Article for products and services related to risk assessment and pricing of a consumer in the case of life, health and sickness insurance products. | 3. The European Insurance and Occupational Pensions Authority (EIOPA) shall develop draft regulatory technical standards on the implementation of paragraph 1 of this Article for products and services related to risk assessment and pricing of a consumer in the case of life, health and sickness insurance products. To avoid certain consumers becoming unable to access insurance due to overly granular risk assessments, those regulatory technical standards shall include provisions on how data may be used to avoid excessive granularity that undermines the "risk sharing" principle of insurance. |
| The EIOPA shall submit the draft regulatory technical standards referred to in the first subparagraph to the Commission by ... [XX]. | |
| Power is delegated to the Commission to supplement this Regulation by adopting the regulatory technical standards referred to in the first subparagraph of this paragraph in accordance with Articles 10 to 14 of Regulation (EU) No 1093/2010. |
Or. en
Justification
Strong and binding measures are necessary in this area to prevent the risk of consumer data being misused. It is therefore suggested to mandate the ESAs to develop RTSs that list a finite set of data that may be collected and used for each of the use cases covered in Article 7. This is in line with the GDPR Article 5(1) principles of “purpose limitation” and “data minimisation”, while preserving a degree of flexibility as RTSs can be updated to reflect new developments.
Amendment 79
Proposal for a regulation
Article 7 – paragraph 4
| Text proposed by the Commission | Amendment |
|---|---|
| 4. When preparing the guidelines referred to in paragraphs 2 and 3 of this Article, EIOPA and EBA shall closely cooperate with the European Data Protection Board established by Regulation (EU) 2016/679. | 4. When preparing the guidelines and draft regulatory standards referred to in paragraphs 2 and 3 of this Article, EIOPA and EBA shall formally consult the European Data Protection Board established by Regulation (EU) 2016/679. |
Or. en
Justification
Formal consultation of EDPB follows a recommendation made by the EDPS in its opinion (point 30).
Amendment 80
Proposal for a regulation
Article 7 – paragraph 4 a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| 4a. Consumers shall not be denied access to a financial product on the sole basis of not giving permission to their data being accessed via the framework established by this Regulation. For the purposes of the implementation of this paragraph, the burden of proof shall lie with the data user. |
Or. en
Justification
Consumers should not be denied access to a financial product only because they do not give permission to their data being accessed via the FiDA framework. This suggestion is in line with the EDPS opinion (point 22) and aims at preventing risks of financial exclusion of customers having regard to both eligibility for and pricing of financial products and services.
Amendment 81
Proposal for a regulation
Article 8 – paragraph 1
| Text proposed by the Commission | Amendment |
|---|---|
| 1. A data holder shall provide the customer with a permission dashboard to monitor and manage the permissions a customer has provided to data users. | 1. A data holder shall provide the customer with an easily accessible permission dashboard to monitor and manage the permissions a customer has provided to data users. |
Or. en
Justification
The permission dashboard should be easily accessible.
Amendment 82
Proposal for a regulation
Article 8 – paragraph 2 – point -a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (-a) empower the customer to manage each permission in an informed and impartial manner. |
Or. en
Justification
In line with point 38 of the EDPS opinion, it is suggested to reflect this sentence from recital 21 also in the enacting provision.
Amendment 83
Proposal for a regulation
Article 8 – paragraph 2 – point a – introductory part
| Text proposed by the Commission | Amendment |
|---|---|
| (a) provide the customer with an overview of each ongoing permission given to data users, including: | (a) provide the customer at any time with an overview of each ongoing permission given to each data user, including: |
Or. en
Justification
Customers should at any time have the right to know which of their data is used by which data user.
Amendment 84
Proposal for a regulation
Article 8 – paragraph 2 – point a – point -i (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (-i) the date when the customer has given the permission; |
Or. en
Justification
To enable customers to effectively manage their permissions, it is useful to include the date of permission in this overview.
Amendment 85
Proposal for a regulation
Article 8 – paragraph 2 – point a – point iv
| Text proposed by the Commission | Amendment |
|---|---|
| (iv) the categories of data being shared; | (iv) the categories of data to which access has been granted; |
Or. en
Justification
Alignment of wording with point (ii).
Amendment 86
Proposal for a regulation
Article 8 – paragraph 2 – point a – point iv a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (iva) the location where the data is stored; |
Or. en
Justification
The dashboard should enable customers to know the exact location where their data is stored, at any time.
Amendment 87
Proposal for a regulation
Article 8 – paragraph 2 – point b
| Text proposed by the Commission | Amendment |
|---|---|
| (b) allow the customer to withdraw a permission given to a data user; | (b) allow the customer to withdraw a permission given to a data user at any time; |
Or. en
Justification
A customer should be able to withdraw a permission at any time.
Amendment 88
Proposal for a regulation
Article 8 – paragraph 2 – point c
| Text proposed by the Commission | Amendment |
|---|---|
| (c) allow the customer to re-establish any permission withdrawn; | (c) allow the customer to re-establish any permission withdrawn at any time; |
Or. en
Justification
A customer should be able to re-establish a withdrawn permission at any time.
Amendment 89
Proposal for a regulation
Article 8 – paragraph 3
| Text proposed by the Commission | Amendment |
|---|---|
| 3. The data holder shall ensure that the permission dashboard is easy to find in its user interface and that information displayed on the dashboard is clear, accurate and easily understandable for the customer. | 3. The data holder shall ensure that the permission dashboard is easy to find in its user interface and that information displayed on the dashboard is clear, objective, accurate and easily understandable for the customer and exclusively limited to information provided by the relevant data user. |
Or. en
Justification
The suggested addition aims at clarifying that the permissions dashboard should not be allowed to display any (speculative) information, which has not been provided by the data user.
Amendment 90
Proposal for a regulation
Article 8 – paragraph 3 a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| 3a. The data holder shall ensure that the permission dashboard is not designed in a way that would encourage or unduly influence the customer to grant or withdraw permissions, in a way that is not in the best interest of the customer, or in a way that materially distorts or impairs the ability of the customers to make free and informed decisions. |
Or. en
Justification
In line with point 38 of the EDPS opinion, it is suggested to reflect this sentence from recital 21 also in the enacting provision.
Amendment 91
Proposal for a regulation
Article 8 – paragraph 4 – introductory part
| Text proposed by the Commission | Amendment |
|---|---|
| 4. The data holder and the data user for which permission has been granted by a customer shall cooperate to make information available to the customer via the dashboard in real-time. To fulfil the obligations in paragraph 2 points (a), (b), (c) and (d) of this Article: | 4. The data holder and the data user for which permission has been granted by a customer shall cooperate to make information available to the customer via the dashboard in real-time. To fulfil the obligations in paragraph 2 of this Article: |
Or. en
Justification
These specific references are redundant.
