2023/0205(COD) | [ParlTrack]

Proposal for a regulation
Recital 1

(1) A responsible data economy, which is driven by the generation and use of data, is an integral part of the Union internal market that can bring benefits to both Union citizens and the economy. Digital technologies relying on data are increasingly driving change in financial markets by innovating, producing new business models, products and ways for firms to engage with customers.

Amendment 157 #

Proposal for a regulation
Recital 3

(3) The Union has a stated policy interest in enabling access of customers of financial institutions to their financial data. The Commission confirmed in its communication on a digital finance strategy and Communication on a capital markets union adopted in 2021 an intention to put in place a framework for financial data access to reap the benefits for customers of ~~data sharing~~unlocking their data in the financial sector. Such benefits include the development and provision by the financial sector of data-driven financial products and financial services, made possible by the ~~sharing of custome~~re-use of customer data. By creating synergies with data from other relevant sectors, the innovative potential of such financial products and financial services could be further enhanced to the benefit of customers and the overall data economy. The goal of the European Commission should be a data sharing across sectors, as promoted by its strategy for data.

Amendment 158 #

Proposal for a regulation
Recital 3

(3) The Union has a stated policy interest in enabling access of customers of financial institutions to their financial data. The Commission confirmed in its communication on a digital finance strategy and Communication on a capital markets union adopted in 2021 an intention to put in place a framework for financial data access to reap the benefits for customers of data sharing in the financial sector. Such benefits include the development and provision of data-driven financial products and financial services, made possible by the sharing of customer data. In order to actualise these benefits, financial institutions should have the possibility of developing and providing tailor-made and data-driven financial products and services for customers based on the sharing of customer data with their consent.

Amendment 159 #

Proposal for a regulation
Recital 4

(4) Within financial services, and as a result of the revised Directive (EU) 2015/2366 of the European Parliament and of the Council7 , the sharing of payments account data in the Union based on customer permission has begun to transform the way consumers and businesses use banking services. In order to build upon the measures in that Directive, a regulatory framework should be established for the sharing of customer data, which have been derived from financial services provided in the Union, across the financial sector beyond payment account data. This should also be a building block for fully integrating the financial sector into the Commission’s strategy for data8 which promotes data sharing across sectors. _________________ 7 Directive (EU) 2015/2366 of the European Parliament and of the Council of 25 November 2015 on payment services in the internal market, amending Directive 2002/65/EC, 2009/110/EC and 2013/36/EU and Regulation (EU) No 1093/2010, and repealing Directive 2007/64/EC (OJ L 337, 23.12.2015, p. 35). 8 https://eur-lex.europa.eu/legal- content/EN/TXT/?qid=1593073685620&ur i=CELEX%3A52020DC0066

Amendment 160 #

Proposal for a regulation
Recital 4 a (new)

(4 a) It should be noted that the costs of implementation of provisions to enable Open Banking through PSD II were high for the sector, particularly smaller actors. While the Directive has allowed the development of new and innovative offerings to customers, a cost-benefit analysis is essential to ensure that the expansion of Open Banking to Open Finance is not prohibitive to firms, particularly smaller firms.

Amendment 161 #

Proposal for a regulation
Recital 4 a (new)

(4 a) This Regulation should only apply to financial data falling outside of the scope of the ‘open banking’ provisions under the Regulation (EU) [XXXX/XXXX] of the European Parliament and of the Council (PSR/PSD3).

Amendment 162 #

Proposal for a regulation
Recital 5

(5) Ensuring customer control and trust is imperative to build a well-functioning and effective data sharing framework in the financial sector. Ensuring effective customers’ control over data sharing contributes to innovation as well as customer confidence and trust in data sharing. As a result, effective control may helps overcome customer reluctance to share their data. Under the current Union framework, the data portability right of a data subject in accordance with the Regulation (EU) 2016/679 of the European Parliament and of the Council9 is limited to personal data and can be relied upon only where it is technically feasible to port the data. Customer data and technical interfaces in the financial sector beyond payment accounts are not standardised, rendering data sharing more costly for businesses. Further, the financial institutions are only legally obliged to make the payment data of their customers available. _________________ 9 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1).

Amendment 163 #

Proposal for a regulation
Recital 6

(6) The Union’s financial data economy therefore remains fragmented, characterised by uneven data sharing, barriers, and high stakeholder reluctance to engage in data sharing beyond payments accounts. Customers accordingly do not benefit from individualised, data-driven products and services that may fit their specific needs. The absence of personalised financial products limits the possibility to innovate, by offering more choice and financial products and services for interested consumers who could otherwise benefit from data-driven tools that can support them to make informed choices, compare offerings in a user-friendly manner, and switch to more advantageous products that match their preferences based on their data. The existing barriers to business data sharing are preventing firms, in particular SMEs, tofrom benefitting from better, convenient and automated financial services.

Amendment 164 #

Proposal for a regulation
Recital 6 a (new)

(6 a) The sharing of data should seek to enhance innovation, benefit customers, and to provide innovative personalised financial products or services based, where appropriate, on clear use cases. Examples may include: improving the mortgage credit market for consumers by ensuring choices that better suit the consumer's needs or personal circumstances; facilitating the provision of high-quality financial advice to customers; utilising energy efficiency, energy consumption and climate data to provide new financial services to consumers; developing vehicle data sharing frameworks so that insurers, among other stakeholders, can offer innovative products, reduce damages, help improve road safety and eco-friendly mobility, and stimulate future technological developments.

Amendment 165 #

Proposal for a regulation
Recital 7

(7) Making data available by way of high-quality technical interfaces like application programming interfaces is essential to facilitate seamless and effective access to data. Beyond the area of payment accounts, however, only a minority of financial institutions that are data holders indicate that they make data available through technical interfaces like application programming interfaces. As incentives to develop such innovative services are absent, market demand for data access remains limited. To foster efficient data sharing, data holders and data users should make use of existing application programming interfaces infrastructures and common standards as mandated under Directive (EU) 2015/2366 and Commission Delegated Regulation (EU) 2018/389.

Amendment 166 #

Proposal for a regulation
Recital 8

(8) A dedicated and harmonised framework for access to financial data is therefore ~~necessary~~desireable at Union level to respond to the needs of the digital economy and to remove barriers to a well- functioning internal market for data. Specific rules are required to address these barriers to promote better access to customer data and hence make it possible for consumers and firms to realise the gains stemming from better financial products and services. Data-driven finance wcould facilitate industry transition from the traditional supply of standardised products to tailored solutions that are better suited to the customers’ specific needs, including improved customer facing interfaces that enhance competition, improve user experience and ensure financial services that are focused on the customer as the end user.

Amendment 167 #

Proposal for a regulation
Recital 9

(9) The data included in the scope of this Regulation should demonstrate high value added for financial innovation as well as low financial exclusion risk for consumers. This Regulation should therefore not cover data related to the sickness and health insurance of a consumer in accordance with Directive 2009/138/EC of the European Parliament and of the Council10 as well as data on life insurance products of a consumer in accordance with Directive 2009/138/EC other than life insurance contracts covered by insurance-based investment products. This Regulation should also not cover data collected as part of a creditworthiness assessment ~~of a consumer~~. The sharing of customer data in the scope of this Regulation should respect the protection of confidential business data ~~and trade secrets.~~ of both the customer and data holder. An obligation to make data available to a data user shall not oblige the disclosure of trade secrets within the meaning of Directive (EU) 2016/943, including but not limited to mathematical and methodological approaches. _________________ 10 Directive 2009/138/EC of the European Parliament and of the Council of 25 November 2009 on the taking-up and pursuit of the business of Insurance and Reinsurance (Solvency II) (recast) (OJ L 335, 17.12.2009, p. 1).

Amendment 168 #

Proposal for a regulation
Recital 9

(9) The data included in the scope of this Regulation should demonstrate high value added for financial innovation as well as low financial exclusion risk for consumers. This Regulation should therefore not cover data related to the sickness and health insurance of a consumer in accordance with Directive 2009/138/EC of the European Parliament and of the Council10 as well as data on life insurance products of a consumer in accordance with Directive 2009/138/EC other than life insurance contracts covered by insurance-based investment products. This Regulation should also not cover data collected as part of a creditworthiness assessment of a consumer. The sharing of customer data in the scope of this Regulation should respect the protection of confidential business data ~~and trade secrets.~~ of both the customer and the data holder. Data that is required to be shared shall not include trade secrets within the meaning of Directive (EU) 2016/943, including but not limited to methodological approaches. _________________ 10 Directive 2009/138/EC of the European Parliament and of the Council of 25 November 2009 on the taking-up and pursuit of the business of Insurance and Reinsurance (Solvency II) (recast) (OJ L 335, 17.12.2009, p. 1).

Amendment 169 #

Stéphanie YON-COURTIN, Gilles BOYER

Proposal for a regulation
Recital 9 a (new)

(9 a) For the purpose of the provision of financial services and product in scope of this Regulation, data holders and data users should comply with existing Union rules and guidelines regarding the access to and use of personal data.

Amendment 170 #

Proposal for a regulation
Recital 10

(10) The ~~sharing of the~~access of customer data in the scope of this Regulation should be based on the explicit permission of the customer. The client’s permission to give access to his or her data should be obtained through an explicit consent, which should not be based solely on a “tick-the-box” approach or the use of generalising phrases. In seeking the explicit permission of the customer to use his or her data, the data users should specify what use they intend to make of the customer’s data, should the customer provide permission. The legal obligation on data holders to share customer data should be triggered once the customer has explicitly requested their data to be shared with a data user. Th~~is request can be submitted by~~e data user should be able to demonstrate how the best interest of the customer will be served and preserved. In accordance with Regulation (EU) [XXXX/XXXX] of the European Parliament of the Council (Data Act), an undertaking providing core platform services that has been designated as a gatekeeper under Regulation (EU) 2022/19251) cannot be eligible as data user ~~acting on behalf of the customer~~under this Regulation. The limitation on granting access to gatekeepers would not exclude them from the market and prevent them from offering its services, as voluntary agreements between them and the data holders remain unaffected. Where the processing of personal data is involved, a data user should have a valid lawful basis for processing under Regulation (EU) 2016/679. The customers data can be processed only for the agreed purposes in the context of the service provided. Under this Regulation, these purposes should be strictly limited to the provision of a financial product, a financial service or a financial information service. The processing of personal data must respect the principles of personal data protection, including lawfulness, fairness and transparency, purpose limitation and data minimisation. A customer has the right to withdraw the permission given to a data user~~. W~~ at any time and free of charge. For example, when data processing is necessary for the performance of a contract, a customer should be able to withdraw permissions according to the contractual obligations to which the data subject is party. WSimilarly, when personal data processing is based on consent, a data subject ~~has the right~~should be able to withdraw his or her consent at any time, as provided for in Regulation (EU) 2016/679. It should not be possible for the data user to transfer customer data to a third-party actor without this explicit permission, or even to another entity within the same group.

