II. The Proposed Financial Data Access Regulation Framework

The proposed Financial Data Access Regulation framework is a legislative proposal introduced by the European Commission to address emerging challenges in the EU financial sector and provide a harmonised European response to them. The FIDA proposal is part of the European Commission’s wider European Finance StrategyFootnote ¹⁸ and European Data Strategy,Footnote ¹⁹ based on the foundations of the Data Governance Act,Footnote ²⁰ the Digital Markets Act,Footnote ²¹ and the Data Act.Footnote ²² The Commission hopes that the FIDA proposal fosters greater innovation in financial products and services, thereby enhancing the array of options available to consumers.Footnote ²³ Additionally, they anticipate that it increases competition within the financial sector, promoting a more dynamic and responsive marketplace.Footnote ²⁴ According to the European Commission, the FIDA proposal aims to achieve these goals by establishing a framework that facilitates data-driven finance by enabling efficient access and sharing of financial data while ensuring high privacy, security, safety, and ethical standards.Footnote ²⁵ The legislative proposal for the FIDA framework is thus driven by the European Commission’s commitment to fostering a data-driven economy. The proposal seeks to empower customers by providing better control over access to their financial data with the objective of enhancing economic outcomes for financial services customers and firms, allowing for personalised, data-powered products and services and creating new business opportunities for data-driven third-party service providers.Footnote ²⁶ The legislative intent is also to strike a balance between facilitating the flow and wide use of data in the financial sector while preserving robust standards for privacy, security, and risk management.Footnote ²⁷ The proposal has cleared the first reading stage in the Council, with the potential for minor adjustments as it progresses through the legislative process.Footnote ²⁸

The proposed FIDA framework ultimately concerns accessing, sharing, and using customers’ financial data, including natural or legal persons.Footnote ²⁹ Its scope is narrowed down to particular categories of customer data in Article 2, including mortgage credit agreementsFootnote ³⁰ and non-life insurance products.Footnote ³¹ The FIDA proposal would also apply to other institutions that act as data holders or users, including e.g. credit institutionsFootnote ³² and crypto-asset service providers.Footnote ³³

Concerning data access, the data holder must make specific data available to the customer upon the customer’s request.Footnote ³⁴ This includes continuously providing the data without undue delay, free of charge, and in real-time.Footnote ³⁵ The data holder must make customer data available to a data user based on the customer’s permission.Footnote ³⁶ Compensation may be claimed by the data holder from a data user only under specific conditions, such as compliance with financial data sharing scheme rules or other specified circumstances.Footnote ³⁷ Additionally, when making data available, the data holder must ensure the use of recognised standards,Footnote ³⁸ communicate securely with the data user,Footnote ³⁹ verify customer permissions,Footnote ⁴⁰ provide a permission dashboard to the customer,Footnote ⁴¹ and respect confidentiality and intellectual property rights.Footnote ⁴² The FIDA proposal outlines further obligations on data users. Data users can access customer data if they are authorised as a financial institution or financial information service provider by a competent authority.Footnote ⁴³ Data users can only access customer data for the specified purposes and conditions granted by the customer, and they must delete it when no longer necessary.Footnote ⁴⁴ Further to that, the FIDA proposal grants customers the right to withdraw their permission, especially in contractual obligations.Footnote ⁴⁵

Another duty is that data users must process customer data only for the explicitly requested service,Footnote ⁴⁶ implement security measures,Footnote ⁴⁷ respect confidentiality and intellectual property rights,Footnote ⁴⁸ prevent unlawful transfer or access to non-personal customer data,Footnote ⁴⁹ and refrain from processing customer data for advertising purposes unless allowed by EU and national law.Footnote ⁵⁰ If data users are part of a group of companies, customer data is limited to the entity acting as the data user within the group.Footnote ⁵¹ Further responsible data use is ensured by the data use perimeterFootnote ⁵² and the Financial Data Access permission dashboards.Footnote ⁵³ The FIDA proposal would thus significantly open data access while protecting the relevant interests of data customers, holders, and users. Customers would have a variety of choices to customise their experience in the dashboard:

‘A permission dashboard shall:

1. a) provide the customer with an overview of each ongoing permission given to data users, including:

   1. (i) the name of the data user to which access has been granted

   2. (ii) the customer account, financial product or financial service to which access has been granted;

   3. (iii) the purpose of the permission;

   4. (iv) the categories of data being shared;

