Regulation has never been more intense for the payments industry. The EU’s General Data Protection Regulation (GDPR) represents a watershed moment. This is not simply another data compliance headache. GDPR enshrines a new idea: that consumers have ultimate control of their data. Stuart Lacey, CEO and founder, Trunomi, writes
This concept will lead to a new model for the payments industry; one centred on the empowered customer and based on informed consent. At the same time, the Payment Services Directive II (PSD II) is also set to fundamentally change the way that customer data is shared and managed. With both pieces of legislation entering into force within six months of each other in 2018, it is time to consider the practical implications.
Go deeper with GlobalData
Payment firms and financial services providers have an opportunity to choose a path to compliance that not only ticks the boxes but also delivers a positive impact on customers, a core ambition for both regulations.
The regulatory imperative
From 25 May 2018, each business that handles sensitive data belonging to EU citizens will need to comply with GDPR. Broadly speaking, the aim of the regulation is to replace Data Protection Directive 95/46/EC and harmonise the EU’s current landscape of wildly differing data protection regulations.
Aligned with the ambitions of the GDPR, the core tenants of PSD II are enhancing consumer protection, promoting innovation and improving the security of payment services within the EU.
How well do you really know your competitors?
Access the most comprehensive Company Profiles on the market, powered by GlobalData. Save hours of research. Gain competitive edge.
Thank you!
Your download email will arrive shortly
Not ready to buy yet? Download a free sample
We are confident about the unique quality of our Company Profiles. However, we want you to make the most beneficial decision for your business, so we offer a free sample that you can download by submitting the below form
By GlobalDataBoth regulations will place the protection of personal customer data at the forefront of enterprise data management priorities and help maintain trust and transparency in digital services.
Specifically under the GDPR, businesses must provide customers with a digital copy of their personal data upon request, and in a form that is electronically transmissible to other processing systems. GDPR also enshrines the infamous ‘right to be forgotten’; mandating that businesses are able to erase customer data upon request by a customer.
For PSD II, APIs move centre stage. There are many opportunities for third parties to enter the fray and promote greater competition. One of the biggest changes being effected is the increase in scope to regulate payment initiation services and account information services. As a result, payment providers, banks and new entrants are being encouraged to deliver more innovative services to consumers and businesses.
In the future, both regulations are pushing to give consumers greater power over how companies use their data, and greater access to their own data and how it is being processed.
Firms will no longer be able to assume consent when processing personal data: it must be given explicitly.
The impact on the payments industry
Payments industry businesses – from merchants to the financial services organisations that support them – are increasingly looking at how they can monetise their customer data. There are direct monetisation models, where firms sell their anonymized customer data. For example, payments data can be aggregated by card payments processors and sold on to retailers to inform their sales strategies.
There are also indirect monetisation models where customer data is used to drive new services. For instance, banks can analyse the payments history of a customer to provide him/her with money saving tips. PSD II in particular is trying to open up the market to encourage dashboard services – account information services – that aggregate bank account information in a single place.
This provides a clear challenge to the payments industry. How can firms continue to monetise their data while also complying with the privacy and consent demands of new regulation?
Putting the customer in control
The challenge can be met if the payments industry embraces the idea of informed consent. This involves taking a customer-driven approach to information sharing where the consumer is empowered to share and rescind their consent, and with it their data.
Let’s be clear: it is not enough to simply put in place a means of asking for consent. Rather, organisations need to be able to capture gained consent in an auditable workflow. This requires a sophisticated information management platform; one which enables an automated and secure digital communication link with the customer.
Once consent is secured, payments industry businesses then need to find a flexible yet secure platform to store and manage the data in customer-driven way. One way firms are looking to build this framework is through digital rights management services that create a digital ‘vault’ for customers, in which to store their personal data. Such an approach enables simplified and streamlined Data Portability and the Right to be Forgotten; empowering customers and meeting the stipulations of GDPR.
A new model for a changed world
While the GDPR and PSD II are significant enabling events for the rollout of consent-driven data management, they are a symptom of a wider change. People are becoming more aware of the fact that merchants and financial services companies are collecting and using their data – often for profit.
Consumers and businesses are more invested in how their data is used and want to be able to give or revoke consent and to know that, where consent is given, their data is secure. Payments businesses can’t take customer consent for granted any more. They must proactively enable a customer-driven and customer-centric data framework and provide customers with the tools they need to view and manage their own data.
The result will be regulatory compliance, a much better customer experience and a new method for building customer loyalty. It will also mean they can expect to continue to monetise their data.