Amendment 171 #

Marco ZANNI, Valentino GRANT, Antonio Maria RINALDI

Proposal for a regulation
Recital 10

(10) The ~~sharing of the~~access of customer data in the scope of this Regulation should be based on the explicit permission of the customer. In seeking the explicit permission of the customer to use his or her data, the data users should specify what use they intend to make of the customer’s data, should the customer provide permission. The legal obligation on data holders to ~~share~~enable access to customer data should be triggered once the customer has explicitly requested their data to be ~~shared with a data user. This request can be submitted by a data user acting on behalf of the customer~~made accessible to a data user. In accordance with Regulation (EU) [2023/2854] of the European Parliament of the Council (Data Act), an undertaking providing core platform services that has been designated as a gatekeeper under Regulation (EU) 2022/19251b cannot be eligible as data user under this Regulation. The limitation on granting access to gatekeepers would not exclude them from the market and prevent them from offering its services, as voluntary agreements between them and the data holders remain unaffected. Where the processing of personal data is involved, a data user should ~~have a~~rely on one of the valid lawful basies for processing under Article 6 of Regulation (EU) 2016/679. The customers data can be processed only for the agreed purposes in the context of the service provided. Under this Regulation, these purposes should be strictly limited to the provision of a financial product, a financial service or a financial information service. The processing of personal data must respect the principles of personal data protection, including lawfulness, fairness and transparency, purpose limitation and data minimisation. A customer has the right to withdraw the permission given to a data user~~. W~~ at any time. For example, when data processing is necessary for the performance of a contract, a customer should be able to withdraw permissions according to the contractual obligations to which the data subject is party. WSimilarly, when personal data processing is based on consent, a data subject ~~has the right~~should be able to withdraw his or her consent at any time, as provided for in Regulation (EU) 2016/679. It should not be possible for the data user to transfer customer data to a third-party actor without this explicit permission, or even to another entity within the same group.

Amendment 172 #

Proposal for a regulation
Recital 10

(10) The ~~sharing of the~~access of customer data in the scope of this Regulation should be based on the explicit permission of the customer. In seeking the explicit permission of the customer to use his or her data, the data users should specify what use they intend to make of the customer’s data, should the customer provide permission. The legal obligation on data holders to ~~share~~enable access to customer data should be triggered once the customer has explicitly requested their data to be ~~shared with a data user. This request can be submitted by a data user acting on behalf of the customer~~made accessible to a data user. In accordance with Regulation (EU) [XXXX/XXXX] of the European Parliament of the Council (Data Act), an undertaking providing core platform services that has been designated as a gatekeeper under Regulation (EU) 2022/19251b cannot be eligible as data user under this Regulation. The limitation on granting access to gatekeepers would not exclude them from the market and prevent them from offering its services, as voluntary agreements between them and the data holders remain unaffected. Where the processing of personal data is involved, a data user should ~~have a~~rely on one of the valid lawful basies for processing under Article 6 of Regulation (EU) 2016/679. The customers data can be processed only for the agreed purposes in the context of the service provided. Under this Regulation, these purposes should be strictly limited to the provision of a financial product, a financial service or a financial information service. The processing of personal data must respect the principles of personal data protection, including lawfulness, fairness and transparency, purpose limitation and data minimisation. A customer has the right to withdraw the permission given to a data user~~. W~~ at any time. For example, when data processing is necessary for the performance of a contract, a customer should be able to withdraw permissions according to the contractual obligations to which the data subject is party. WSimilarly, when personal data processing is based on consent, a data subject ~~has the right~~should be able to withdraw his or her consent at any time, as provided for in Regulation (EU) 2016/679. It should not be possible for the data user to transfer customer data to a third-party actor without this explicit permission, or even to another entity within the same group.

Amendment 173 #

Proposal for a regulation
Recital 10

(10) The sharing of the customer data in the scope of this Regulation should be based on the permission of the customer. The legal obligation on data holders to share customer data should be triggered once the customer has requested their data to be shared with a data user. ~~This request can be submitted by a data user acting on behalf of the customer.~~ Where the processing of personal data is involved, a data user should be able to demostrate they have a valid lawful basis for processing under article 6(1)(a) or (b) of Regulation (EU) 2016/679. The customers data can be processed for the agreed purposes in the context of the service provided. The processing of personal data must respect the principles of personal data protection, including lawfulness, fairness and transparency, purpose limitation and data minimisation. A customer has the right to withdraw the permission given to a data user at any time. When data processing is necessary for the performance of a contract, a customer should be able to withdraw permissions according to the contractual obligations to which the data subject is party. When personal data processing is based on consent, a data subject has the right to withdraw his or her consent at any time, as provided for in Regulation (EU) 2016/679.

Amendment 174 #

Proposal for a regulation
Recital 10

(10) The sharing of the customer data in the scope of this Regulation should be based on the permission of the customer. The legal obligation on data holders to share customer data should be triggered once the customer has requested their data to be shared with a data user. This request can be submitted by a data user acting on behalf of the customer where permission has explicitly been granted. Where the processing of personal data is involved, a data user should have a valid lawful basis for processing under Regulation (EU) 2016/679. The customers data can be processed for the agreed purposes in the context of the service provided. The processing of personal data must respect the principles of personal data protection, including lawfulness, fairness and transparency, purpose limitation and data minimisation. A customer has the right to withdraw the permission given to a data user at any time. When data processing is necessary for the performance of a contract, a customer should be able to withdraw permissions according to the contractual obligations to which the data subject is party. When personal data processing is based on consent, a data subject has the right to withdraw his or her consent at any time, as provided for in Regulation (EU) 2016/679.

Amendment 175 #

Proposal for a regulation
Recital 10 a (new)

(10 a) The sharing of customer data, based on the consent of the customer, would empower in particular the customer to have access to a wider range of financial services goods and services. It would provide the possibility for consumers to benefit from the opening of the Single Market to increased access of retail financial services products from other Member States. This in turn should lead to the availability of more competitive, consumer-focused and cheaper financial services and products.

Amendment 176 #

Proposal for a regulation
Recital 10 b (new)

(10 b) This regulation should be implemented according to the standards of existing and future EU law in the area of privacy and data protection, as well as the values of the Single Market. Therefore, undertakings designated as gatekeepers under Regulation (EU) 2022/1925 of the European Parliament and of the Council should not be ineligible data users under this Regulation.

Amendment 177 #

Proposal for a regulation
Recital 11

(11) Enabling customers to share their data on their current investments can encourage innovation in the provision of retail investment services. Primary data collection to complete a suitability and appropriateness assessment of a retail investor is time-intensive for a customer and constitutes a significant cost factor for advisors and distributors of investment, pension, and insurance-based investment products. The sharing of customer data on holdings of savings and investments in financial instruments including insurance-based investment products and data collected for the purposes of carrying out a suitability and appropriateness assessment can improve investment advice for consumers and has strong innovative potential, including in the development of personalised investment advice and investment management tools that can make retail investment advice more efficient. Such management tools are already being developed in the market and can develop more effectively in the context where a customer can share their investment-related datarefore, the inclusion of this type of data as well as the necessary prerequisites should be carefully assessed.

Amendment 178 #

Proposal for a regulation
Recital 11

(11) Enabling customers to share their data on their current investments can encourage innovation in the provision of retail investment services. Primary data collection to complete a suitability and appropriateness assessment of a retail investor is time-intensive for a customer and constitutes a significant cost factor for advisors and distributors of investment, pension, and insurance-based investment products. The sharing of customer data on holdings of savings and investments in financial instruments including insurance-based investment products ~~and data collected for the purposes of carrying out a suitability and appropriateness assessment~~ can improve investment advice for consumers and has strong innovative potential, including in the development of personalised investment advice and investment management tools that can make retail investment advice more efficient. Such management tools are already being developed in the market and can develop more effectively in the context where a customer can share their investment-related data.

Amendment 179 #

Proposal for a regulation
Recital 12

(12) Customer data on balance, conditions or transaction details related to mortgages, loans and savings can enable customers to gain a better overview of their deposits and better meet their savings needs based on credit data. This Regulation should cover customer data beyond payment accounts defined in Directive (EU) 2015/2366~~. Credit accounts covered by a credit line which cannot be used for the execution of payment transactions to third parties should be within the scope of t~~11 . This Regulation~~. It~~ should ~~therefore be understood that this Regulation covers the~~not cover access to ~~the~~data on balances, conditions or transaction details ~~related to mortgage credit agreements, loans, and savings accounts as well as the types of accounts not falling withing the scope of the Directive (EU) 2015/236611 .~~of payment accounts as defined under Directive (EU) / Regulation (EU) [XXXX/XXXX] of the European Parliament of the Council (PSR/PSD3). _________________ 11 Directive (EU) 2015/2366 of the European Parliament and of the Council of 25 November 2015 on payment services in the internal market, amending Directives 2002/65/EC, 2009/110/EC and 2013/36/EU and Regulation (EU) No 1093/2010, and repealing Directive 2007/64/EC (OJ L 337 23.12.2015, p. 35).

