Financial Privacy & PSD2

The practices of advertising companies such as Google and Facebook often give rise to discussions about data protection and privacy. The operations of secret services and similar organizations such as the Dutch National Coordinator for Counterterrorism and Security (NCTV) equally draw attention and criticism.

There is a growing trend – remaining largely under the radar – towards general financial surveillance, whereby a number of large companies can follow citizens and organizations in detail on the basis of payment data. This is encouraged by public authorities and is spreading throughout society for all sorts of reasons, causing major data protection risks for citizens.

Privacy First would like to pay more attention to what it calls financial privacy in the period ahead.

What is financial privacy? 

Financial privacy relates to the following:

A. Payments

• Detailed personal financial data in the hands of banks and other large parties. Nowadays, payments are made digitally for the most part; cash payments are becoming ever less common. As a result, parties involved in processing payments (banks, payment service providers and account information service providers) have detailed information about all their customers, including consumers, companies and various sorts of organizations. This means that these parties know a great deal about their customers. Financial data are becoming more and more detailed for all kinds of reasons and ever more companies can access these data. iDEAL 2.0, for example, is expected to cause further proliferation of personal financial data. In the past, banks have tried to monetize the financial data of customers, in the way that American advertising companies do, think of the ING affair in the Netherlands. This was stopped at the time, but could come back.
• New PSD2 services. The European Payment Services Directive 2 (PSD2) was intended to allow new services to be developed around the financial data of customers of payment institutions, including account information services. However, insufficient thought has been given to data protection, putting citizens at risk. Privacy First has been working on a campaign called Don’t-PSD2-me for several years now.
• Cash payments are disappearing, and so is this method of last resort to evade being tracked by banks from hour to hour. The European digital currency that is being developed is unlikely to be completely anonymous to enable crime fighting.

B. Privatization of crime fighting and the provision of services to public authorities

• Crime fighting duties of banks and other financial institutions (‘anti-money laundering’). These duties result in the collection of additional personal data of citizens. This concerns not only the identification of natural persons, but also the collection of data on and from natural persons involved in organizations. This may include directors and representatives of legal entities as well as the ultimate stakeholders. Customers often find themselves having to share confidential data with financial institutions in an insecure way. Please note that this is not only about crimes that can harm the customer or the financial institution. Institutions must actively check whether their own customers are holding criminal money and must report any suspicions of crime (‘unusual transactions’) to a section of the Dutch police: the Financial Intelligence Unit (FIU). The EU is currently working on a set of regulations, also known as the Anti-Money Laundering (AML) package, which will radically change the way in which companies combat crime. As a result of new regulations, more and more financial data will be transfered by companies to public authorities.
• Identification through biometrics among other ways. Banks and other financial institutions have to identify their customers, first and foremost to find out (under private law) with whom they are entering into an agreement, and secondly because anti-money laundering rules require it. There is some fuss about identification efforts, partly because banks now want to ‘re-identify’ existing customers, sometimes requiring biometric data in the process.
• UBO Register. Part of the crime-fighting duties of banks and designated enterprises, is that they must identify the ultimate beneficial owners (UBOs) of their customers and verify the accuracy of their customers’ registration with the UBO Register. Privacy First has litigated against the UBO Register and is now awaiting the outcome of similar cases pending before the European Court of Justice.
• Black lists. As part of crime fighting efforts and in order to protect financial interests, blacklists of ‘suspicious’ and convicted customers are created in the financial sector. There are two such lists, known as the internal referral register (Dutch abbreviation: ‘IVR’) and the external referral register (‘EVR’). The rules for these registers are laid out in ‘PIFI’, the Protocol Incident Warning System for Financial Institutions. Insurers have a complete overview of all claims that insurees have submitted to them. Increasingly, other companies with crime-fighting duties also want to create blacklists.
• Provision of data to public authorities (data reporting). Financial institutions, employers and, in the future, platforms too are required to provide data to public authorities. Within the framework of the obligation to provide information, many confidential data are collected from customers. One particular example is the obligation of financial institutions to collect customer data for the purpose of taxation by other countries. In this respect, the Foreign Account Tax Compliance Act (FATCA) is well known. It’s the US law that requires financial institutions around the world to provide free services to the US tax authorities, which relates not only to tax residents of the US and persons with property in or income from the US, but also anyone who has US citizenship (even if these people are without any real ties to the country, so-called ‘accidental Americans’). The Netherlands has entered into a FATCA treaty with the US and also participates in the ‘Common Reporting Standard’ (CRS), that many (EU) countries have implemented.[1]