   5. (v) the period of validity of the permission

2. b) allow the customer to withdraw a permission given to a data user;

3. c) allow the customer to re-establish any permission withdrawn;

4. d) include a record of perm’Footnote ⁵⁴

To facilitate data sharing, the FIDA proposal would establish financial data sharing schemes. It outlines that within 18 months of the FIDA proposal’s entry into force, data holders and users must become members of one or multiple financial data-sharing schemes.Footnote ⁵⁵ The proposal also outlines how such schemes should look like, namely it must include members representing a significant market share with fair and equal representation in decision-making processes as well as customer and consumer associations.Footnote ⁵⁶ Several provisions in Article 10 govern the exact procedural and substantive rules that govern such schemes, including dispute resolution.Footnote ⁵⁷ The Commission might intervene on the absence of a financial data sharing scheme for specific categories of customer data listed in Article 2(1) of the FIDA proposal.Footnote ⁵⁸

The FIDA proposal also outlines eligibility requirements for data access and organisation. Article 12 of the proposed FIDA proposal outlines the process for financial information service providers to obtain authorisation to access customer data, requiring them to submit a detailed set of documents and hold professional indemnity insurance. The proposal also covers the granting and potential withdrawal of authorisations, considering compliance, conditions for third-country providers, and the role of competent authorities in overseeing outsourcing arrangements.Footnote ⁵⁹ To facilitate this, Article 15 outlines the establishment of a central register by the European Banking Authority, containing information on authorised providers, their intentions, and financial data-sharing schemes.Footnote ⁶⁰ It outlines organisational requirements for financial information service providers, including policies for compliance, continuity, and risk management.Footnote ⁶¹ The framework would thus allow for cross-border access to data by financial information service providers.Footnote ⁶²

Finally, the proposed FIDA framework establishes a sophisticated supervision framework. It establishes competent authorities in Member States responsible for ensuring compliance with the Regulation, with the obligation to notify the Commission of these authorities and ensure they possess necessary powers and resources.Footnote ⁶³ Several investigatory powers would be transferred to the competent authorities, including the ability to require information, conduct investigations, and take various measures to address breaches.Footnote ⁶⁴ Articles 19 and 20 allow for settlement agreements, expedited enforcement procedures, and the imposition of administrative penalties, respectively, with detailed provisions on the types and levels of penalties.Footnote ⁶⁵ The FIDA proposal would safeguard fundamental rights by granting the right of appeal against decisions of competent authorities.Footnote ⁶⁶ In addition, while the proposed FIDA framework would foster cooperation and information exchange between competent authorities,Footnote ⁶⁷ they must ensure data protection.Footnote ⁶⁸

The proposed FIDA framework would notably harmonise and propel data access within the EU, facilitating the personalisation of current financial products and services and potentially fostering the emergence of new ones. It is poised to emerge as a cornerstone initiative in Open Finance, promoting decentralised control over data rather than centralisation. Some scholars have generally characterised Open Finance as antitrust, arguing that data-centric enterprises leverage their large datasets and tend to monopolise market share.Footnote ⁶⁹ The FIDA proposal could thus serve as a potential remedy to address such tendencies, offering a path towards greater competition. Another noteworthy aspect of FIDA is its focus on the intersection of tech resilience – connected to DORA – financial regulation, and data protection, which is crucial for ensuring a robust, secure, and compliant financial ecosystem in the EU.

III. Financial Data Access, Data Protection, and Automated Decision-Making

Automated decision-making, utilised by data users, holders, and supervising authorities, is rapidly advancing within the context of European financial law. As generative AI technologies advance, ADM increasingly utilises software to support or replace human decision-making processes, leveraging the abundance of data available in the technology age. This is especially used in European financial law, where the 2008 financial crisis resulted in further data reporting requirements, for instance, to monitor compliance,Footnote ⁷⁰ mostly in real-time.Footnote ⁷¹ This section delves into the intricate relationship between the FIDA proposal, data protection, and automated decision-making, examining its implications and regulatory elements.

The Data Protection Directive of 1995 contained some of the first rules on ADM, prohibiting the use of solely automated decision-making in individual cases without human involvement.Footnote ⁷² The right to data protection is a fundamental human right protected by Article 8(1) of the European Convention on Human Rights, Article 8(1) of the EU Charter of Fundamental Rights, and Article 16(1) of the Treaty on the Functioning of the European Union.Footnote ⁷³ It is thus no surprise that the GDPR took on the restrictive approach in the Data Protection Directive.Footnote ⁷⁴ However, the GDPR outlines exceptions in Article 22:

1. a) ‘is necessary for entering into, or performance of, a contract between the data subject and a data controller;

2. b) is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests; or

3. c) is based on the data subject’s explicit consent.’