Amendment 180 #

Proposal for a regulation
Recital 13

(13) The customer data included in the scope of this Regulation should include sustainability-related information that should enable customers to more easily access financial services that are aligned with their sustainability preferences and sustainable finance needs, in line with the Commission’s strategy for financing the transition to a sustainable economy12 . Access to data relating to sustainability which may be contained in balance or transaction details related to a mortgage, credit, loan and savings account, as well as access to customer data relating to sustainability held by investment firms, can contribute to facilitating access to data needed to access sustainable finance or make investments into the green transition. Moreover, customer data in the scope of this Regulation should include data which forms part of a creditworthiness assessment related to firms, including small and medium sized enterprises, and which can provide greater insight into the sustainability objectives of small firms. The inclusion of data used for the creditworthiness assessment related to firms should improve access to financing and streamline the application for loans. Such data should be limited to data on firms and should not infringe intellectual property rights. _________________ 12 Communication From the Commission to the European Parliament, the Council, the European Economic And Social Committee and the Committee of the Regions, Strategy for Financing the Transition to a Sustainable Economy, COM/2021/390 finaldeleted

Amendment 181 #

Proposal for a regulation
Recital 13

Amendment 182 #

Proposal for a regulation
Recital 13

(13) The customer data included in the scope of this Regulation should include sustainability-related information, where applicable, that should enable customers to more easily access financial services that are aligned with their sustainability preferences and sustainable finance needs, in line with the Commission’s strategy for financing the transition to a sustainable economy12 . Access to data relating to sustainability which may be contained in balance or transaction details related to a mortgage, credit, loan and savings account, as well as access to customer data relating to sustainability held by investment firms, can contribute to facilitating access to data needed to access sustainable finance or make investments into the green transition. Moreover, customer data in the scope of this Regulation should include data which forms part of a creditworthiness assessment related to firms, including small and medium sized enterprises, and which can provide greater insight into the sustainability objectives of small firms. The inclusion of data used for the creditworthiness assessment related to firms should improve access to financing and streamline the application for loans. Such data should be limited to data on firms and should not infringe intellectual property rights. _________________ 12 Communication From the Commission to the European Parliament, the Council, the European Economic And Social Committee and the Committee of the Regions, Strategy for Financing the Transition to a Sustainable Economy, COM/2021/390 final

Amendment 183 #

Proposal for a regulation
Recital 14

(14) Customer data related to the provision of non-life insurance are essential to enable insurance products and services important to the needs of customer like the protection of homes, vehicles, and other property. At the same time, the collection of such data is ~~often burdensome and costly~~costly for advisers, distributors of investment products, pension products, insurance- based investment products and non-lifre insurance products, and often burdensome for customers and can act as a deterrent against seeking optimal insurance coverage by customers. To address this problem, it is therefore necessary to include such financial services within the scope of this Regulation. Customer data on insurance products within scope of this Regulation should include both insurance product information such as detail on an insurance coverage and data specific to the consumers’ insured assets which are collected for the purposes of a demands and needs test. The sharing of such data should allow for the development of personalised tools for customers, such as insurance dashboards that could help consumers better manage their risks. It could also help customers to obtain products that are better targeted to their demands and needs, including through more valuable advice. This can contribute to more optimal insurance coverage for customers and increased financial inclusion of otherwise underserved consumers, by offering new or increased coverage. Moreover, the sharing of insurance data can be beneficial for more efficient supply of insurance including, in particular, at the stages of product design, underwriting, contract execution, including claims management, and risk mitigation.

Amendment 184 #

Proposal for a regulation
Recital 15

(15) The sharing of data on occupational and personal pension savings ~~has strong innovative potential for consumers. P~~can create added value for consumers in case they can choose the provider and the pension scheme. Especially in absence of national tracking systems pension savers often lack ~~sufficient~~holistic knowledge about their pension rights, which is related to the fact that data on such rights are often dispersed across different data holders. The sharing of data related to occupational and personal pension savings ~~should contribute to the development of pension tracking tools that provide savers with a comprehensive overview of their entitlements and retirement~~according to this regulation should be aligned in terms of content, data access and data formats with national pension tracking systems. The national pension tracking systems that can most effectively ensure comprehensive overviews by including entitlements from the first and second pillar (public and occupational pension schemes) and inc some ~~both within specific M~~cases also from third pillar personal schemes. Alignment is also desirable with regard to ember ~~States and cross-border in the Union~~ging forms of data exchange between national pension tracking systems, most notable the European Tracking System. Data on pension rights concerns in particular accrued pension entitlements, projected levels of retirement benefits, risks and guarantees of members and beneficiaries of occupational pension schemes. Access to data related to occupational pensions is without prejudice to national social and labour law on the organisation of pension systems, including membership of schemes and the outcomes of collective bargaining agreements.

Amendment 185 #

Proposal for a regulation
Recital 16

(16) Data which forms part of a creditworthiness assessment of a firm in the scope of this Regulation should consist of information which a firm provides to institutions and creditors as part of the loan application process or a request for a credit rating. This includes loan applications of micro, small, medium and large enterprises. It may include data collected by institutions and creditors as set out in Annex II of the European Banking Authority Guidelines on loan origination and monitoring13 . Such data may include financial statements and projections, information on financial liabilities and arrears in payment, evidence of ownership of the collateral, evidence of insurance of the collateral and information on guarantees. Additional data may be relevant if the purpose of the loan application relates to the purchase of commercial real estate or real estate development. _________________ 13 EBA Final Report on Guidelines on loan origination and monitoring.pdf (europa.eu), 29.05.2020.deleted

Amendment 186 #

Proposal for a regulation
Recital 16

Amendment 187 #

Proposal for a regulation
Recital 16

(16) Data which forms part of a creditworthiness assessment of a firm in the scope of this Regulation should consist of information which a firm provides to institutions and creditors as part of the loan application process ~~or a request for a credit rating~~. This includes loan applications of micro, small, medium and large enterprises. It may include data collected by institutions and creditors as set out in Annex II of the European Banking Authority Guidelines on loan origination and monitoring13 . Such data may include financial statements and projections, information on financial liabilities and arrears in payment, evidence of ownership of the collateral, evidence of insurance of the collateral and information on guarantees. Additional data may be relevant if the purpose of the loan application relates to the purchase of commercial real estate or real estate development. _________________ 13 EBA Final Report on Guidelines on loan origination and monitoring.pdf (europa.eu), 29.05.2020.

Amendment 188 #

Proposal for a regulation
Recital 16 a (new)

(16 a) Data required to conduct Know- Your-Customer (KYC) processes by financial firms, including small and medium enterprises, can be valuable when onboarding new customers. Therefore, the sharing of such data should significantly contribute to lowering barriers to switching providers and therefore result in increased competition and innovation for financial products and services to the benefit of customers.

Amendment 189 #

Eero HEINÄLUOMA, Jonás FERNÁNDEZ, Costas MAVRIDES, Alfred SANT, Aurore LALUCQ

Proposal for a regulation
Recital 17

(17) As this Regulation is meant to oblige financial institutions to provide access to defined categories of data at the request of the customer when acting as data holders, and allow the sharing of data based on customer permission when financial institutions act as data users, it should provide a list of the financial institutions that may act as either a data holder, a data user or both. Financial institutions should therefore be understood to mean those entities that provide financial products and financial services or offer relevant information services to customers in the financial sector. Data acquired from a third party where the data holder is not the original data holder should not be in the scope of this regulation.

Amendment 190 #

Proposal for a regulation
Recital 19

(19) The data use perimeter thus established in this Regulation and in the accompanying ~~guidelines (‘the guidelines’)~~regulatory technical standards to be developed by the European Banking Authority (EBA) and the European Insurance and Occupational Pensions Authority (EIOPA) should provide a proportionate framework on how personal data related to a consumer that falls within the scope of this Regulation should be used. The data use perimeter ensures consistency between the scope of this Regulation, which excludes data that forms part of a creditworthiness assessment of a consumer as well as data related to life, health and sickness insurance of a consumer, and the scope of the ~~guidelines,~~regulatory technical standards which set recommendations on how types of data originating from other areas of the financial sector that are in scope of this Regulation can be used to provide these products and services. ~~The guideline~~ The regulatory technical standards developed by the EBA should set out how other types of data that are in scope of this Regulation can be used to assess the credit score of a consumer. The ~~guideline~~regulatory technical standards developed by EIOPA should set out how data in scope of this Regulation can be used in products and services related to risk assessment and pricing in the case of life, health and sickness insurance products. The ~~guideline~~regulatory technical standards should be developed in a manner that is aligned to the needs of the consumer and proportionate to the provision of such products and services. The regulatory technical standards developed by EIOPA and the EBA should also elaborate on the limits for combining ‘customer data’ with other types of personal data, such as personal data obtained from third party sources, such as from social media networks or from data brokers.

Amendment 191 #

Proposal for a regulation
Recital 22

(22) The permission dashboard should display the permissions given by a customer, including when personal data are shared based on consent or are necessary for the performance of a contract. The permission dashboard should warn a customer in a standard way of the risk of possible contractual consequences of the withdrawal of a permission, but ~~the customer should remain responsible for managing such risk.~~ should not encourage or influence the consumer to grant access in a way that materially distorts or impairs their ability to make a free and informed decision, as the customer should remain responsible for managing such risk. It is essential that consumers know exactly what they are giving their permission for and that their rights under the GDPR apply. This information should be provided to consumers in clear and understandable language. To allow consumers to effectively stay in control of their data, the deployment of dark patterns and pre- ticketed boxes in dashboards are prohibited for the purpose of providing permissions to data sharing.The permission dashboard should be used to manage existing permissions. Data holders should inform data users in real-time of any withdrawal of a permission. The permission dashboard should include a record of permissions that have been withdrawn or have expired for a period of up to two years to allow the customer to keep track of their permissions in an informed and impartial manner. Data users should inform data holders in real-time of new and re-established permissions granted by customers, including the duration of validity of the permission and a short summary of the purpose of the permission. The information provided on the permission dashboard is without prejudice to the information requirements under Regulation (EU) 2016/679.

Amendment 192 #

Proposal for a regulation
Recital 22

(22) The permission dashboard should display the permissions given by a customer, including when personal data are shared based on consent or are necessary for the performance of a contract. The permission dashboard should warn a customer in a standard way of the risk of possible contractual consequences of the withdrawal of a permission, but the customer should remain responsible for managing such risk. The permission dashboard should be used to manage existing permissions. Data holders should inform data users i~~n real-time~~mmediately of any withdrawal of a permission. The permission dashboard should include a record of permissions that have been withdrawn or have expired for a period of up to two years to allow the customer to keep track of their permissions in an informed and impartial manner. Data users should inform data holders i~~n real-time~~mmediately of new and re-established permissions granted by customers, including the duration of validity of the permission and a short summary of the purpose of the permission. The information provided on the permission dashboard is without prejudice to the information requirements under Regulation (EU) 2016/679. The permission dashboard may be combined with the permission dashboard established under the Payment Services Regulation.