Amendment 92
Proposal for a regulation
Article 8 – paragraph 4 – point a
| Text proposed by the Commission | Amendment |
|---|---|
| (a) The data holder shall inform the data user of changes made to a permission concerning that data user made by a customer via the dashboard. | (a) The data holder shall inform the data user of changes made to a permission, including a withdrawal, concerning that data user made by a customer via the dashboard. |
Or. en
Justification
A withdrawal of a permission also constitutes a change to the permission. It is suggested to mention this explicitly for the sake of clarity.
Amendment 93
Proposal for a regulation
Article 8 – paragraph 4 a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| 4a. For the purpose of this Article, different data holders may collectively provide a permission dashboard to customers, provided that such a collective permission dashboard fulfils the requirements set out in paragraphs 1 to 4 of this Article. |
Or. en
Justification
Instead of having a multitude of data holders providing separate permission dashboards to customers, it might be more effective to have central permission dashboards. That way, customers are less likely to lose track of which permission they have given to whom. It is therefore suggested to allow data holders to work together to provide a collective permission dashboard.
Amendment 94
Proposal for a regulation
Title IV
| Text proposed by the Commission | Amendment |
|---|---|
| Financial Data Sharing Schemes | Financial Data Access Schemes |
| (This amendment applies throughout the text.) |
Or. en
Justification
It is suggested to use language that focuses more clearly on establishing data access rights for consumers and business customers. FiDA should first and foremost enable customers to take control over their data so that they can access and re-use it as they see fit.
Amendment 95
Proposal for a regulation
Article 9 – paragraph 2 – subparagraph 2
| Text proposed by the Commission | Amendment |
|---|---|
| Any sharing of data shall be made in accordance with the rules and modalities of a financial data sharing scheme of which both the data user and the data holder are members. | Any access of data shall be made in accordance with the rules and modalities of a financial data access scheme of which both the data user and the data holder are members. |
Or. en
Justification
It is suggested to use language that focuses more clearly on establishing data access rights for consumers and business customers. FiDA should first and foremost enable customers to take control over their data so that they can access and re-use it as they see fit.
Amendment 96
Proposal for a regulation
Article 10 – paragraph 1 – point a – point i
| Text proposed by the Commission | Amendment |
|---|---|
| (i) data holders and data users representing a significant proportion of the market of the product or service concerned, with each side having fair and equal representation in the internal decision-making processes of the scheme as well as equal weight in any voting procedures; where a member is both a data holder and data user, its membership shall be counted equally towards both sides; | (i) data holders and data users representing a significant proportion of the market of the product or service concerned, with each side having fair and equal representation in the internal decision-making processes of the scheme as well as every member having equal weight within their side in any voting procedures; where a member is both a data holder and data user, its membership shall be counted equally towards both sides; |
Or. en
Justification
Fair and equal representation deserves a clarification, to avoid that large companies would interpret this provision wrongly by advocating a distribution of voting rights according to company size, which is not the intention of the legislator. Decision making processes that are not dominated by a small number of large companies would moreover incentivise SMEs to join data access schemes.
Amendment 97
Proposal for a regulation
Article 10 – paragraph 1 – point a – point ii
| Text proposed by the Commission | Amendment |
|---|---|
| (ii) customer organisations and consumer associations. | (ii) customer organisations and consumer associations in relation to the financial sector. |
Or. en
Justification
The cusomer organisations and consumer associations involved in the financial data access schemes should have expertise in relation to the financial sector.
Amendment 98
Proposal for a regulation
Article 10 – paragraph 1 – point d
| Text proposed by the Commission | Amendment |
|---|---|
| (d) a financial data sharing scheme shall not impose any controls or additional conditions for the sharing of data other than those provided in this Regulation or under other applicable Union law; | (d) a financial data access scheme shall not impose any controls or additional conditions for the access or re-use of data other than those provided in this Regulation or under other applicable Union law; |
Or. en
Justification
It is suggested to use language that focuses more clearly on establishing data access rights for consumers and business customers. FiDA should first and foremost enable customers to take control over their data so that they can access and re-use it as they see fit.
Amendment 99
Proposal for a regulation
Article 10 – paragraph 1 – point g
| Text proposed by the Commission | Amendment |
|---|---|
| (g) a financial data sharing scheme shall include the common standards for the data and the technical interfaces to allow customers to request data sharing in accordance with Article 5(1). The common standards for the data and technical interfaces that scheme members agree to use may be developed by scheme members or by other parties or bodies; | (g) a financial data access scheme shall include the common standards for the data and the technical interfaces to allow customers to request data access in accordance with Article 5(1). The common standards for the data and technical interfaces that scheme members agree to use shall draw on existing international or industry-recognized standards or may be developed by scheme members or by other parties or bodies in coordination with the European Data Innovation Board established by Regulation (EU) 2022/868; |
Or. en
Justification
By creating synergies with data from other relevant sectors, the innovative potential of such financial products and financial services could be further enhanced to the benefit of customers and the overall data economy. To promote the use of cross-sector data, it is suggested to refer to the EDIB as established by the Data Governance Act.
Amendment 100
Proposal for a regulation
Article 10 – paragraph 1 – point g a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (ga) a financial data access scheme shall include the minimum technical and organisational measures that financial data access scheme members shall implement to ensure an appropriate level of security for exchanged data. |
Or. en
Justification
This follows a suggestion by the EDPS in its opinion (point 45).
Amendment 101
Proposal for a regulation
Article 10 – paragraph 1 – point h – subparagraph 1 – introductory part
| Text proposed by the Commission | Amendment |
|---|---|
| (h) a financial data sharing scheme shall establish a model to determine the maximum compensation that a data holder is entitled to charge for making data available through an appropriate technical interface for data sharing with data users in line with the common standards developed under point (g). The model shall be based on the following principles: | (h) a financial data access scheme shall establish a model to determine the maximum compensation that a data holder is entitled to charge the data user for making data available through an appropriate technical interface for enabling the data user to access data in line with the common standards developed under point (g). The model shall be based on the following principles: |
Or. en
Justification
Clarification to more closely align with Article 5.
Amendment 102
Proposal for a regulation
Article 10 – paragraph 1 – point h – subparagraph 1 – point i
| Text proposed by the Commission | Amendment |
|---|---|
| (i) it should be limited to reasonable compensation directly related to making the data available to the data user and which is attributable to the request; | (i) it should be limited to reasonable and proportionate compensation related to the costs incurred in making the data available to the data user and which is attributable to the request. When agreeing on any compensation, the scheme members shall take into account in particular the costs necessary for the formatting of data, dissemination via electronic means and storage, and investments in the collection and production of data, where applicable, taking into account whether other parties contributed to obtaining, generating, or collecting the data in question. The compensation may also depend on the volume, format and nature of the data; |
Or. en
Justification
Closer alignment with Article 9 paragraphs 2 and 3 of the Data Act (as adopted; publication on OJ forthcoming). The deletion of the word “directly” aims at more clearly delineating the exemption in the final subparagraph of point (h).