C. Miscellaneous

• Merchants in financial (personal) data. A number of very large and little-known parties are active on behalf of financial institutions, collecting financial and other data on both consumers and the natural persons involved in various organizations. These data are sold to financial institutions, among others, as credit information and as anti-money laundering information. Although these merchants must comply with the General Data Protection Regulation, they usually don’t, so the people whose data are being sold are not aware of the presence of their data with those merchants, nor can they verify whether the data are accurate and whether they were obtained lawfully. In other words, these people cannot exercise their GDPR rights. According to Privacy First, these merchants should be required to be licensed, just as financial institutions are, with a strong regulator and a strict review of executives.
• The Dutch Credit Registration Office (Bureau Kredietregistratie, BKR). This is a foundation recognized by the government and established by the financial sector to register data for the benefit of that sector.

What will Privacy First be doing?

Financial privacy covers a wide and complex area, which makes it difficult to tackle the issues surrounding this topic. In recent years, Privacy First has been active on the following subtopics:

• PSD2;
• The UBO Register;
• The preservation of cash and anonymous means of payment.

We want to be doing more and get involved in other subtopics as well. Would you like to partipate or do you have any ideas you would like to share with us? This email address is being protected from spambots. You need JavaScript enabled to view it.!

[1] See for example https://ellentimmer.com/2015/12/23/gegevensuitwisseling/ (in Dutch).

As an NGO that promotes civil rights and privacy protection, Privacy First has been concerned with financial privacy for years. Since 2017, we have been keeping close track of the developments surrounding the second European Payment Services Directive (PSD2), pointing out the dangers to the privacy of consumers. In particular, we focus on privacy issues related to ‘account information service providers’ (AISPs) and on the dangerous possibilities offered by PSD2 to process personal data in more extensive ways.

At the end of 2017, we assumed that providing more adequate information and more transparency to consumers would be sufficient to mitigate the risks associated with PSD2. However, these risks turned out to be greater and of a more fundamental nature. We therefore decided to launch a bilingual (Dutch & English) website called PSD2meniet.nl in order to outline both our concerns and our solutions with regard to PSD2.

Central to our project is the Don’t-PSD2-Me-Register, an idea we launched on 7 January 2019 in the Dutch television program Radar and in this press release. The aim of the Don’t-PSD2-Me-Register is to provide a real tool to consumers with which they can filter out and thus protect their personal data. In time, more options to filter out and restrict the use of data should become available. With this project, Privacy First aims to contribute to positive improvements to PSD2 and its implementation.

Protection of special personal data

In this project, which is supported by the SIDN Fund, Privacy First has focused particularly on ‘special personal data’, such as those generated through payments made to trade unions, political parties, religious organizations, LGBT advocacy groups or medical service providers. Payments made to the Dutch Central Judicial Collection Agency equally reveal parts of people’s lives that require extra protection. These special personal data directly touch upon the issue of fundamental human rights. When consumers use AISPs under PSD2, their data can be shared more widely among third parties. PSD2 indirectly allows data that are currently protected, to become widely known, for example by being included in consumer profiles or black lists.

The best form of protection is to prevent special personal data from getting processed in the first place. That is why we have built the Don’t-PSD2-Me-Register, with an Application Programming Interface (API) – essentially a privacy filter – wrapped around it. With this filter, AISPs can detect and filter out account numbers and thus prevent special personal data from being unnecessarily processed or provided to third parties. Moreover, the register informs consumers and gives them a genuine choice as to whether or not they wish to share their data.

What’s next?