Amendment 193 #

Marco ZANNI, Valentino GRANT, Antonio Maria RINALDI

Proposal for a regulation
Recital 22

(22) The permission dashboard should display the permissions given by a customer~~, including when personal data are shared based on consent or are necessary for the performance of a contract~~. The permission dashboard should warn a customer in a standard way of the risk of possible contractual consequences of the withdrawal of a permission, but the customer should remain responsible for managing such risk. The permission dashboard should be used to manage existing permissions. Data ~~hold~~users should inform data usholders i~~n real-time~~mmediately of any withdrawal of a permission. The permission dashboard should include a record of permissions that have been withdrawn or have expired for a period of up to two years to allow the customer to keep track of their permissions in an informed and impartial manner. Data users should inform data holders i~~n real-time of new and re-established~~mmediately of new permissions granted by customers, including the duration of validity of the permission and a short summary of the purpose of the permission. The information provided on the permission dashboard is without prejudice to the information requirements under Regulation (EU) 2016/679.

Amendment 194 #

Proposal for a regulation
Recital 22

Amendment 195 #

Proposal for a regulation
Recital 22

Amendment 196 #

Othmar KARAS

Proposal for a regulation
Recital 23

(23) To ensure proportionality, certain financial institutions are out of the scope of this Regulation for reasons associated with their size or the services they provide, which would make it too difficult to comply with this regulation. These include institutions for occupational retirement provision which operate pension schemes which together do not have more than 15 members in total, as well as insurance intermediaries who are microenterprises or small or medium-sized enterprises. In addition, small or medium-sized enterprises acting as data holders that are within the scope of this Regulation should be allowed to establish an application programming interface jointly, reducing the costs for each of them. They can also avail themselves of external technology providers which run application programming interfaces in a pooled manner for financial institutions and may charge them only a low fixed usage fee and work largely on a pay-per-call basis. Small enterprises should only fall into the scope of this Regulation 12 months after the date of application of this Regulation, due to potentially limited supply and/or high costs of these solutions in the short term.

Amendment 197 #

Proposal for a regulation
Recital 23 a (new)

(23a) This Regulation sets out a series of requirements, such as the digitisation of data or the provision of data to customers free of charge and in real time, which incur costs for and place burdens on the entities falling under its scope of application. The Commission is therefore urged to conduct an in-depth analysis of the costs to which they give rise so as to ensure that no business is potentially disadvantaged.

Amendment 198 #

Proposal for a regulation
Recital 24

(24) This Regulation introduces a new legal obligation on financial institutions, when members of a financial data access scheme are acting as data holders, to ~~share defined categories of data at request of the customer~~provide data users with access to defined categories of data which are available digitally. The obligation on data holders to ~~share~~provide access to data at the expressed request of the customer should be specified by making available generally recognised EU-wide interoperable standards to also ensure that the data ~~shar~~accessed is of a sufficiently high quality. The European Supervisory Authorities should be mandated to issue guidelines to ensure EU-wide interoperable data standards. The data holder should make customer data available con~~tinuous~~ly for the purposes and under the conditions for which the customer has explicitly granted permission to a data user for a specific service which is clearly identified by the customer, where relevant and technically feasible, on a continuous basis. Continuous access could consist of multiple requests to make customer data available to fulfil the service agreed with the customer. It could also consist of a once- off access to customer data. While the data holder is responsible for the interface to be available and for the interface to be of adequate quality, the interface may be provided not only by the data holder but also by another financial institution, an external IT provider, an industry association or a group of financial institutions, or by a public body in a member state. For institutions for occupational retirement provisions, the interface can be integrated into pension dashboards or existing pension tracking services that cover a broader range of information, as long as it complies with the requirements of this Regulation.

Amendment 199 #

Proposal for a regulation
Recital 24

(24) This Regulation introduces a new legal obligation on financial institutions acting as data holders to share defined categories of data at request of the customer in the framework of a financial data sharing scheme. The obligation on data holders to share data at the request of the customer should be specified by making available generally recognised standards to also ensure that the data shared is of a sufficiently high quality. The data holder should make customer data available continuously for the purposes and under the conditions for which the customer has granted permission to a data user. Continuous access could consist of multiple requests to make customer data available to fulfil the service agreed with the customer. It could also consist of a one- off access to customer data. While the data holder is responsible for the interface to be available and for the interface to be of adequate quality, the interface may be provided not only by the data holder but also by another financial institution, an external IT provider, an industry association or a group of financial institutions, or by a public body in a member state. For institutions for occupational retirement provisions, the interface can be integrated into pension dashboards that cover a broader range of information, as long as it complies with the requirements of this Regulation.

Amendment 200 #

Proposal for a regulation
Recital 24 a (new)

(24a) With a view to ensuring a level playing field and avoiding any competitive disadvantage, entities excluded from the scope of this Regulation shall under no circumstances be obliged to share data collected through their work with data users as defined in this Regulation. This includes, for example, data collected by insurance intermediaries that are SMEs or micro-enterprises for the purposes of either a demands and needs assessment pursuant to Article 20 of Directive (EU) 2016/97 of the European Parliament and Council or an appropriateness and suitability assessment pursuant to Article 30 of said Directive.

Amendment 201 #

Proposal for a regulation
Recital 25

(25) In order to enable the contractual and technical interaction necessary for implementing data access between multiple financial institutions, data holders and data users should be required to be part of financial data ~~sharing~~access schemes. These schemes should develop data and EU-wide interoperable interface standards, joint standardised contractual frameworks governing access to specific datasets, and governance rules related to data ~~sharing~~access and re-use. In order to ensure that schemes function effectively across the EU Single Market, it is necessary to establish general principles for the governance of these schemes, including rules on inclusive governance and participation of data holders, data users and customers (to ensure balanced representation in schemes), transparency requirements, and a well-functioning appeal and review procedure (notably around the decision- making of schemes). Financial data ~~sharing~~access schemes must comply with Union rules in the area of consumer protection and data protection, privacy, and competition. The participants in such schemes are also encouraged to draw up codes of conduct ~~similar to those prepared by controllers and processors under~~in accordance with Article 40 of Regulation (EU) 2016/679. While such schemes may build upon existing market initiatives, the requirements set out in this Regulation should be specific to financial data ~~sharing~~access schemes or parts thereof which market participants use to fulfil their obligations under this Regulation after the data of application of these obligations. These schemes should not be required to replace or duplication existing data access schemes, including those established by way of the Directive (EU) 2015/2366, [insert reference – PSD], Regulation (EU) 2022/2554 and [insert reference – AMLR].

Amendment 202 #

Proposal for a regulation
Recital 25

(25) In order to enable the contractual and technical interaction necessary for implementing data access between multiple financial institutions, data holders and data users should be required to be part of financial data sharing schemes that can be established either on European or national level. These schemes should develop data and interface standards, joint standardised contractual frameworks governing access to specific datasets, and governance rules related to data sharing. In order to ensure that schemes function effectively, it is necessary to establish general principles for the governance of these schemes, including rules on inclusive governance and participation of data holders, data users and customers (to ensure balanced representation in schemes), transparency requirements, and a well-functioning appeal and review procedure (notably around the decision- making of schemes). Financial data sharing schemes must comply with Union rules in the area of consumer protection and data protection, privacy, and competition. The participants in such schemes are also encouraged to draw up codes of conduct similar to those prepared by controllers and processors under Article 40 of Regulation (EU) 2016/679. While such schemes may build upon existing market initiatives, the requirements set out in this Regulation should be specific to financial data sharing schemes or parts thereof which market participants use to fulfil their obligations under this Regulation after the data of application of these obligations.

Amendment 203 #

Proposal for a regulation
Recital 25

(25) In order to enable the contractual and technical interaction necessary for implementing data access between multiple financial institutions, data holders and data users should be required to be part of financial data sharing schemes. These schemes should develop data and interface standards, joint standardised contractual frameworks governing access to specific datasets, and governance rules related to data sharing. In order to ensure that schemes function effectively, it is necessary to establish general principles for the governance of these schemes, including rules on inclusive governance and participation of data holders, data users and customers (to ensure balanced representation in schemes), transparency requirements, and a well-functioning appeal and review procedure (notably around the decision-making of schemes). Financial data sharing schemes must comply with Union rules in the area of consumer protection and data protection, privacy, and competition. The participants in such schemes are also encouraged to draw up codes of conduct ~~similar to~~in accordance with those prepared by controllers and processors under Article 40 of Regulation (EU) 2016/679. While such schemes may build upon existing market initiatives, the requirements set out in this Regulation should be specific to financial data sharing schemes or parts thereof which market participants use to fulfil their obligations under this Regulation after the data of application of these obligations.

Amendment 204 #

Proposal for a regulation
Recital 25

(25) In order to enable the contractual and technical interaction necessary for implementing data access between multiple financial institutions, data holders and data users ~~should b~~are required to be part of financial data sharing schemes. These schemes should develop data and interface standards, joint standardised contractual frameworks governing access to specific datasets, and governance rules related to data sharing. In order to ensure that schemes function effectively, it is necessary to establish general principles for the governance of these schemes, including rules on inclusive governance and participation of data holders, data users and customers (to ensure balanced representation in schemes), transparency requirements, and a well-functioning appeal and review procedure (notably around the decision-making of schemes). Financial data sharing schemes must comply with Union rules in the area of consumer protection and data protection, privacy, and competition. The participants in such schemes are also encouraged to draw up codes of conduct similar to those prepared by controllers and processors under Article 40 of Regulation (EU) 2016/679. While such schemes may build upon existing market initiatives, the requirements set out in this Regulation should be specific to financial data sharing schemes or parts thereof which market participants use to fulfil their obligations under this Regulation after the data of application of these obligations.