Amendment 103
Proposal for a regulation
Article 10 – paragraph 1 – point h – subparagraph 1 – point ii
| Text proposed by the Commission | Amendment |
|---|---|
| (ii) it should be based on an objective, transparent and non-discriminatory methodology agreed by the scheme members; | (ii) it should be based on an objective, transparent and non-discriminatory methodology agreed by the scheme members and may include a margin; |
Or. en
Justification
Closer alignment with Article 9 paragraph 1 of the Data Act (as adopted; publication on OJ forthcoming).
Amendment 104
Proposal for a regulation
Article 10 – paragraph 1 – point h – subparagraph 1 – point v
| Text proposed by the Commission | Amendment |
|---|---|
| (v) it should be devised to gear compensation towards the lowest levels prevalent on the market; and | (v) it should be devised to gear compensation towards the lowest levels prevalent on the market, while ensuring that there are sufficient incentives to foster market adoption and effective competition; and |
Or. en
Justification
Data holders should be sufficiently incentivised to build and maintain the necessary infrastructure for making data available.
Amendment 105
Proposal for a regulation
Article 10 – paragraph 1 – point h – subparagraph 2
| Text proposed by the Commission | Amendment |
|---|---|
| Where the data user is a micro, small or medium enterprise, as defined in Article 2 of the Annex to Commission Recommendation 2003/361/EC of 6 May 200342 , any compensation agreed shall not exceed the costs directly related to making the data available to the data recipient and which are attributable to the request. | Where the data user is a micro, small or medium enterprise, as defined in Article 2 of the Annex to Commission Recommendation 2003/361/EC of 6 May 200342 , any compensation agreed shall not exceed the costs directly related to making the data available to the data user and which are attributable to the request. |
| 42 Commission Recommendation of 6 May 2003 concerning the definition of micro, small and medium-sized enterprises (C(2003) 1422) OJ L 124, 20.5.2003, p. 36. | 42 Commission Recommendation of 6 May 2003 concerning the definition of micro, small and medium-sized enterprises (C(2003) 1422) OJ L 124, 20.5.2003, p. 36. |
Or. en
Justification
As the term “data recipient” is not defined in Article 3, it is suggested to use the term “data user” instead.
Amendment 106
Proposal for a regulation
Article 10 – paragraph 1 – point h – subparagraph 2 a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| The Commission shall adopt guidelines on the calculation of reasonable and proportionate compensation, taking into account the advice of the European Data Innovation Board (EDIB) established by Regulation (EU) 2022/868. |
Or. en
Justification
In line with Article 9 paragraph 6 of the Data Act (as adopted; publication on OJ forthcoming), it is suggested to provide for level 2 guidance on the calculation of compensation and to refer to the EDIB as established by the Data Governance Act.
Amendment 107
Proposal for a regulation
Article 10 – paragraph 1 – point i a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (ia) a financial data access scheme shall provide for a mechanism of financial compensation to customers for any loss of data, damage or fraud suffered by those customers; |
Or. en
Justification
Customers that gave permission to access their data should be compensated by data holders and/or data users in the event of misuse, loss or fraud involving this data. Financial data access schemes should therefore provide rules on such compensation to customers.
Amendment 108
Proposal for a regulation
Article 10 – paragraph 4
| Text proposed by the Commission | Amendment |
|---|---|
| 4. A financial data sharing scheme set up in accordance with this Article shall be notified to the competent authority of establishment of the three most significant data holders which are members of that scheme at the time of establishment of the scheme. Where the three most significant data holders are established in different Member States, or where there is more than one competent authority in the Member State of establishment of the three most significant data holders, the scheme shall be notified to all of these authorities which shall agree among themselves which authority shall carry out the assessment referred to in paragraph 6. | 4. A financial data access scheme set up in accordance with this Article shall be notified to the European Supervisory Authorities. |
Or. en
Justification
It suggested that the schemes are assessed at European level by the ESAs rather than at national level by the competent authorities. The Commission proposal already suggested a certain level of centralisation by the establishment of the register proposed in Article 15, including schemes. It would be more logical, therefore, to leave also the assessment to the ESAs, in order to avoid differing assessments of schemes by national authorities that could jeopardise a level playing field.
Amendment 109
Proposal for a regulation
Article 10 – paragraph 6 – subparagraph 1
| Text proposed by the Commission | Amendment |
|---|---|
| Within 1 month of receipt of the notification pursuant to paragraph 4, the competent authority shall assess whether the financial data sharing scheme’s governance modalities and characteristics are in compliance with paragraph 1. When assessing the compliance of the financial data sharing scheme with paragraph 1, the competent authority may consult other competent authorities. | Within 1 month of receipt of the notification pursuant to paragraph 4, the European Supervisory Authorities shall assess whether the financial data access scheme’s governance modalities and characteristics are in compliance with paragraph 1. When assessing the compliance of the financial data access scheme with paragraph 1, the European Supervisory Authorities may consult other competent authorities, including the supervisory authorities under Regulation (EU) 2016/679. |
Or. en
Justification
The Commission proposal already suggested a certain level of centralisation at EU level in the Article 15 register. To avoid differing assessment of schemes by NCAs that could jeopardise a level playing field, it is suggested to further increase the role of the ESAs. Furthermore, a suggestion made by the EDPS in its opinion (point 49) is taken on board: given the foreseeable data protection implications, it seems adequate to explicitly refer to the supervisory authorities under the GDPR.
Amendment 110
Proposal for a regulation
Article 10 – paragraph 6 – subparagraph 2
| Text proposed by the Commission | Amendment |
|---|---|
| Upon completion of its assessment, the competent authority shall inform EBA of a notified financial data sharing scheme that satisfies the provisions of paragraph 1. A scheme notified to EBA in accordance with this paragraph shall be recognised in all the Member States for the purpose of accessing data pursuant to Article 5(1) and shall not require further notification in any other Member State. | Upon completion of its assessment, the European Supervisory Authorities shall include the notified financial data access scheme in the register defined in Article 15. |
Or. en
Justification
This paragraph is no longer needed if the process is streamlined by giving this task to ESAs rather than to the NCA. It is instead suggested that notified financial data access scheme is included in the central register defined in Article 15.
Amendment 111
Proposal for a regulation
Article 10 – paragraph 6 a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| 6a. The European Supervisory Authorities shall undertake regular comprehensive reviews of data access schemes’ governance arrangements set out in Article 10(1). Those reviews shall include a thorough and documented assessment whether the schemes’ arrangements are appropriate and credible for the purposes of ensuring the responsible treatment of customer data. |
Or. en
Justification
It is suggested to require the ESAs to regularly undertake a comprehensive review of the governance arrangements that goes beyond a purely formalistic “box-ticking” exercise of the criteria set out in Article 10(1).