Decisions by the EU and national data protection authorities suggest that the prohibition applies to very few circumstances.Footnote ⁷⁵ Nevertheless, the GDPR duties apply to private and public bodies,Footnote ⁷⁶ including data holders, users, and supervising authorities under the FIDA proposal.Footnote ⁷⁷ The Court of Justice also clarified that calculating a credit score constitutes an automated individual decision under Article 22(1) of the GDPR.Footnote ⁷⁸

Additionally, the GDPR introduced other duties, including an obligation to ensure data protection through the design of technology, so-called privacy by design.Footnote ⁷⁹ The FIDA proposal requires such a design feature, for instance, in the permission dashboard.Footnote ⁸⁰ The GDPR sets forth stringent requirements for data processing, including provisions related to automated decision-making and profiling (Aarticle 22). Financial institutions must ensure that their automated decision-making processes comply with the principles of fairness, transparency, and accountability enshrined in the GDPR.Footnote ⁸¹ Moreover, individuals have rights under the GDPR to access, rectify, and object to automated decisions that significantly affect them.Footnote ⁸² The AI Act will further restrict the use of certain ADM mechanisms that deploy “high risk” AI systems.Footnote ⁸³ Profiling AI systems are always considered “high risk,”Footnote ⁸⁴ and it is thus inevitable that AI systems need a number of safeguards like transparency and audits.Footnote ⁸⁵

If customers choose to share their data with data holders and users by granting permission in the dashboard, their data will be utilised for personalised products and services. The Commission highlights several use cases, such as personalised investment advice and automated creditworthiness assessments for SMEs.Footnote ⁸⁶ Financial institutions may deploy ADM to assess the needs and opportunities of customers, leveraging data analytics and machine learning algorithms to gain deeper insights into customer behaviour to personalise marketing, services, and products or identify risks like fraud.Footnote ⁸⁷ Furthermore, as pointed out in the previous section, the FIDA proposal does not apply to all kind of data but it is limited to an exhaustive list of industries and products.Footnote ⁸⁸ It also provides customers with a choice on whether and how much data they want to share, including the option to withdraw it.Footnote ⁸⁹ In any case, data holders and users must ensure that they do not use the data contrary to Article 9(1) of the GDPR, dealing with processing sensitive information like ethnic origin or religious beliefs, which could be deduced from transaction activities, and lead to unwanted consequences like price discrimination.Footnote ⁹⁰ Customers also have a right to be informed under Articles 13 and 14 of the GDPR and to receive information about the existence ADM under Article 15 of the GDPR, which includes profiling.Footnote ⁹¹

The FIDA proposal also requires an automated transmission of data to regulators. Article 15 establishes a central register by the European Banking Authority containing information on authorised providers and their intentions. The provision for establishing such a register implies the need for computerised systems to manage and maintain this information efficiently. Furthermore, Title VI of the FIDA proposal pertains to the supervision and enforcement framework of the FIDA proposal, including the powers of competent authorities to investigate breaches and impose penalties. The investigatory powers granted to competent authorities will most likely involve scrutiny of automated decision-making processes to ensure compliance of data holders and users with the FIDA regulation.Footnote ⁹² Both maintaining the register and ensuring compliance of supervised entities must align with the GDPR. Regarding the data of natural persons, EU regulators must also ensure they comply with the EDPR.Footnote ⁹³

In summary, the integration of automated decision-making into financial data access marks a substantial advancement in European financial law. While it presents opportunities for efficiency and innovation, it also introduces intricate challenges related to data protection, fairness, and accountability. Regulatory interventions like the FIDA proposal are pivotal in overseeing the implementation of automated systems, safeguarding consumer rights, and industry interests. Looking ahead, it is imperative for policymakers, regulators, and industry stakeholders to collaborate continuously in evolving the framework within the swiftly changing technological terrain.

IV. Policy Considerations

The FIDA proposal ambitiously addresses the intersections of tech resilience, financial regulation, and data protection. While the FIDA proposal offers benefits to customers and financial firms, it also presents several shortcomings. For instance, the European Economic and Social Committee (EESC), the European Commission’s Regulatory Scrutiny Board, and BEUC have already highlighted various contentious points within the FIDA proposal.