Amendment 205 #

Proposal for a regulation
Recital 26 b (new)

(26 b) In the setting up of financial data access schemes, all parties to the schemes should be involved. Competent authorities on both the European and national level should also be available for consultation by those setting up the schemes, and be ready to offer advice on best practice and examples of other schemes set up during the period running up to the application of this regulation.

Amendment 206 #

Proposal for a regulation
Recital 27

(27) In order to ensure the effectiveness of this Regulation, the power to adopt acts in accordance with Article 290 of the Treaty on the Functioning of the European Union should be delegated to the Commission in respect of specifying the modalities and characteristics of a financial data sharing scheme in case a scheme is not developed by the data holders and the data users. It is of particular importance that the Commission carry out appropriate consultations during its preparatory work, including at expert level, and that those consultations be conducted in accordance with the principles laid down in the Interinstitutional Agreement of 13 April 2016 on Better Law-Making17 . In particular, to ensure equal participation in the preparation of delegated acts, the European Parliament and the Council receive all documents at the same time as Member States' experts, and their experts systematically have access to meetings of Commission expert groups dealing with the preparation of delegated acts. _________________ 17 OJ L 123, 12.5.2016, p. 1.deleted

Amendment 207 #

Marco ZANNI, Valentino GRANT, Antonio Maria RINALDI

Proposal for a regulation
Recital 28

(28) Data holders and data users should be allowed to use existing market standards and infrastructures for technical interfaces like application programming interfaces when developing common standards for mandatory data ~~sharing~~access.

Amendment 208 #

Proposal for a regulation
Recital 28

Amendment 209 #

Giuseppe FERRANDINO

Proposal for a regulation
Recital 31

(31) To promote consumer protection, enhance customer trust and ensure a level playing field, it is necessary to lay down rules on who is eligible to access customers’ data. Such rules should ensure that all data users are authorised and supervised by competent authorities. This would ensure that data can be accessed only by regulated financial institutions or by firms subject to a dedicated authorisation as financial information service providers’ (‘FISPs’) which is subject to this Regulation. Eligibility rules on FISPs, are needed to safeguard financial stability, market integrity and consumer protection, as FISPs would ~~provide financial products and services to customers in the Union and would~~ access data held by financial institutions and the integrity of which is essential to preserve the financial institutions’ ability to continue providing financial services in a safe and sound manner. Such rules are also required to guarantee the proper supervision of FISPs by competent authorities in line with their mandate to safeguard financial stability and integrity in the Union, which would allow FISPs to provide throughout the Union the services for which they are authorised.

Amendment 210 #

Proposal for a regulation
Recital 31

(31) To promote consumer protection, enhance customer trust and ensure a level playing field, it is necessary to lay down rules on who is eligible to access customers’ data. Such rules should ensure that all data users are authorised and supervised by competent authorities. This would ensure that data can be accessed only by regulated financial institutions or by firms subject to a dedicated authorisation as financial information service providers’ (‘FISPs’) which is subject to this Regulation. Eligibility rules on FISPs, are needed to safeguard financial stability, market integrity and consumer protection, as FISPs would provide financial ~~products and~~information services to customers in the Union and would access data held by financial institutions and the integrity of which is essential to preserve the financial institutions’ ability to continue providing financial services in a safe, sound, and s~~ound~~ecure manner. Such rules are also required to guarantee the proper supervision of FISPs by competent authorities in line with their mandate to safeguard financial stability and integrity in the Union, which would allow FISPs to provide throughout the Union the financial information services for which they are authorised.

Amendment 211 #

Marco ZANNI, Valentino GRANT, Antonio Maria RINALDI

Proposal for a regulation
Recital 31

(31) To promote consumer protection, enhance customer trust and ensure a level playing field, it is necessary to lay down rules on who is eligible to access customers’ data. Such rules should ensure that all data users are authorised and supervised by competent authorities. This would ensure that data can be accessed only by regulated financial institutions or by firms subject to a dedicated authorisation as financial information service providers’ (‘FISPs’) which is subject to this Regulation. Eligibility rules on FISPs, are needed to safeguard financial stability, market integrity and consumer protection, as FISPs would provide financial ~~products and services to customers in the Union~~information services and would access data held by financial institutions and the integrity of which is essential to preserve the financial institutions’ ability to continue providing financial services in a safe and sound manner. Such rules are also required to guarantee the proper supervision of FISPs by competent authorities in line with their mandate to safeguard financial stability and integrity in the Union, which would allow FISPs to provide throughout the Union the financial information services for which they are authorised.

Amendment 212 #

Proposal for a regulation
Recital 31

(31) To promote consumer protection, enhance customer trust and ensure a level playing field, it is necessary to lay down rules on who is eligible to access customers’ data. Such rules should ensure that all data users are authorised and supervised by competent authorities. This would ensure that data can be accessed only by regulated financial institutions or by firms subject to a dedicated authorisation as financial information service providers’ (‘FISPs’) which is subject to this Regulation. Eligibility rules on FISPs, are needed to safeguard financial stability, market integrity and consumer protection, as FISPs would provide financial ~~products and services to customers in the Union~~information services and would access data held by financial institutions and the integrity of which is essential to preserve the financial institutions’ ability to continue providing financial services in a safe and sound manner. Such rules are also required to guarantee the proper supervision of FISPs by competent authorities in line with their mandate to safeguard financial stability and integrity in the Union, which would allow FISPs to provide throughout the Union the financial information services for which they are authorised.

Amendment 213 #

Proposal for a regulation
Recital 31 a (new)

(31a) Providers of financial information services as defined in this Regulation shall be data users authorised to provide financial information services. Financial information services shall be services provided with the aim of imparting information to customers on financial products falling within the scope of the Regulation. Financial information services may consist, for instance, in analytical, comparative and aggregation activities. The providers of such services shall in no event be authorised to conduct, for example, activities regulated by existing sector-specific financial legislation. These activities shall be carried out by entities regulated by the relevant sector-specific legislation. As such, these providers shall not be authorised, for example, to provide financial advice or to carry out insurance distribution activities regulated under Directive (EU) 2016/97 or Directive 2014/65/EU.

Amendment 214 #

Stéphanie YON-COURTIN, Gilles BOYER

Proposal for a regulation
Recital 33

(33) In order to enable effective supervision and to eliminate the possibility of evading or circumventing supervision, financial information service providers must be either legally incorporated in the Union or in case they are incorporated in a third country appoint a legal representative in the Union. An effective supervision by the competent authorities is necessary for the enforcement of requirements under this Regulation to ensure integrity and stability of the financial system and to protect consumers. The requirement of legal incorporation of financial information service providers in the Union or the appointment of a legal representative in the Union does not amount to data localisation since this Regulation does not entail any further requirement on data processing including storage to be undertaken in Union.

Amendment 215 #

Proposal for a regulation
Recital 33

(33) In order to enable effective supervision and to eliminate the possibility of evading or circumventing supervision, financial information service providers must ~~be either legally incorporated in the Union or in case they are incorpora~~only be provided by legal persons that have a registered office in a Member State in which they intend ~~in a third country appoint a legal represen~~to carry out or do carry out substantive ~~in the Union.~~business activities An effective supervision by the competent authorities is necessary for the enforcement of requirements under this Regulation to ensure integrity and stability of the financial system and to protect consumers. The requirement of legal incorporation of financial information service providers in the Union or the appointment of a legal representative in the Union does not amount to data localisation since this Regulation does not entail any further requirement on data processing including storage to be undertaken in Union.

Amendment 216 #

Marco ZANNI, Valentino GRANT, Antonio Maria RINALDI

Proposal for a regulation
Recital 33

(33) In order to enable effective supervision and to eliminate the possibility of evading or circumventing supervision, financial information service providers must ~~be either legally incorporated in the Union or in case they are incorpora~~only be provided by legal persons that have a registered office in a Member State in which they intend ~~in a third country appoint a legal represen~~to carry out or do carry out substantive ~~in the Union~~business activities. An effective supervision by the competent authorities is necessary for the enforcement of requirements under this Regulation to ensure integrity and stability of the financial system and to protect consumers. The requirement of legal incorporation of financial information service providers in the Union ~~or the appointment of a legal representative in the Union~~ does not amount to data localisation since this Regulation does not entail any further requirement on data processing including storage to be undertaken in Union.

Amendment 217 #

Proposal for a regulation
Recital 33

(33) In order to enable effective supervision and to eliminate the possibility of evading or circumventing supervision, financial information service providers must ~~be either legally incorporated in the Union or in case they are incorpora~~only be provided by legal persons that have a registered office in a Member State in which they intend ~~in a third country appoint a legal represen~~to carry out or do carry out substantive ~~in the Union~~business activities. An effective supervision by the competent authorities is necessary for the enforcement of requirements under this Regulation to ensure integrity and stability of the financial system and to protect consumers. The requirement of legal incorporation of financial information service providers in the Union ~~or the appointment of a legal representative in the Union~~ does not amount to data localisation since this Regulation does not entail any further requirement on data processing including storage to be undertaken in Union.

Amendment 218 #

Stéphanie YON-COURTIN, Gilles BOYER

Proposal for a regulation
Recital 34

(34) A financial information service provider should be authorised in the jurisdiction of the Member State where its main establishment is located, that is, where the financial information service provider intends to carry out substantive business activities and where it has its head office or registered office within which the principal functions and operational control are exercised. In respect of financial information service providers that do not have an establishment in the Union but require access to data in the Union and therefore fall within the scope of this Regulation, the Member State where those financial information service providers have appointed their legal representative should have jurisdiction, considering the function of legal representatives under this Regulation.

Amendment 219 #

Proposal for a regulation
Recital 34

Amendment 220 #

Proposal for a regulation
Recital 48

(48) Regulation (EU) 2016/679 applies when personal data are processed. It provides for the rights of a data subject, including the right of access and right to port personal data. This Regulation is without prejudice to the rights of a data subject provided under Regulation (EU) 2016/679, including the right of access and right to data portability. This Regulation creates a legal obligation to share customer personal and non-personal data upon customer’s request and mandates the technical feasibility of access and sharing for all types of data within the scope of this Regulation. The granting of permission by a customer is without prejudice to the obligations of data users under Article 6 of(1)(a) or (b) of Regulation (EU) 2016/679. Permission should not be construed as ‘consent’ or ‘explicit consent’ or ‘necessity for the performance of a contract’ as defined in Regulation (EU) 2016/679. Personal data that are made available and shared with a data user should only be processed for services provided by a data user where there is a valid legal basis under Article 6(1) of Regulation (EU) 2016/679 and, when applicable, where the requirements of Article 9 of that Regulation on the processing of special categories of data are met. Processing of personal data in the context of this Regulation should be carried out in accordance with Regulation (EU) 2016/679 and Regulation (EU) 2018/1725, as well as, where applicable, with the ePrivacy Directive. In case of mixed datasets, where personal and non- personal data are inextricably linked, the protections in EU data protection legislation and in this Regulation concerning personal data shall be fully applicable.