Amendment 112
Proposal for a regulation
Article 11 – paragraph 1 – introductory part
| Text proposed by the Commission | Amendment |
|---|---|
| In the event that a financial data sharing scheme is not developed for one or more categories of customer data listed in Article 2(1) and there is no realistic prospect of such a scheme being set up within a reasonable amount of time, the Commission is empowered to adopt a delegated act in accordance with Article 30 to supplement this Regulation by specifying the following modalities under which a data holder shall make available customer data pursuant to Article 5(1) for that category of data: | In the event that a financial data access scheme is not completely developed for one or more categories of customer data listed in Article 2(1) and there is no realistic prospect of such a scheme being completed within a reasonable amount of time, the Commission is empowered to adopt a delegated act in accordance with Article 30 to supplement this Regulation by specifying the following modalities under which a data holder shall make available customer data pursuant to Article 5(1) for that category of data: |
Or. en
Justification
Clarification that the financial data access scheme should be complete.
Amendment 113
Proposal for a regulation
Article 11 – paragraph 1 a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| When developing a delegated act for the purpose of the first subparagraph that specifies the modalities referred to in point (a), the Commission shall consult the European Data Protection Supervisor pursuant to Article 42(1) of Regulation (EU) 2018/1725. |
Or. en
Justification
This follows a suggestion by the EDPS in its opinion (point 46).
Amendment 114
Proposal for a regulation
Article 12 – paragraph 1
| Text proposed by the Commission | Amendment |
|---|---|
| 1. A financial information service provider shall be eligible to access customer data under Article 5(1) if it is authorised by the competent authority of a Member State. | 1. A legal person shall be eligible to access customer data under Article 5(1) and provide financial information services if it is authorised by the competent authority of a Member State. |
Or. en
Justification
At the moment of application, the company is not yet a FISP as per the definition in Article 3(7). Wording with “legal person” inspired by the crowdfunding regulation.
Amendment 115
Proposal for a regulation
Article 12 – paragraph 2 – subparagraph 1 – introductory part
| Text proposed by the Commission | Amendment |
|---|---|
| A financial information service provider shall submit an application for authorisation to the competent authority of the Member State of establishment of its registered office, together with the following: | A legal person who intends to provide financial information services shall apply to the competent authority of the Member State for authorisation as a financial information service provider, that is, where it intends to carry out substantive business activities, together with the following: |
Or. en
Justification
At the moment of application, the company is not yet a FISP as per the definition in Article 3(7). Wording with “legal person” inspired by the crowdfunding regulation. Furthermore, FISPs should be established in the EU, with a registered office in a Member State where they carry out or intend to carry out substantive business activities.
Amendment 116
Proposal for a regulation
Article 12 – paragraph 2 – subparagraph 1 – point a
| Text proposed by the Commission | Amendment |
|---|---|
| (a) a programme of operations setting out in particular the type of access to data envisaged; | (a) a programme of operations setting out in particular the type of access to data and financial information services envisaged; |
Or. en
Justification
It is suggested to extend the provision on the content of the programme of operations to the financial information services that the applicant intends to provide.
Amendment 117
Proposal for a regulation
Article 12 – paragraph 2 – subparagraph 1 – point c
| Text proposed by the Commission | Amendment |
|---|---|
| (c) a description of the applicant’s governance arrangements and internal control mechanisms, including administrative, risk management and accounting procedures, as well as arrangements for the use of ICT services in accordance with Regulation (EU) 2022/2554 of the European Parliament and of the Council, which demonstrates that those governance arrangements, control mechanisms and procedures are proportionate, appropriate, sound and adequate; | (c) a description of the applicant’s governance arrangements and internal control mechanisms, including administrative, risk management and accounting procedures, as well as arrangements for the use of ICT services in accordance with Chapter II of Regulation (EU) 2022/2554 of the European Parliament and of the Council, which demonstrates that those governance arrangements, control mechanisms and procedures are proportionate, appropriate, sound and adequate; |
Or. en
Justification
More precise reference to DORA.
Amendment 118
Proposal for a regulation
Article 12 – paragraph 2 – subparagraph 1 – point e
| Text proposed by the Commission | Amendment |
|---|---|
| (e) a description of business continuity arrangements including a clear identification of the critical operations, effective ICT business continuity policy and plans and ICT response and recovery plans, and a procedure to regularly test and review the adequacy and efficiency of such plans in accordance with Regulation (EU) 2022/2554; | (e) a description of business continuity arrangements including a clear identification of the critical operations, effective ICT business continuity policy and plans and ICT response and recovery plans, and a procedure to regularly test and review the adequacy and efficiency of such plans in accordance with Chapter II of Regulation (EU) 2022/2554; |
Or. en
Justification
More specific reference to DORA.
Amendment 119
Proposal for a regulation
Article 12 – paragraph 2 – subparagraph 1 – point j
| Text proposed by the Commission | Amendment |
|---|---|
| (j) the address of the applicant’s head office; | (j) the address of the applicant’s head office office and, where available, the Legal Entity Identifier (LEI); |
Or. en
Justification
The ISO 17742 Legal Entity Identifier (LEI), as a global, readily-available, and machine-readable standard, would provide an efficient way to help verify the identity of any applicant FISP that wishes to access customer data under the FIDA framework.
Amendment 120
Proposal for a regulation
Article 12 – paragraph 3 – subparagraph 1 – introductory part
| Text proposed by the Commission | Amendment |
|---|---|
| Financial information service providers shall hold a professional indemnity insurance covering the territories in which they access data, or some other comparable guarantee, and shall ensure the following: | Financial information service providers shall hold a professional indemnity insurance covering the territories in which they offer financial information services, or some other comparable guarantee on liability, and shall ensure the following: |
Or. en
Justification
Clarification.
Amendment 121
Proposal for a regulation
Article 12 – paragraph 3 – subparagraph 1 – point a
| Text proposed by the Commission | Amendment |
|---|---|
| (a) an ability to cover their liability resulting from non-authorised or fraudulent access to or non-authorised or fraudulent use of data; | (a) an ability to cover their liability resulting from professional negligence, non-authorised or fraudulent access to or non-authorised or fraudulent use of data; |
Or. en
Justification
It is suggested that professional negligence should be covered by the professional indemnity insurance or other comparable coverage.
Amendment 122
Proposal for a regulation
Article 12 – paragraph 3 – subparagraph 2
| Text proposed by the Commission | Amendment |
|---|---|
| As an alternative to holding a professional indemnity insurance or other comparable guarantee as required in the first sub-paragraph, the undertaking as referred in the previous subparagraph shall hold initial capital of EUR 50 000, which can be replaced by a professional indemnity insurance or other comparable guarantee after it commences its activity as financial information service provider, without undue delay. | As an alternative to holding a professional indemnity insurance or other comparable guarantee as required in the first sub-paragraph, the undertaking as referred in the previous subparagraph shall hold initial capital of EUR 50 000, which shall, without undue delay, be replaced by a professional indemnity insurance or other comparable guarantee on liability after it commences its activity as financial information service provider. |
Or. en
Justification
Given the importance of appropriate insurance coverage, it should be mandatory to conclude a professional indemnity insurance or comparable guarantee.