The primary and foremost critique directed at the FIDA proposal revolves around its inadequate evidential support and integration of consumer protection theories.Footnote ⁹⁴ The Commission’s call for evidence garnered minimal engagement, receiving a mere seventy-nine responses.Footnote ⁹⁵ While the majority of these responses were from citizens (fifty-seven), contributions also stemmed from trade associations (fourteen), businesses (three), consumer organisations (one), unions (one), and other entities (three). Geographically, the bulk of the responses originated from Slovakia (twenty-four), Germany (twenty-two), and Belgium (eight). According to the impact assessment, citizen responses generally conveyed a negative sentiment towards Open Finance and those from businesses exhibited a more positive outlook. The public consultation attracted slightly more feedback with fifty-five citizens and thirty-seven professional responses.Footnote ⁹⁶ Citizens highlighted their concerns about privacy and data protection. Professionals were more optimistic in the consultation, highlighting the benefits of innovation and competition for customers. The Commission’s cost/benefit analysis is positive, although it is difficult to quantify the estimated impact.Footnote ⁹⁷

The European Commission’s Regulatory Scrutiny Board also expressed criticism regarding the impact assessment.Footnote ⁹⁸ They contended that the assessment places excessive reliance on stakeholder feedback, urging for the inclusion of insights from initiatives in different jurisdictions. Additionally, the European Commission’s Regulatory Scrutiny Board highlighted the ambiguity surrounding the existence of customer demand for new financial services and products, emphasising the absence of concrete examples of innovation. The European Commission should thus conduct further research on the potential impact of the FIDA proposal.

Another concern relates to data protection. While data minimisation in accordance with the GDPR appears to be adhered to,Footnote ⁹⁹ some actors point out that more could be done. BEUC, a consumer organisation, emphasises the importance of including only financially relevant data and excluding profiling activities, as both could lead to a high risk of exclusion.Footnote ¹⁰⁰ Furthermore, BEUC suggests that data perimeters should be binding and cover additional areas such as retail banking and insurance products, which also pose a high risk of exclusion.Footnote ¹⁰¹ The European Economic and Social Committee (EESC) also proposes refinements concerning data minimisationFootnote ¹⁰² and raises further considerations. Regarding customer data categories, the EESC notes a persistent risk of “misuse and illegitimate interference.”Footnote ¹⁰³ Consequently, the EESC recommends proper training for staff,Footnote ¹⁰⁴ additional bans on the use of personal data within the FIDA proposal,Footnote ¹⁰⁵ and ensuring that data holders refrain from restrictive practices concerning the dashboards that provide customers with consent and transparency.Footnote ¹⁰⁶ The sentiment regarding dashboards is also emphasised by BEUC, which underscores the importance of ensuring easy accessibility to dashboards.Footnote ¹⁰⁷ Moreover, BEUC emphasises that dashboard design and the information presented must comply with data protection and consumer law rules.Footnote ¹⁰⁸ The European Commission’s Regulatory Scrutiny Board further highlighted that it is unclear how the FIDA proposal would protect vulnerable customers and ensure customers are not pressured into data sharing.Footnote ¹⁰⁹ The intricate nature of utilising ADM AI mechanisms necessitates experience requirements, which the FIDA proposal should mandate for both data holders and users.Footnote ¹¹⁰

In addition to the previous concerns, the European Economic and Social Committee suggests that there might be an imbalance in the regulatory environment between heavily regulated financial institutions and other participants in the market.Footnote ¹¹¹ This is also debated by BEUC.Footnote ¹¹² On the one hand, BEUC emphasises the potential benefits of the proposal’s introduction of Financial Information Service Providers (FISPs), which could offer tailored and innovative solutions to consumers, enhancing competition and consumer outcomes in Open Finance. One the other hand, BEUC cautions against the risks associated with financial data sharing, particularly the possibility of exploitation by powerful companies. They advocate for clear delineation of the role of FISPs and propose that entities designated as gatekeepers under the Digital Markets Act should be barred from accessing data under Open Finance to mitigate these risks. The impact assessment, and potentially the FIDA proposal, should consider this power imbalance and aim to rectify it.