Amendment 221 #

Marco ZANNI, Valentino GRANT, Antonio Maria RINALDI

Proposal for a regulation
Recital 48

(48) ~~Regulation (EU) 2016/679 applies when personal data are processed. It~~Processing of personal data in the context of this Regulation should be carried out in accordance with Regulation (EU) 2016/679 and Regulation (EU) 2018/1725, as well as, where applicable, with Directive 2002/58/EC of the European Parliament and of the Council1a (ePrivacy Directive). Regulation (EU) 2016/679 provides for the rights of a data subject, including the right of access and right to port personal data. This Regulation is without prejudice to the rights of a data subject provided under Regulation (EU) 2016/679, including the right of access and right to data portability. This Regulation creates a legal obligation to ~~share~~provide access to and enable re-use of customer personal and non-personal data upon customer’s request and mandates the technical feasibility of access ~~and sharing~~ for all types of data within the scope of this Regulation. The granting of permission by a customer is without prejudice to the obligations of data users under Article 6 of Regulation (EU) 2016/679. Permission should not be construed as ‘consent’ or ‘necessity for the performance of a contract’ as defined in Regulation (EU) 2016/679. Personal data that are made available ~~and shared with~~to a data user should only be processed for services provided by a data user where there is a valid legal basis under Article 6(1) of Regulation (EU) 2016/679 and, when applicable, where the requirements of Article 9 of that Regulation on the processing of special categories of data are met.

Amendment 222 #

Proposal for a regulation
Recital 48

Amendment 223 #

Eero HEINÄLUOMA, Jonás FERNÁNDEZ, Costas MAVRIDES, Aurore LALUCQ

Proposal for a regulation
Recital 48

(48) ~~Regulation (EU) 2016/679 applies when personal data are processed. It~~Processing of personal data in the context of this Regulation should be carried out in accordance with Regulation (EU) 2016/679 and Regulation (EU) 2018/1725, as well as, where applicable, with the ePrivacy Directive. Regulation (EU) 2016/679 provides for the rights of a data subject, including the right of access and right to port personal data. This Regulation is without prejudice to the rights of a data subject provided under Regulation (EU) 2016/679, including the right of access and right to data portability. This Regulation creates a legal obligation to share customer personal and non- personal data upon customer’s request and mandates the technical feasibility of access and sharing for all types of data within the scope of this Regulation. The granting of permission by a customer is without prejudice to the obligations of data users under Article 6 of Regulation (EU) 2016/679. Permission should not be construed as ‘consent’ or ‘explicit consent’ or ‘necessity for the performance of a contract’ as defined in Regulation (EU) 2016/679. Personal data that are made available and shared with a data user should only be processed for services provided by a data user where there is a valid legal basis under Article 6(1) of Regulation (EU) 2016/679 and, when applicable, where the requirements of Article 9 of that Regulation on the processing of special categories of data are met.

Amendment 224 #

Proposal for a regulation
Recital 48

(48) Regulation (EU) 2016/679 applies when personal data are processed. It provides for the rights of a data subject, including the right of access and right to port personal data. This Regulation is without prejudice to the rights of a data subject provided under Regulation (EU) 2016/679, including the right of access and right to data portability. This Regulation creates a legal obligation to share customer personal and non-personal data upon customer’s request and mandates the technical feasibility of access and sharing for all types of data within the scope of this Regulation. The granting of permission by a customer is without prejudice to the obligations of data users under Article 6 of Regulation (EU) 2016/679. Permission under this Regulation should not be inferred as ‘consent’ or ‘explicit consent’ or ‘necessity for the performance of a contract’ as defined in Regulation (EU) 2016/679 and should be in alignment with the Directive (EU) 2015/2366 and the Commission Delegated Regulation (EU) 2018/389. Personal data that are made available and shared with a data user should only be processed for services provided by a data user where there is a valid legal basis under Article 6(1) of Regulation (EU) 2016/679 and, when applicable, where the requirements of Article 9 of that Regulation on the processing of special categories of data are met.

Amendment 225 #

Proposal for a regulation
Article 1 – paragraph 2 a (new)

This Regulation is without prejudice to Regulation (EU) 2016/679, Regulation (EU) 2018/1725, Directive 2002/58/EC, Directive (EU) 2019/2161, Directive 93/13/EEC, and Directive 2011/83. In the event of a conflict between this Regulation and Union law on the protection of personal data or privacy, or national legislation adopted in accordance with such Union law, the relevant Union or national law on the protection of personal data or privacy shall prevail.

Amendment 226 #

Proposal for a regulation
Article 1 – paragraph 2 b (new)

This Regulation is without prejudice to Directive (EU) 2023/2225, Directive 2014/17/EU, Directive 2014/65/EU and Directive (EU) 2016/97.

Amendment 227 #

Proposal for a regulation
Article 1 – paragraph 2 c (new)

This Regulation shall not affect the right of a customer to receive financial services and/or products without any additional costs from providers listed in article 2(2), shall they not avail themselves to the permission dashboard of article 8, or otherwise enable financial data sharing under the proposal. For the purposes of the implementation of this paragraph, the burden of proof shall lie with the data user.

Amendment 228 #

Proposal for a regulation
Article 2 – paragraph 1 – introductory part

1. This Regulation applies to the following categories of basic customer data , which is derived from financial services provided within the Union:

Amendment 229 #

Proposal for a regulation
Article 2 – paragraph 1 – point a

(a) mortgage credit agreements~~, loans an~~ as defined in Directive (EU) 2021/2167, loans with installments provided by the data holder, and accounts, including credit card accounts, except payment accounts as defined in the Payment Services Directive (EU) 2015/2366 and technical accounts, including data on balance~~, conditions~~ and transactions;

Amendment 230 #

Proposal for a regulation
Article 2 – paragraph 1 – point a

(a) mortgage credit agreements~~, loans and accounts~~ as defined in Directive (EU)2014/17, loans to consumers as defined in Directive EU n. 2023/2225 , except payment accounts as defined in the Payment Services Directive (EU) 2015/2366, including data on ~~balance~~, conditions and transactions;.

Amendment 231 #

Proposal for a regulation
Article 2 – paragraph 1 – point a

(a) mortgage credit agreements, ~~loan~~credit agreements and accounts, except payment accounts as defined in the Payment Services Directive (EU) 2015/2366, including data on balance, conditions and transactions;

Amendment 232 #

Proposal for a regulation
Article 2 – paragraph 1 – point b

(b) savings, investments in financial instruments, ~~insurance-based investment products,~~ crypto-assets, real estate and other related financial assets as well as the economic benefits derived from such assets; including data collected for the purposes of carrying out an assessment of suitability and appropriateness in accordance with Article 25 of Directive 2014/65/EU of the European Parliament and of the Council32; _________________ 32 Directive 2014/65/EU of the European Parliament and of the Council of 15 May 2014 on markets in financial instruments and amending Directive 2002/92/EC and Directive 2011/61/EU (recast) (OJ L 173, 12.6.2014, p. 349).

Amendment 233 #

Lídia PEREIRA

Proposal for a regulation
Article 2 – paragraph 1 – point b

Amendment 234 #

Proposal for a regulation
Article 2 – paragraph 1 – point b

Amendment 235 #

Proposal for a regulation
Article 2 – paragraph 1 – point b

(b) savings, investments in financial instruments, insurance-based investment products, crypto-assets, real estate and other related financial assets as well as the economic benefits derived from such assets; including data collected for the purposes of carrying out an ass comprising term deposits, structured deposits, and savings accounts, investments in financial instruments in accordance with Section C of Annex I of Directive (EU) 2014/65 and excluding derivative transactions used for risk management purposes, insurance-based invesstment of suitability and appropriateness in accordance with Article 25 of Directive 2014/65/EU of the European Parliament and of the Council32 ; _________________ 32 Directive 2014/65/EU of the European Parliament and of the Council of 15 May 2014 on markets in financial instruments and amending Directive 2002/92/EC and Directive 2011/61/EU (recast) (OJ L 173, 12.6.2014, p. 349).products, crypto-assets as defined in Article 3(1)(5) of Regulation (EU) 2023/1114, and other related financial assets as well as the economic benefits derived from such assets;

Amendment 236 #

Marco ZANNI, Valentino GRANT, Antonio Maria RINALDI

Proposal for a regulation
Article 2 – paragraph 1 – point b

(b) savings, investments in financial instruments, insurance-based investment products, crypto-assets, real estate and other related financial assets as well as the economic benefits derived from such assets; including data collected for the purposes of carrying out an ass represented by term deposits, structured deposits and savings accounts, investments in financial instruments, in accordance with Section C of Annex I of Directive 2014/65/EU and excluding derivative transactions used for risk management purposes, insurance- based invesstment of suitability and appropriateness in accordance with Article 25 of Directive 2014/65/EU of the European Parliament and of the Council32 ; _________________ 32 Directive 2014/65/EU of the European Parliament and of the Council of 15 May 2014 on markets in financial instruments and amending Directive 2002/92/EC and Directive 2011/61/EU (recast) (OJ L 173, 12.6.2014, p. 349).products, crypto-assets, as defined under Article 3(1)(5) of Regulation 2023/1114/EU, and other related financial assets as well as the economic benefits derived from such assets;

Amendment 237 #

Proposal for a regulation
Article 2 – paragraph 1 – point b

Amendment 238 #

Marco ZANNI, Valentino GRANT, Antonio Maria RINALDI

Proposal for a regulation
Article 2 – paragraph 1 – point b

Amendment 239 #

Proposal for a regulation
Article 2 – paragraph 1 – point c

(c) pension rights in occupational pension schemes, in accordance with Directive 2009/138/EC and Directive (EU) 2016/2341 of the European Parliament and of the Council33 ; _________________ 33 Directive (EU) 2016/2341 of the European Parliament and of the Council of 14 December 2016 on the activities and supervision of institutions for occupational retirement provision (IORPs) (recast) (OJ L 354, 23.12.2016, p. 37).deleted

Amendment 240 #

Caroline NAGTEGAAL, Esther DE LANGE, Ondřej KOVAŘÍK

Proposal for a regulation
Article 2 – paragraph 1 – point c

(c) pension rights in occupational pension schemes, in accordance with Directive 2009/138/EC and Directive (EU) 2016/2341 of the European Parliament and of the Council33 ; with the exception of data related to sickness and health cover of a member or beneficiary; _________________ 33 Directive (EU) 2016/2341 of the European Parliament and of the Council of 14 December 2016 on the activities and supervision of institutions for occupational retirement provision (IORPs) (recast) (OJ L 354, 23.12.2016, p. 37).