Amendment 123
Proposal for a regulation
Article 12 – paragraph 3 a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| 3a. Financial information service providers authorised in accordance with Article 14 shall at all times meet the conditions for their authorisation. |
Or. en
Justification
It seems adequate to state explicitly that a FISP should at all times comply with the conditions of its authorisation.
Amendment 124
Proposal for a regulation
Article 12 – paragraph 4 – subparagraph 1 – point a
| Text proposed by the Commission | Amendment |
|---|---|
| (a) the information to be provided to the competent authority in the application for the authorisation of financial information service providers, including the requirements laid down in paragraph 1, points (a) to (l); | (a) the information to be provided to the competent authority in the application for the authorisation of financial information service providers, including the requirements laid down in paragraph 2, points (a) to (k); |
Or. en
Justification
Correction of a wrong reference. This relates to paragraph 2, in which there is no point (l).
Amendment 125
Proposal for a regulation
Article 12 – paragraph 4 – subparagraph 1 – point c
| Text proposed by the Commission | Amendment |
|---|---|
| (c) what is a comparable guarantee, as referred in paragraph 2, which should be interchangeable with a professional indemnity insurance; | (c) what is a comparable guarantee, as referred in paragraph 3, which should be interchangeable with a professional indemnity insurance; |
Or. en
Justification
Correction of a wrong reference.
Amendment 126
Proposal for a regulation
Article 12 – paragraph 4 – subparagraph 2 – introductory part
| Text proposed by the Commission | Amendment |
|---|---|
| In developing these regulatory technical standards, EBA shall take account of the following: | In developing these draft regulatory technical standards, EBA shall take account of the following: |
Or. en
Justification
To be more precise.
Amendment 127
Proposal for a regulation
Article 12 – paragraph 4 – subparagraph 4
| Text proposed by the Commission | Amendment |
|---|---|
| Power is conferred to the Commission to adopt the regulatory technical standards referred to in the first subparagraph of this paragraph in accordance with Articles 10 to 14 of Regulation 1093/2015. | Power is conferred to the Commission to adopt the regulatory technical standards referred to in the first subparagraph of this paragraph in accordance with Articles 10 to 14 of Regulation (EU) No 1093/2010. |
Or. en
Justification
Correction of a wrong reference.
Amendment 128
Proposal for a regulation
Article 12 – paragraph 4 a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| 4a. Any undertaking designated as a gatekeeper, pursuant to Article 3 of Regulation (EU) 2022/1925, shall not be eligible for authorisation as a financial information service provider under this Regulation. |
Or. en
Justification
It is suggested to prevent gatekeepers under the Digital Markets Act to access data under FiDA. The wording is inspired by Article 5 paragraph 3 of the Data Act (as adopted; publication on OJ forthcoming).
Amendment 129
Proposal for a regulation
Article 13
| Text proposed by the Commission | Amendment |
|---|---|
| Article 13 | deleted |
| Legal representatives | |
| 1. Financial information service providers that do not have an establishment in the Union but that require access to financial data in the Union shall designate, in writing, a legal or natural person as their legal representative in one of the Member States from where the financial information service provider intends to access financial data. | |
| 2. Financial information service providers shall mandate their legal representatives to be addressed in addition to or instead of the financial information service provider by the competent authorities on all issues necessary for the receipt of, compliance with and enforcement of this Regulation. Financial information service providers shall provide their legal representative with the necessary powers and resources to enable them to cooperate with the competent authorities and ensure compliance with their decisions. | |
| 3. The designated legal representative may be held liable for non-compliance with obligations under this Regulation, without prejudice to the liability and legal actions that could be initiated against the financial information service provider. | |
| 4. Financial information service providers shall notify the name, address, the electronic mail address and telephone number of their legal representative to the competent authority in the Member State where that legal representative resides or is established. They shall ensure that that information is up to date. | |
| 5. The designation of a legal representative within the Union pursuant to paragraph 1 shall not constitute an establishment in the Union. |
Or. en
Justification
In order to maintain a level playing field, not to jeopardise effective supervision of these new actors, and to protect customers against possible misuse of their data, is suggested to remove the possibility for undertakings that are not established in the EU to benefit from an authorisation as a FISP. Third country providers should not be allowed to conduct activities if they are not properly licensed for such activities in a specific member state. Such option does not exist under PSD2 either for e.g. AISPs and would therefore result in a discriminatory situation between FISPs and AISPs.
Amendment 130
Proposal for a regulation
Article 14 – paragraph 1
| Text proposed by the Commission | Amendment |
|---|---|
| 1. The competent authority shall grant an authorisation if the information and evidence accompanying the application complies with of the requirements laid down in Article 11(1) and (2). Before granting an authorisation, the competent authority may, where relevant, consult other relevant public authorities. | 1. The competent authority shall grant an authorisation if the information and evidence accompanying the application complies with the requirements laid down in Article 12(1) and (2) and if the competent authority’s overall assessment, having scrutinised the application, is favourable. Before granting an authorisation, the competent authority may, where relevant, consult other relevant public authorities, including the supervisory authorities under Regulation (EU) 2016/679. |
Or. en
Justification
This follows a suggestion by the EDPS in its opinion (point 49). Given the foreseeable data protection implications, it seems adequate to explicitly refer to the supervisory authorities under the GDPR. Furthermore closer alignment with PSD2 / proposal on PSD3 and correction of a reference (Article 12 instead of Article 11).
Amendment 131
Proposal for a regulation
Article 14 – paragraph 2
| Text proposed by the Commission | Amendment |
|---|---|
| 2. The competent authority shall authorise a third country financial information service provider provided that all the following conditions are met: | deleted |
| (a) the third country financial information service provider has complied with all conditions laid down in Article 12 and 16; | |
| (b) the third country financial information service provider has designated a legal representative pursuant to Article 13; | |
| (c) where the third country financial information service provider is subject to supervision, the competent authority shall seek to put in place an appropriate cooperation arrangement with the relevant competent authority of the third country where the financial information service provider is established, to ensure an efficient exchange of information; | |
| (d) the third country where the financial information service provider is established is not listed as a non-cooperative jurisdiction for tax purposes under the relevant Union policy or as a high-risk third-country jurisdiction that presents deficiencies in accordance with Commission Delegated Regulation (EU) 2016/1675.44 | |
| 44 Commission Delegated Regulation (EU) 2016/1675 of 14 July 2016 supplementing Directive (EU) 2015/849 of the European Parliament and of the Council by identifying high-risk third countries with strategic deficiencies |
Or. en
Justification
To maintain a level playing field, in order not to jeopardise effective supervision of these new actors, and to protect customers against possible misuse of their data, is suggested to remove the possibility for undertakings that are not established in the EU to benefit from an authorisation as a FISP. Third country providers should not be allowed to conduct activities if they are not properly licensed for such activities in a specific member state. Such option does not exist under PSD2 either for e.g. AISPs and would therefore result in a discriminatory situation between FISPs and AISPs.