There are also deficiencies concerning supervision and enforcement within the proposed framework. Specifically, the European Economic and Social Committee emphasises the necessity for the European Banking Authority and the European Insurance and Occupational Pensions Authority to receive a clear mandate for developing guidelines regarding the processing of consumer data. These guidelines would pertain to various financial products and services, including credit level assessment and risk evaluation for consumers, as well as life, health, and sickness insurance products.Footnote ¹¹³ Regarding the enforcement of consumer rights, the FIDA proposal would allow individuals to seek compensation when their rights are violated,Footnote ¹¹⁴ and entities found responsible for such violations could face administrative penalties imposed by the Competent Authority.Footnote ¹¹⁵ One criticism highlighted by BEUC is that it should be incorporated into the Annex of the Representative Actions Directive.Footnote ¹¹⁶ The legislators should take these concerns seriously and carefully assess whether to take them on board during the legislative process.

BEUC further emphasises that data users, data holders, consumer organisations, and consumer associations must collaborate to establish data sharing schemes, where the content and governance will be determined by scheme members themselves.Footnote ¹¹⁷ While BEUC appreciates the inclusion of consumer representation, they urge policymakers to ensure a balanced representation, emphasising that consumer presence should not merely serve to legitimise financial data sharing schemes. They thus argue that customer organisations and consumer associations should be granted full voting rights within these schemes. Additionally, the European Commission’s Regulatory Scrutiny Board recommends that the FIDA proposal report provides a clearer description of the intended compensation measures, including the governance model and the methodology for calculating “reasonable compensation.”Footnote ¹¹⁸ Furthermore, it should address how compensation measures will not impede innovative open finance services and how the risk of anticompetitive effects resulting from data reuse will be mitigated.

Another point to consider is the time to implement the measure.Footnote ¹¹⁹ The EESC highlighted that the 18-month period for technical features should be prolonged by another six months.Footnote ¹²⁰ Industry associations, like the Association of the Luxembourg Fund Industry, equally pointed out that the anticipated timeframe is unrealistic.Footnote ¹²¹ The Commission should thus assess whether this timeline is realistic and feasible.

The critique of the FIDA proposal is warranted, particularly due to the absence of evidence or consumer theories in the impact assessment. The FIDA proposal must heed all the outlined concerns as certain aspects necessitate additional refinement for it to succeed, ensuring a delicate balance between innovation and consumer protection, particularly regarding automated decision-making. Overall, the FIDA proposal took some principles proposed by the academic community into account, without directly listing them in the impact assessments.Footnote ¹²² The concentration of power by digital platforms will potentially be remedied by FIDA, serving as antitrust and strengthening consumer choice. However, as previously mentioned, the European Commission should have initiated a broader public discourse and justified its legislative choices with scientific evidence. It is hoped that the European Commission will employ an evidence-based approach when assessing the ex-post impact of FIDA on the financial industry and consumer protection.Footnote ¹²³

V. Conclusion

This article has scrutinised the intricate landscape surrounding financial data access and automated decision-making in the European Union, focusing on the proposed Financial Data Access Regulation. It has highlighted the critical necessity of regulating financial data access and ADM within the EU’s legal framework, especially in a digital era marked by a rapid influx of financial data. The FIDA proposal signifies a significant stride towards tackling these challenges, aiming to balance innovation with consumer rights and business interests.

As pointed out, a noteworthy aspect of FIDA is its focus on the intersection of tech resilience – connected to DORA – financial regulation, and data protection. A key consideration regarding the FIDA proposal is thus whether it aligns more closely with the trajectory of EU financial law or primarily serves as a specialised form of data protection regulation. It seems that FIDA attempts to satisfy both perspectives without fully committing to either domain. While it is an ambitious endeavour with potential antitrust effects on digital finance platforms, mere transparency in data processing does not automatically lead to enhanced consumer protection.

Moving forward, it is imperative for the European Commission to conduct further research on the potential impacts of the FIDA proposal and to mandate experience requirements for both data holders and users engaging in such ADM systems. Additionally, there is a pressing need to address power imbalances, particularly concerning entities designated as gatekeepers under the Digital Markets Act, to ensure fair access to data under Open Finance. It is essential for legislators to take these concerns into account and integrate them into the legislative process, while also assessing the feasibility of proposed timelines. Ultimately, the FIDA proposal has the potential to fortify the FinTech sector, amplify consumer choice, and foster healthy competition. It could be seen as an antitrust measure, decentralising data access and reducing centralisation, thereby promoting a more balanced financial ecosystem. However, it is crucial to remember that the contents of the FIDA proposal are subject to potential revisions and adjustments throughout the ongoing legislative process.