Amendment 241 #

Proposal for a regulation
Article 2 – paragraph 1 – point c

(c) pension rights in occupational pension schemes, in accordance with Directive 2009/138/EC and Directive (EU) 2016/2341 of the European Parliament and of the Council33 , insofar as they are accessible to all interested consumers; _________________ 33 Directive (EU) 2016/2341 of the European Parliament and of the Council of 14 December 2016 on the activities and supervision of institutions for occupational retirement provision (IORPs) (recast) (OJ L 354, 23.12.2016, p. 37).

Amendment 242 #

Marco ZANNI, Valentino GRANT, Antonio Maria RINALDI

Proposal for a regulation
Article 2 – paragraph 1 – point c

(c) pension rights in occupational pension schemes, in accordance with Directive 2009/138/EC and Directive (EU) 2016/2341 of the European Parliament and of the Council33 , that are accessible for all interested consumers; _________________ 33 Directive (EU) 2016/2341 of the European Parliament and of the Council of 14 December 2016 on the activities and supervision of institutions for occupational retirement provision (IORPs) (recast) (OJ L 354, 23.12.2016, p. 37).

Amendment 243 #

Proposal for a regulation
Article 2 – paragraph 1 – point d

~~(d) pension rights on the provision of pan-European personal pension products, in accordance with Regulation (EU) 2019/1238;~~deleted

Amendment 244 #

Marco ZANNI, Valentino GRANT, Antonio Maria RINALDI

Proposal for a regulation
Article 2 – paragraph 1 – point e

(e) non-life insurance products in accordance with Directive 2009/138/EC, with the exception of sickness and health insurance products; including data collected for the purposes of a demands and needs assessment in accordance with Article 20 of Directive (EU) 2016/97 of the European Parliament and Council34, and data collected for the purposes of an appropriateness and suitability assessment in accordance with Article 30 of Directive (EU) 2016/97. _________________ 34 Directive (EU) 2016/97 of the European Parliament and of the Council of 20 January 2016 on insurance distribution (recast) (OJ L 26, 2.2.2016, p. 19–5)deleted

Amendment 245 #

Giuseppe FERRANDINO

Proposal for a regulation
Article 2 – paragraph 1 – point e

(e) non-life insurance products in accordance with Directive 2009/138/EC, with the exception of sickness and health insurance products; including data collected for the purposes of a demands and needs assessment in accordance with Article 20 of Directive (EU) 2016/97 of the European Parliament and Council34 , and data collected for the purposes of an appropriateness and suitability assessment in accordance with Article 30 of Directive (EU) 2016/97. _________________ 34 Directive (EU) 2016/97 of the European Parliament and of the Council of 20 January 2016 on insurance distribution (recast) (OJ L 26, 2.2.2016, p. 19–5)deleted

Amendment 246 #

Proposal for a regulation
Article 2 – paragraph 1 – point e

(e) non-life insurance products in accordance with Directive 2009/138/EC, with the exception of sickness and health insurance products; including data collected for the purposes of a demands and needs assessment in accordance with Article 20 of Directive (EU) 2016/97 of the European Parliament and Council34 , and data collected for the purposes of an appropriateness and suitability assessment in accordance with Article 30 of Directive (EU) 2016/97. _________________ 34 Directive (EU) 2016/97 of the European Parliament and of the Council of 20 January 2016 on insurance distribution (recast) (OJ L 26, 2.2.2016, p. 19–5)deleted

Amendment 247 #

Proposal for a regulation
Article 2 – paragraph 1 – point e

(e) non-life insurance products in accordance with Directive 2009/138/EC, with the exception of sickness and health insurance products; including data collected for the purposes of a demands and needs assessment in accordance with Article 20 of Directive (EU) 2016/97 of the European Parliament and Council34 , and data collected for the purposes of an appropriateness and suitability assessment in accordance with Article 30 of Directive (EU) 2016/97. _________________ 34 Directive (EU) 2016/97 of the European Parliament and of the Council of 20 January 2016 on insurance distribution (recast) (OJ L 26, 2.2.2016, p. 19–5)deleted

Amendment 248 #

Proposal for a regulation
Article 2 – paragraph 1 – point e

(e) non-life insurance products in accordance with Directive 2009/138/EC, with the exception of sickness and health insurance products; including data collected for the purposes of a demands and needs assessment in accordance with Article 20 of Directive (EU) 2016/97 of the European Parliament and Council34 , and data collected for the purposes of an appropriateness and suitability assessment in accordance with Article 30 of Directive (EU) 2016/97. _________________ 34 Directive (EU) 2016/97 of the European Parliament and of the Council of 20 January 2016 on insurance distribution (recast) (OJ L 26, 2.2.2016, p. 19–5) European Parliament and Council;

Amendment 249 #

Proposal for a regulation
Article 2 – paragraph 1 – point e

(e) non-life insurance products in accordance with Directive 2009/138/EC, with the exception of sickness and health insurance products; and other insurance products involving health data, such as accident insurance, disability insurance, long-term care insurance;including data collected for the purposes of a demands and needs assessment in accordance with Article 20 of Directive (EU) 2016/97 of the European Parliament and Council34 , and data collected for the purposes of an appropriateness and suitability assessment in accordance with Article 30 of Directive (EU) 2016/97. _________________ 34 Directive (EU) 2016/97 of the European Parliament and of the Council of 20 January 2016 on insurance distribution (recast) (OJ L 26, 2.2.2016, p. 19–5)

Amendment 250 #

Proposal for a regulation
Article 2 – paragraph 1 – point f

~~(f) data which forms part of a creditworthiness assessment of a firm which is col~~delected ~~as part of a loan application process or a request for a credit rating.~~

Amendment 251 #

Proposal for a regulation
Article 2 – paragraph 1 – point f

~~(f) data which forms part of a creditworthiness assessment of a firm which is col~~delected ~~as part of a loan application process or a request for a credit rating.~~

Amendment 252 #

Lídia PEREIRA

Proposal for a regulation
Article 2 – paragraph 1 – point f

~~(f) data which forms part of a creditworthiness assessment of a firm which is col~~delected ~~as part of a loan application process or a request for a credit rating.~~

Amendment 253 #

Proposal for a regulation
Article 2 – paragraph 1 – point f

(f) data which forms part of a creditworthiness assessment of a firm which is collected as part of a loan application process ~~or a request for a credit rating~~.

Amendment 254 #

Proposal for a regulation
Article 2 – paragraph 1 – point f

(f) data which forms part of a creditworthiness assessment of a firm which is collected as part of a loan application process or a request for a credit rating. Data collected as part of a creditworthiness assessment of consumers shall be excluded.

Amendment 255 #

Proposal for a regulation
Article 2 – paragraph 1 – point f

(f) data which forms part of a creditworthiness assessment of a firm which is collected as part of a ~~loan~~credit agreement application process or a request for a credit rating.

Amendment 256 #

Proposal for a regulation
Article 2 – paragraph 1 – point f a (new)

(f a) non-sensitive categories of data used by data holders to meet Know-Your- Customer (KYC) requirements for business customers.

Amendment 257 #

Proposal for a regulation
Article 2 – paragraph 1 – point f a (new)

(fa) (e) vehicle insurance services;

Amendment 258 #

Proposal for a regulation
Article 2 – paragraph 2 – point b

(b) payment institutions, including account information service providers ~~and payment institutions exempted pursuant to Directive (EU) 2015/2366~~;

Amendment 259 #

Proposal for a regulation
Article 2 – paragraph 2 – point b

(b) payment institutions, including ~~account information service providers and~~ payment institutions exempted pursuant to Directive (EU) 2015/2366;

Amendment 260 #

Proposal for a regulation
Article 2 – paragraph 2 – point c

(c) electronic money institutions, including electronic money institutions exempted pursuant to Directive 2009/110/EC of the European Parliament and of the Council35 ; _________________ 35 Directive 2009/110/EC of the European Parliament and of the Council of 16 September 2009 on the taking up, pursuit and prudential supervision of the business of electronic money institutions amending Directives 2005/60/EC and 2006/48/EC and repealing Directive 2000/46/EC (OJ L 267, 10.10.2009, p. 7).;

Amendment 261 #

Proposal for a regulation
Article 2 – paragraph 2 – point i

(i) insurances that are accessible for all interested consumers and reinsurance undertakings;

Amendment 262 #

Proposal for a regulation
Article 2 – paragraph 2 – point j

(j) insurance intermediaries ~~and ancillary insurance intermediaries~~;

Amendment 263 #

Proposal for a regulation
Article 2 – paragraph 2 – point k

(k) institutions for occupational retirement provision (IORP), excluding small IORP as referred to in Article 5 of Directive (EU) 2016/2341;

Amendment 264 #

Proposal for a regulation
Article 2 – paragraph 2 – point k

(k) institutions for occupational retirement provision, insofar as they are accessible to all interested consumers;

Amendment 265 #

Proposal for a regulation
Article 2 – paragraph 2 – point k

(k) institutions for occupational retirement provision that are accessible for all interested consumers;

Amendment 266 #

Proposal for a regulation
Article 2 – paragraph 2 – point l

~~(l) credit rating agencies;~~deleted

Amendment 267 #

Proposal for a regulation
Article 2 – paragraph 2 – point l

~~(l) credit rating agencies;~~deleted

Amendment 268 #

Proposal for a regulation
Article 2 – paragraph 2 – point m

(m) crowdfunding service providers, which are not microenterprises or small or medium sized enterprises;

Amendment 269 #

Proposal for a regulation
Article 2 – paragraph 2 – point o

(o) financial information service providers;

Amendment 270 #

Eero HEINÄLUOMA, Jonás FERNÁNDEZ, Costas MAVRIDES, Alfred SANT, Aurore LALUCQ

Proposal for a regulation
Article 2 – paragraph 2 – point o a (new)

(o a) operators of payment schemes

Amendment 271 #

Proposal for a regulation
Article 2 – paragraph 3

3. This Regulation shall not apply to the entities referred to in Article 2(3), points (a) to (e), of Regulation (EU) 2022/2554. Any undertaking designated as a gatekeeper, pursuant to Article 3 of Regulation (EU) 2022/1925, shall not be an eligible data user for the purposes of this Regulation. .