Amendment 132
Proposal for a regulation
Article 14 – paragraph 4 a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| 4a. The competent authority shall grant an authorisation only if it is satisfied that the governance arrangements of the financial information service provider demonstrate that it intends to carry out substantive business activities in the Member State where it has its registered office. |
Or. en
Justification
FISPs should be established in the EU, with a registered office in a Member State where they carry out or intend to carry out substantive business activities. Competent authorities should verify compliance with these requirements during the authorisation process.
Amendment 133
Proposal for a regulation
Article 14 – paragraph 6
| Text proposed by the Commission | Amendment |
|---|---|
| 6. Within 3 months of receipt of an application or, if the application is incomplete, of all of the information required for the decision, the competent authority shall inform the applicant whether the authorisation is granted or refused. The competent authority shall give reasons where it refuses an authorisation. | 6. Within 3 months of receipt of a complete application, the competent authority shall inform the applicant whether the authorisation is granted or refused. The competent authority shall give reasons where it refuses an authorisation |
Or. en
Justification
It should not be possible to obtain authorisation on the basis of an incomplete application. The 3 months period should only start once the NCAs have received all information (so a complete application).
Amendment 134
Proposal for a regulation
Article 14 – paragraph 7 – subparagraph 1 – point a
| Text proposed by the Commission | Amendment |
|---|---|
| (a) does not make use of the authorisation within 12 months, expressly renounces the authorisation or has ceased to engage in business for more than 6 months; | (a) does not make use of the authorisation within 12 months, requests the competent authority to withdraw the authorisation or has ceased to engage in business for more than 6 months; |
Or. en
Justification
More precise wording.
Amendment 135
Proposal for a regulation
Article 14 – paragraph 7 – subparagraph 1 – point c
| Text proposed by the Commission | Amendment |
|---|---|
| (c) no longer meets the conditions for granting the authorisation or fails to inform the competent authority on major developments in this respect; | (c) no longer meets the conditions for granting the authorisation or fails to inform the competent authority on major developments in this respect; or |
Or. en
Justification
Clarification that fulfilment of one of the conditions is sufficient.
Amendment 136
Proposal for a regulation
Article 14 – paragraph 7 – subparagraph 1 – point d
| Text proposed by the Commission | Amendment |
|---|---|
| (d) would constitute a risk to consumer protection and the security of data. | (d) would constitute a risk to consumer protection or the security of data. |
Or. en
Justification
A risk to consumer protection or a risk to the security of date should be a sufficient condition.
Amendment 137
Proposal for a regulation
Article 14 – paragraph 7 a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| 7a. The European Supervisory Authorities or the competent authority of any host Member State may at any time request the competent authority of the home Member State to examine whether the financial information service provider still complies with the conditions under which the authorisation was granted, when there are grounds to suspect that this may no longer be the case. |
Or. en
Justification
In the event of suspected non-compliance, the ESAs or host Member States NCAs should be able to require the competent authority of the home Member State to verify that a given FISP is still in compliance with FiDA. The wording is inspired by MiCA Article 67(4).
Amendment 138
Proposal for a regulation
Article 15 – paragraph 1 – point a
| Text proposed by the Commission | Amendment |
|---|---|
| (a) the authorised financial information service providers. | (a) the authorised financial information service providers, including the name, the address and, where applicable, the authorisation number, and a description of the financial information services offered; |
Or. en
Justification
Including more information about and a description of the financial information services offered by authorised FISPs in the register improves transparency and could help to promote the innovative potential of open finance.
Amendment 139
Proposal for a regulation
Article 15 – paragraph 2
| Text proposed by the Commission | Amendment |
|---|---|
| 2. The register referred to in paragraph 1 shall only contain anonymised data. | deleted |
Or. en
Justification
The purpose of the register seems somewhat defeated if it only contains anonymised data. It is therefore suggested to delete this provision.
Amendment 140
Proposal for a regulation
Article 15 – paragraph 3
| Text proposed by the Commission | Amendment |
|---|---|
| 3. The register shall be publicly available on EBA’s website and shall allow for easy searching and accessing the information listed. | 3. The register shall be publicly available on EBA’s website and shall allow for easy searching and accessing the information listed, free of charge. |
Or. en
Justification
Alignment with PSD2 Article 15 paragraph 1 and PSD3 proposal Article 18 paragraph 2.
Amendment 141
Proposal for a regulation
Article 15 – paragraph 5
| Text proposed by the Commission | Amendment |
|---|---|
| 5. The competent authorities of Member States shall communicate without delay to EBA the information necessary to fulfil its tasks pursuant to paragraphs 1 and 3. Competent authorities shall be responsible for the accuracy of the information specified in paragraphs 1 and 3 and for keeping that information up to date. They shall, where technically possible, transmit this information to EBA in an automated way. | 5. The competent authorities of the Member States where financial information service providers are authorised shall communicate without delay, and where possible in an automated way, to EBA the information necessary to fulfil its tasks pursuant to paragraphs 1 and 4. Competent authorities shall be responsible for the accuracy of the information specified in paragraphs 1 and 3 and for keeping that information up to date. They shall, where technically possible, transmit this information to EBA in an automated way. |
Or. en
Justification
Clarification that this task should be performed by the “home” NCAs, and ideally in an automated way. It is further sugggested to correct a wrong reference.
Amendment 142
Proposal for a regulation
Article 16 – paragraph 1 – point b
| Text proposed by the Commission | Amendment |
|---|---|
| (b) it shall take reasonable steps to ensure continuity and regularity in the performance of its activities. To that end the financial information service provider shall employ appropriate and proportionate systems, resources and procedures to ensure the continuity of its critical operations, have in place contingency plans and a procedure to test and review regularly the adequacy and efficiency of such plans; | (b) it shall take reasonable steps to ensure continuity and regularity in the performance of its activities. To that end the financial information service provider shall employ appropriate and proportionate systems, human and technical resources and procedures to ensure the continuity of its critical operations, have in place contingency plans and a procedure to test and review regularly the adequacy and efficiency of such plans; |
Or. en
Justification
Clarification.
Amendment 143
Proposal for a regulation
Article 16 – paragraph 1 – point c
| Text proposed by the Commission | Amendment |
|---|---|
| (c) when relying on a third party for the performance of functions which are critical for the provision of continuous and satisfactory service to customers and the performance of activities on a continuous and satisfactory basis, that it takes reasonable steps to avoid undue additional operational risk. Outsourcing of important operational functions may not be undertaken in such a way as to impair materially the quality of its internal control and the ability of the supervisor to monitor the financial information service provider’s compliance with all obligations; | (c) when relying on a third party for the performance of functions which are critical for the provision of continuous and satisfactory service to customers and the performance of activities on a continuous and satisfactory basis, that it takes reasonable steps to avoid undue additional operational risk. Outsourcing of important operational functions may not be undertaken in such a way as to impair materially the quality of its internal control and the ability of the competent authority to monitor the financial information service provider’s compliance with all obligations; |
Or. en
Justification
As “supervisor” is a non-defined term, it is suggested to refer to the competent authority.
