On May 25 2018, the General Data Protection Regulation (GDPR) requirements come into full effect. This is set to redefine how banks, and every other industry, utilises and protects consumer data. So what is GDPR? Patrick Brusnahan writes
Adopted on 14 April 2016, GDPR is an EU law on data protection and privacy. It also affects how personal data is exported. The goal was to give citizens a greater share of control over their own personal data.
The gold standard of business intelligence.
Requests for consent must be clear, and not buried under pages of terms and conditions and there cannot be ‘preticked’ boxes giving consent to a company. In addition, making someone hand over more personal information for bonus features or a premium service no longer counts as freely given consent.
Consumers can also ask companies to delete their personal data or information. The company must do it or give a particularly good reason as to why they cannot.
GDPR is a regulation and not a directive and governments do not need to pass any other legislation regarding to it.
This has resulted in a recent splurge of companies sending emails to everyone on their mailing list asking people to review privacy policies and resubscribe to newsletters as the old way of gaining this information may not be compliant.
Access the most comprehensive Company Profiles on the market, powered by GlobalData. Save hours of research. Gain competitive edge.
Your download email will arrive shortly
We are confident about the unique quality of our Company Profiles. However, we want you to make the most beneficial decision for your business, so we offer a free sample that you can download by submitting the below form
Not complying to GDPR can result in heavy fines, the maximum being €20m () or 4% of a company’s global turnover, whichever is higher.
Banks, with their overwhelming supply of critical consumer data, need to be especially wary. There are four places in which GDPR will have the most impact:
To date, the biggest headline of GDPR is the massive fines of 4% of annual global turnover or £17m ($22.9m) it could impose.
While such fines certainly present a risk, a pragmatic approach is needed.
In addition, with the attention GDPR is getting, consumer could feel empowered and take a greater role in the usage of their data, something that banks have rarely had to contend with in the past.
Data breaches can affect millions of individuals and it is becoming increasingly common and reported on. With ‘mere distress’ being enough to claim damages, it is clear why banks should remain vigilant on GDPR.
Organisations can also be held liable for the actions of their employees, so it is not hard to see how the GDPR could increase litigation against banks.
Under GDPR, organisations will be required to maintain accurate and up-to-date personal data. Following a request to correct inaccurate data, organisations will have one month to comply, or three months in complicated cases.
Banks and other FIs already receive numerous claims from individuals who consider that their credit rating has been harmed by incorrect reporting and this can only rise following GDPR.
Individuals can request their personal data be erased under the ‘right to be forgotten’. This right is limited, but it could conflict with a financial institution’s requirement to keep records for regulatory reasons.
These regulatory requirements will prevail over requests to erase personal data, but it can be expected that numerous claims will be made over the failure to erase data by individuals who disagree with the application of these competing obligations.
Data breaches are constantly in the news. 2017 saw breaches for Morrisons, Uber and, Heathrow Airport, Pizza Hut, and Equifax.
As holders of large quantities of valuable personal information, financial institutions need to ensure sufficient protections are in place. In the event of a breach, organisations could face customer complaints to the Financial Ombudsman Service (FOS) and claims for damages from potentially millions of people, on top of fines.
