EBA欧洲银行-Report-on-Innovative-uses-of-data-2017_21页_707kb

Summary of the Report on Innovative Uses of Consumer Data by Financial Institutions

Core Content

This report by the European Banking Authority (EBA) evaluates the innovative uses of consumer data by financial institutions in the European Union (EU), focusing on the associated risks and potential benefits. The EBA was mandated by Article 9(4) of its founding Regulation to monitor financial innovation and ensure a consistent supervisory approach. The report is based on a Discussion Paper (DP) published in May 2016 and the subsequent responses from market participants.

Main Points

1. Accelerating Innovation in Consumer Data Use

• Innovative uses of consumer data are not uniformly widespread across the EU, but their adoption is increasing rapidly.
• Factors contributing to this growth include the revised Payment Services Directive (PSD2), the GDPR's data portability rights, and advancements in technologies like Big Data analytics, artificial intelligence, and open banking standards.
• Financial institutions are increasingly combining internal data with external sources (e.g., social media, data vendors) to offer personalized services and improve risk management.

2. Risks Identified and Their Assessment

• The EBA identified several risks in the DP, such as lack of consumer transparency, potential misuse of data, inaccurate decision-making, lock-in risks, cybersecurity threats, reputational risks, and risks to the financial sector's integrity.
• Respondents generally agreed with the risks outlined, though they noted that many are not unique to financial institutions and may vary in likelihood and impact.
• Cybersecurity concerns were highlighted, especially with the increasing interconnectedness in the financial sector and the access granted to third-party providers under PSD2.

3. Potential Benefits of Data Innovation

• If risks are properly managed, data innovation can lead to better consumer services, improved fraud detection, and enhanced financial inclusion.
• Financial institutions may benefit from increased cost/revenue efficiency, better risk management, and regulatory compliance.
• However, consumer associations expressed skepticism, particularly about the potential for data to be used in non-transparent pricing or to encourage excessive spending.

4. Legal Framework and Compliance

• The use of consumer data is already governed by a wide range of EU legal provisions, including the GDPR, PSD2, PAD, MCD, AMLD, and UCPD.
• These laws provide mechanisms to mitigate risks, such as transparency requirements, data minimisation, purpose limitation, and accountability measures.
• The GDPR, which will apply from 25 May 2018, is a key legal instrument that addresses many of the risks outlined in the DP, including the use of data for profiling, data portability, and the need for informed consent.

Key Information

Legal Requirements

• GDPR: Imposes strict rules on data processing, including the need for transparency, informed consent, data minimisation, and accountability. It also mandates the use of Data Protection Impact Assessments (DPIA) for high-risk processing.
• PSD2: Reinforces data protection principles for payment service providers and restricts third-party providers from using data for purposes other than those explicitly requested by the consumer.
• AMLD: Prohibits the further processing of data collected for anti-money laundering (AML) purposes for incompatible purposes, such as commercial use.
• UCPD: Addresses risks of unfair commercial practices, including the use of data for misleading or exploitative marketing.

Supervisory Actions

• The EBA does not currently see a need for new industry-specific legislation, but continues to monitor the development of data innovation.
• The EBA encourages cooperation between national competent authorities, the European Commission, and other European Supervisory Authorities (ESAs) to ensure consistent application of data laws across the EU.
• It also promotes education initiatives to raise consumer awareness about data usage and rights.

Future Considerations

• Risks specific to Big Data analytics are expected to be further assessed in joint work with ESMA and EIOPA.
• The EBA will continue to monitor the evolution of data innovation through case studies and by engaging with stakeholders.

Conclusion

The EBA concludes that while the innovative use of consumer data is growing, the existing legal framework provides sufficient safeguards to mitigate most of the identified risks. The focus is now on ensuring consistent application of these rules across the EU and fostering a balanced innovation environment that protects both consumers and financial institutions.