Amendment 144
Proposal for a regulation
Article 16 – paragraph 1 – point e
| Text proposed by the Commission | Amendment |
|---|---|
| (e) its directors and persons responsible for its management as well as the persons responsible for the management of the data access activities of the financial information service provider are of good repute and possess appropriate knowledge, skills and experience, both individually and collectively, to perform their duties; | (e) its directors and persons responsible for its management as well as the persons responsible for the management of the financial information service activities of the financial information service provider are of good repute and possess appropriate knowledge, skills and experience, both individually and collectively, to perform their duties in relation to the types of data which are subject to the processing; the data subjects concerned; the entities to, and the purposes for which, the personal data may be disclosed; the purpose limitation; storage periods; and processing operations and processing procedures, including measures to ensure lawful and fair processing such as those for other specific processing situations; |
Or. en
Justification
The suggested replacement of “data access” by “financial information service” follows from the suggested insertion in Article 3 of a definition of “financial information service”. Furthermore it seems adequate to more closely align the good repute criteria with Article 6 GDPR.
Amendment 145
Proposal for a regulation
Article 16 – paragraph 1 – point f
| Text proposed by the Commission | Amendment |
|---|---|
| (f) it shall establish and maintain effective and transparent procedures for the prompt, fair and consistent monitoring, handling and follow up of a security incident and security related customer complaints, including a reporting mechanism which takes account of the notification obligations laid down in Chapter III of Regulation (EU) 2022/2554; | (f) it shall establish and maintain effective and transparent procedures to ensure the confidentiality, availability and integrity of data in the event of a security incident and for the prompt, fair and consistent monitoring, handling and follow up of a security incident and security related customer complaints, including a reporting mechanism which takes account of the notification obligations laid down in Chapter III of Regulation (EU) 2022/2554; |
Or. en
Justification
It is suggested to include an additional security requirement relating to ensuring the confidentiality, availability and integrity of data in case of a security incident.
Amendment 146
Proposal for a regulation
Article 17 – paragraph 1
| Text proposed by the Commission | Amendment |
|---|---|
| 1. Member States shall designate the competent authorities responsible for carrying out the functions and duties provided for in this Regulation. Member States shall notify those competent authorities to the Commission. | 1. Member States shall designate the competent authorities responsible for carrying out the functions and duties provided for in this Regulation, including the supervision of financial data access schemes and compliance of financial information services providers with this Regulation. Member States shall notify those competent authorities to the Commission. |
Or. en
Justification
It is suggested to explicitly refer to the competent authorities’ responsibility of overseeing financial data access schemes and compliance of FISPs with the Regulation.
Amendment 147
Proposal for a regulation
Article 17 – paragraph 2 – subparagraph 2
| Text proposed by the Commission | Amendment |
|---|---|
| Member States shall ensure that those competent authorities have the necessary resources, notably in terms of dedicated staff, in order to comply with their tasks as per the obligations under this Regulation. | Member States shall ensure that those competent authorities have the necessary human and technical resources, notably in terms of dedicated staff, in order to comply with their tasks as per the obligations under this Regulation. |
Or. en
Justification
Clarification.
Amendment 148
Proposal for a regulation
Article 18 – paragraph 3
| Text proposed by the Commission | Amendment |
|---|---|
| 3. In the exercise of their investigatory and sanctioning powers, including in cross border cases, competent authorities shall cooperate effectively with each other and with the authorities from any sector concerned as applicable to each case and in accordance with national and Union law, to ensure the exchange of information and the mutual assistance necessary for the effective enforcement of administrative sanctions and administrative measures. | 3. In the exercise of their investigatory and sanctioning powers, including in cross border cases, competent authorities shall cooperate effectively with each other, with the supervisory authorities under Regulation (EU) 2016/679, and with the authorities from any sector concerned as applicable to each case and in accordance with national and Union law, to ensure the exchange of information and the mutual assistance necessary for the effective enforcement of administrative sanctions and administrative measures. |
Or. en
Justification
Given the foreseeable data protection dimensions, it seems adequate to explicitly refer to the supervisory authorities under the GDPR.
Amendment 149
Proposal for a regulation
Article 19 – paragraph 1
| Text proposed by the Commission | Amendment |
|---|---|
| 1. Without prejudice to Article 20, Member States may lay down rules enabling their competent authorities to close an investigation concerning an alleged breach of this Regulation, following a settlement agreement in order to put an end to the alleged breach and its consequences before formal sanctioning proceedings are started. | 1. Without prejudice to Article 20, Member States may lay down rules enabling their competent authorities to close an investigation or formal sanctioning proceedings concerning an alleged breach of this Regulation, following a settlement agreement in order to put an end to the alleged breach and its consequences before formal sanctioning proceedings are started or to close formal sanctioning proceedings by way of settlement. |
Or. en
Justification
To take into account that applicable law is not harmonised across the EU.
Amendment 150
Proposal for a regulation
Article 20 – paragraph 1 – point d
| Text proposed by the Commission | Amendment |
|---|---|
| (d) infringements of Articles 13 and 16; | (d) infringements of Articles 12, 13 and 16; |
Or. en
Justification
It is suggested that infringements of Article 12, in particular regarding the obligation to hold indemnity insurance, should also be subject to administrative measures.
Amendment 151
Proposal for a regulation
Article 28 – paragraph 2 – subparagraph 1 – point a
| Text proposed by the Commission | Amendment |
|---|---|
| (a) the name, the address and, where applicable, the authorisation number of the financial information service provider; | (a) the name, the address and, where applicable, the authorisation number and the Legal Entity Identifier (LEI) of the financial information service provider; |
Or. en
Justification
The ISO 17742 Legal Entity Identifier (LEI), as a global, readily-available, and machine-readable standard, would provide an efficient way to help verify the identity of any FISP.
Amendment 152
Proposal for a regulation
Article 28 – paragraph 2 – subparagraph 1 – point d
| Text proposed by the Commission | Amendment |
|---|---|
| (d) the financial data sharing schemes it is a member. | (d) the financial data access schemes of which it is a member. |
Or. en
Justification
More precise wording.
Amendment 153
Proposal for a regulation
Article 28 – paragraph 2 – subparagraph 1 – point d a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| (da) a description of the service it intends to provide. |
Or. en
Justification
To ensure that NCAs are informed of FISPs’ access to customer data located in other MS, it is suggested to oblige FISPs to communicate to the home NCA a description to the services they intend to provide. The home NCA should then share this information with host NCAs in accordance with paragraph 3.
Amendment 154
Proposal for a regulation
Article 28 – paragraph 4 a (new)
| Text proposed by the Commission | Amendment |
|---|---|
| 4a. Where the competent authority of a host Member State has reasonable grounds for believing that a financial information service provider acting within its territory under the freedom to provide services or the freedom of establishment infringes the provisions of this Regulation as regards its use of the data of customers located within the host Member State, the competent authority of such host Member State shall have the power to temporarily suspend transmission of data of those customers from data holders to that financial information service provider, until the competent authority of the home Member State has taken the necessary measures to make infringements cease. |
Or. en
Justification
It is suggested to strengthen the powers of host competent authorities where consumer protection is affected by misconducts of FISPs established in another Member State and acting in the host Member State under the freedom to provide services or the freedom of establishment. Any host competent authority should be allowed to suspend the transmission of customer data from data holders to such FISP in order to cease infringements to FiDA that are conducive of harms to consumer interests in the host Member State, notably when there is a suspected fraud.