Amendment 272 #

Proposal for a regulation
Article 2 – paragraph 3

Amendment 273 #

Othmar KARAS

Proposal for a regulation
Article 2 – paragraph 3

3. This Regulation shall apply to small enterprises as defined in Recommendation 2003/361/EC by [OP please insert the date 12 months after the date of application of this Regulation], and shall not apply to the entities referred to in Article 2(3), points (a) to (e), of Regulation (EU) 2022/2554.

Amendment 274 #

Proposal for a regulation
Article 2 – paragraph 3

3. This Regulation shall not apply to the entities referred to in Article 2(3), points (a) to (e), of Regulation (EU) 2022/2554 and to Article 2(5) points (4) to (23), [insert reference to CRD VI once published to the Official Journal of the European Union].

Amendment 275 #

Proposal for a regulation
Article 2 – paragraph 3 a (new)

3a. By way of exemption from paragraph 3, this Regulation shall apply to the entities referred to in Article 2(3)(e) of Regulation (EU) 2022/2554 if they so wish, provided that they prove their compliance with the relevant provisions of Regulation (EU) 2022/2554.

Amendment 276 #

Proposal for a regulation
Article 2 – paragraph 3 a (new)

3 a. By way of derogation from paragraph 3, this Regulation shall apply to entities referred to in Article 2(3), point (e) of Regulation (EU) 2022/2554 to the condition that these entities prove they comply with the proportionate provisions established for microenterprises laid down down in in the the Regulation (EU) 2022/2554.

Amendment 277 #

Eero HEINÄLUOMA, Jonás FERNÁNDEZ, Costas MAVRIDES, Aurore LALUCQ

Proposal for a regulation
Article 2 – paragraph 3 a (new)

3 a. This regulation shall not apply to SMEs, but there shall be an option for SMEs to opt-in to the provisions of the regulation;

Amendment 278 #

Proposal for a regulation
Article 2 – paragraph 3 a (new)

3 a. 3a. This Regulation shall not apply to special categories of data referred to in Article 9(1) of Regulation (EU) 2016/679.

Amendment 279 #

Lídia PEREIRA

Proposal for a regulation
Article 2 – paragraph 3 a (new)

3 a. This Regulation shall not apply to data referred in article 9 of Regulation (EU) 2016/679 (General Data Protection Regulation).

Amendment 280 #

Proposal for a regulation
Article 2 – paragraph 3 a (new)

3 a. This Regulation does not apply to special categories of data referred to in Article 9(1) of Regulation (EU) 2016/679.

Amendment 281 #

Eero HEINÄLUOMA, Jonás FERNÁNDEZ, Costas MAVRIDES, Alfred SANT, Aurore LALUCQ

Proposal for a regulation
Article 2 – paragraph 3 b (new)

3b. This Regulation shall apply to the credit intermediaries referred to in Article 4(5) of Directive 2014/17/EU if they so wish, provided that they prove their compliance with the relevant provisions of Regulation (EU) 2022/2554.

Amendment 282 #

Proposal for a regulation
Article 2 – paragraph 3 b (new)

3 b. This regulation shall not apply to collectively concluded products such as products resulted from social partners bargaining, trade unions or products procured by non-profit organisations on behalf of their members.

Amendment 283 #

Proposal for a regulation
Article 2 – paragraph 3 c (new)

3c. Small and non-interconnected investment firms as defined in Article 12 of Regulation (EU) 2019/2033 shall fall outside the scope of this Regulation.

Amendment 284 #

Proposal for a regulation
Article 2 – paragraph 4 a (new)

4 a. This Regulation is without prejudice to Union law and national law on the protection of personal data, privacy and confidentiality of communications and integrity of terminal equipment, which shall apply to personal data processed in connection with the rights and obligations laid down herein, in particular Regulations (EU) 2016/679 and (EU) 2018/1725 and Directive 2002/58/EC, including the powers and competences of supervisory authorities and the rights of data subjects. Insofar as users are data subjects, the rights laid down in Chapter II of this Regulation shall complement the rights of access by data subjects and rights to data portability under Articles 15 and 20 of Regulation (EU) 2016/679. In the event of a conflict between this Regulation and Union law on the protection of personal data or privacy, or national legislation adopted in accordance with such Union law, the relevant Union or national law on the protection of personal data or privacy shall prevail.

Amendment 285 #

Proposal for a regulation
Article 2 – paragraph 4 a (new)

4 a. Only financially relevant information and data from the categories mentioned above shall be processed for the purposes of this Regulation. Special categories of data, under article 9(1) of Regulation (EU) 2016/679 shall not be processed for the purposes of this Regulation, unless it is strictly necessary to fulfil the service requested by the customer. Data that has been derived or inferred from data provided by a customer as a result of profiling shall not be processed for the categories of this Regulation. For the purposes of the implementation of this paragraph the burden of proof shall lie with the data user.

Amendment 286 #

Marco ZANNI, Valentino GRANT, Antonio Maria RINALDI

Proposal for a regulation
Article 2 – paragraph 4 a (new)

4 a. Customer data referred to in paragraph 1, do not include: - sensitive data regarding a person's race or ethnicity, political opinions, religious or philosophical beliefs or union memberships, as well as genetic information and information about health and sexual orientation/practices - proprietary data that the financial institution has generated, analysed or enriched, including trade secrets and business-sensitive information.

Amendment 287 #

Proposal for a regulation
Article 2 – paragraph 4 a (new)

4 a. Customer data referred to in paragraph 1, do not include: - sensitive data regarding a person's race or ethnicity, political opinions, religious or philosophical beliefs or union memberships, as well as genetic information and information about health and sexual orientation/practices; - proprietary data that the financial institution has generated, analysed or enriched, including trade secrets and business-sensitive information.

Amendment 288 #

Proposal for a regulation
Article 2 – paragraph 4 a (new)

4 a. With reference to other provisions on data access, responsible data use and permission dashboards and financial data sharing schemes, the European Commission may consider, where appropriate, the development of sector- specific use cases by way of delegated or implementing acts.

Amendment 289 #

Marco ZANNI, Valentino GRANT, Antonio Maria RINALDI

Proposal for a regulation
Article 2 – paragraph 4 a (new)

4 a. This Regulation does not apply to trade secrets, business-sensitive information or proprietary data that the financial institution has generated or enriched.

Amendment 290 #

Proposal for a regulation
Article 2 – paragraph 4 b (new)

4 b. This Regulation shall apply to contracts that have been entered into force from the date of application of the present Regulation onwards.

Amendment 291 #

Proposal for a regulation
Article 2 – paragraph 4 b (new)

4 b. This Regulation shall apply to contracts that have been entered into force from the date of application of the present Regulation onwards.

Amendment 292 #

Proposal for a regulation
Article 2 – paragraph 4 b (new)

4 b. This Regulation applies to data held by retail customers only and does not apply to the sharing of data of commercial customers.

Amendment 293 #

Caroline NAGTEGAAL, Esther DE LANGE, Ondřej KOVAŘÍK

Proposal for a regulation
Article 2 – paragraph 4 b (new)

4 b. The development of new or amended use cases shall take place in line with Article 30 of this Regulation.

Amendment 294 #

Proposal for a regulation
Article 3 – paragraph 1 – point 1

(1) ‘consumer’ means a natural person who is acting for purposes other than his or her trade, business or profession, or a current ‘member’ or ‘beneficiary’ of the institution for occupational retirement provisions (IORP), as defined in Article 6 of the IORP II Directive’;

Amendment 295 #

Proposal for a regulation
Article 3 – paragraph 1 – point 2

(2) ‘customer’ means a natural or a ~~legal person who makes~~small and medium enterprise, as defined in Article 2 of the Annex to Commission Recommendation 2003/361/EC of 6 May 2003, residing or having the registered office in the Union who is a party to an agreement for the use of financial products and services referred to in Article 2(1);

Amendment 296 #

Caroline NAGTEGAAL, Esther DE LANGE

Proposal for a regulation
Article 3 – paragraph 1 – point 2

(2) ‘customer’ means a natural or a legal person who makes use of financial products and services and who is the contractual partner of a financial institution (in its role as a data user) and can him- or herself choose the product and its provider;

Amendment 297 #

Proposal for a regulation
Article 3 – paragraph 1 – point 2

(2) ‘customer’ means a natural ~~or a legal person who makes use of financial products and services~~person living in the European Union or a legal person that is established in the European Union and who is a consumer or a micro, small or medium enterprise;

Amendment 298 #

Marco ZANNI, Valentino GRANT, Antonio Maria RINALDI

Proposal for a regulation
Article 3 – paragraph 1 – point 2

(2) ‘customer’ means a natural ~~or a legal person who makes~~person or a micro, small, or medium enterprise that is party to an agreement for the use of financial products and services;

Amendment 299 #

Proposal for a regulation
Article 3 – paragraph 1 – point 2

(2) ‘customer’ means a natural ~~or a legal~~ person who makes use of financial products and services or purchases insurance products;

Amendment 300 #

Proposal for a regulation
Article 3 – paragraph 1 – point 2

(2) ‘customer’ means a natural ~~or a legal~~ person who makes use of financial products and services or purchases insurance products;

Amendment 301 #