Amendment 155
Proposal for a regulation
Article 31 – paragraph -1 (new)
| Text proposed by the Commission | Amendment |
|---|---|
| -1. By ... [one year from the date of entry into application of this Regulation], and every year thereafter, the European Supervisory Authorities shall present a joint annual public report to the European Parliament, the Council and the Commission on the application of this Regulation. | |
| The report referred to in subparagraph 1 shall contain at least the following: | |
| a) a description of developments in the activities of financial information service providers; | |
| b) an appraisal of whether any changes are needed to the measures set out in this Regulation to ensure the protection of customers and to foster the development of innovative services. |
Or. en
Justification
It is important to identify any risks in terms of consumer protection or obstacles to the development of new financial information services under the FiDA framework well ahead of the potential legislative review. It is therefore suggested to oblige the ESAs to annually produce a joint report on the application of the FiDA Regulation.
Explanatory statement 52 paragraphs
1. Background
On 28 June 2023, the European Commission adopted a proposal for a Regulation of the European Parliament and the Council on a framework for Financial Data Access and amending Regulations (EU) No 1093/2010, (EU) No 1094/2010, (EU) No 1095/2010 and (EU) No 2022/2554 (“FiDA”).
The FiDA proposal aims to enable consumers and firms to more efficiently control access to their financial data beyond payments, thus allowing them to benefit from financial products and services that are tailored to their needs while keeping in check associated risks. This represents a shift from open banking with PSD2 towards open finance that should also promote the digital transformation and speed up the adoption of data-driven business models in the EU financial sector.
The 2020 Digital Finance strategy and the 2021 Communication on a Capital Markets Union announced the Commission’s intention to promote data-driven finance with a legislative proposal. Against this background, in her 2022 State of the Union letter of intent, Commission President von der Leyen confirmed data access in financial services as a key Commission initiative for 2023.
The main provisions in FiDA relate to:
Enhancing customer trust in data sharing;
Obliging data holders to share customer data with data users;
Promoting standardisation of customer data and interfaces; and
Promoting implementation of high-quality interfaces for customer data sharing.
2. Procedure in the European Parliament
The Committee on Economic and Monetary Affairs (ECON) was appointed as the lead Committee to deal with the proposal.
3. Draft report
Building on data combination and aggregation, open finance facilitates the provision of new financial products and services that may better service customer needs, for example in areas such as financial advice, insurance, or pension preparation. An enhanced customer experience will empower customers to make better informed financial decisions and effectively reap tangible benefits from FiDA.
Your Rapporteur enthusiastically welcomes the FiDA proposal and fully supports both its overall objective and general direction. He is nevertheless of the opinion that the proposal can be positively amended concerning several key features, and suggests slight modifications along the following main axes.
Enhancing customer trust
Your Rapporteur defends a customer-centric approach. For a safe and successful implementation of the FiDA framework, customers should first and foremost have full confidence in its safety, reliability, and fairness. Any access to customers’ financial data should have due consideration for data privacy. Upholding strong consumer protection also requires strong safeguards, most notably related to permission and liability.
In line with the opinion delivered by the European Data Protection Supervisor (EDPS), your Rapporteur therefore more clearly circumscribes the categories of personal data that can made available under FiDA, taking into account the risks for individuals whose personal data would be accessed and used. To further prevent risks of financial exclusion, he also provides for an explicit prohibition on the denial of financial services to consumers who do not want to make their data available through the FiDA permission dashboard, suggests more granular guidance at level 2 for delineating appropriate uses of personal data, and fosters consistency between the application and implementation of FiDA and EU data protection law.
No other jurisdiction has to date adopted an open finance framework as broad as FiDA. Keeping in mind the importance of ensuring secure cross-border data flows that protect fundamental rights of EU consumers and business customers, especially when data are of a highly sensitive nature, your Rapporteur therefore suggests removing the possibility for undertakings that are not established in the EU to benefit from an authorisation as a financial information service provider. Following the same logic, he further recommends preventing designated gatekeepers under the Digital Markets Act from accessing data under FiDA.
Promoting innovation
Your Rapporteur believes that open finance is not about sharing the customers’ data, but about enabling customers to unlock and re-use their data in a secure way, as they see fit and at their own will, so that they can profit from a wider choice of service providers whilst maintaining full confidentiality. To focus the FiDA framework more clearly on such a data access right for consumers and business customers, he recommends adapting the narrative accordingly.
Adequate incentives are a prerequisite for fostering market adoption. Your Rapporteur’s suggestions aim at contributing to ensure that data holders build and maintain the necessary infrastructure for making data available. Most notably, provisions on compensation are more closely aligned with the market-driven approach under the Data Act.
Improving interoperability and supervision
The long-term success of the FiDA framework requires a minimum level of technical interoperability for data and data access infrastructures, alongside regulatory interoperability among different frameworks. Your Rapporteur suggests a number of modifications to foster such interoperability, including by more closely aligning FiDA with other EU legislation such as the GDPR, the Data Act, and the Data governance Act.
There is merit in further strengthening the role of the European Supervisory Authorities vis-à-vis that of the national competent authorities, e.g. by requiring the assessment of the financial data access scheme to take place at European level. This avoids differing assessments by national authorities that could jeopardise a level playing field. Your Rapporteur makes some preliminary suggestions in that direction, to be worked out should the Parliament negotiating team support this approach.
4. Stakeholder consultation
Whilst the amendments in the draft report contain the views of your Rapporteur only, he and his team are grateful for the input received from a variety of stakeholders, including:
American Express;
Association for Financial Markets in Europe (AFME);
Better Finance;
Bureau européen des unions de consommateurs (BEUC) ;
European Association of Co-operative Banks (EACB);
European Association of Credit Rating Agencies (EACRA);
European Association of Paritarian Institutions (AEIP);
European Banking Federation (EBF);
European Third Party Providers Association (ETTPA);
Febelfin;
Federation of Business Information Services (FEBIS);
Finance Watch;
French Banking Federation (FBF);
German Banking Industry Committee (GBIC);
German Insurance Association (GDV);
Global Legal Entity Identifier Foundation (GLEIF);
Hogan Lovells;
Insurance Europe;
Klarna;
Mastercard;
Pensions Europe;
Nederlands Verbond van Verzekeraars;
Nederlandse Pensioenfederatie;
Visa.
5. Way forward
Your Rapporteur emphasises that his draft report constitutes only a starting point for ECON’s work on FiDA. He looks forward to the contributions of the shadow rapporteurs, which he will approach with an open mind and a constructive attitude.