We have outlined many of the results we have achieved in a Whitepaper, which has been sent to stakeholders such as the European Commission, the European Data Protection Board (EDPB) and the Dutch Data Protection Authority. And of course, to as many AISPs as possible, because if they decide to adopt the measures we propose, they would be protecting privacy by design. Our Whitepaper contains a number of examples and good practices on how to enhance privacy protection. Among other things, it lays out how to improve the transparency of account information services. We hope that AISPs will take the recommendations in our Whitepaper to heart.

Our Application Programming Interface (API) has already been adopted by a service provider called Gatekeeper for Open Banking. We support this start up’s continued development, and we make suggestions on how the privacy filter can be best incorporated into their design and services. When AISPs use Gatekeeper, consumers get the control over their data that they deserve.

Knowing that the European Commission will not be evaluating PSD2 until 2022, we are glad to have been able to convey our own thoughts through our Whitepaper. Along with the API we have developed and distributed, it is an important tool for any AISP that takes the privacy of its consumers seriously.

Privacy First will continue to monitor all developments related to the second Payment Services Directive. Our website PSD2meniet.nl will remain up and running and will continue to be the must-visit platform for any updates on this topic.

If you want to know how things develop, or in case you have any suggestions, please send an email to Martijn van der Veen: This email address is being protected from spambots. You need JavaScript enabled to view it..

The Dutch Ministry of Finance is about to oblige companies to export personal data on a large scale. The measure is hidden in a subordinate clause of a letter from the Minister of Finance, although it has major consequences. The measure obliges companies that trade in 'virtual assets' (such as bitcoins, real estate, but also purchases in computer games) to include personal data of customers in the transaction records and messages. The information from all parties involved needs to remain visible and available to everyone in the value chain.

Consumers, companies and citizens cannot object to this mandatory addition of their personal data. The topic is not receiving the proper amount of political attention because it is presented as a technical measure. In his letter to Dutch Parliament of 21 March 2019, the Minister fails to point out the large scope and impact. It is, however, suggested that a consultation round will take the market responses to the envisaged rules onboard.

Privacy First and VBNL (United Bitcoin Companies Netherlands) have meanwhile understood that the worldwide objections to the proposed measure are being ignored. That is why they are today sending an urgent letter to the Dutch Minister of Finance. They ask him to study the issue better, with all relevant Ministries and in particular: to better inform Parliament. In doing so, they point to the conflicts of law that may arise as the measure may well violate international agreements and treaties that protect privacy.

Where it is known that consumers are very reluctant to make their own data available to private and commercial institutions, the government must be similarly reluctant on their behalf. Privacy First finds it extremely unfortunate that the Ministry of Finance seems to intend to give this all-in permission for unbridled export of personal data without giving it proper attention and without applying due process.

There is no merit to the claim that the measure is required for counter-terrorism purposes. Experts at Europol (!) indicate that the international proposal is "overkill" and not necessary for investigative purposes. The rule adds nothing to the existing European framework against money laundering and terrorist financing and only increases the risk of unwanted data breaches.

Privacy First and VBNL hope that their letter will make Dutch Parliament aware that this is a proposal that goes far beyond the much-debated access-regime of the recent second European Payment Services Directive (PSD2). With PSD2, consumers can decide to share data themselves. With this proposal, they will become deprived of that fundamental right for all kinds of economic acts. Privacy First and VBNL are calling on parliamentarians to protect consumers and businesses against this unnecessary planned measure.

The letter can be downloaded here (pdf).

PSD2 opt-out register

Is it possible to have innovation in the field of payment data while preserving privacy? Under the new European banking law PSD2, payment data can be shared with non banking parties. The legislator has, however, failed to implement privacy by design. Therefore, the Privacy First Foundation has taken the initiative to launch a PSD2 opt-out register in the Netherlands. We are happy to report that the SIDN Fund is supporting us in this. With this opt-out register bank account numbers can be filtered. This can be useful in case bank account numbers are linked to sensitive personal data, such as a payment to a trade union, a healthcare insurer, a political party or an organization that reveals one’s sexual preference. It can also be useful when consumers wish to filter their contra accounts. The Dutch PSD2 opt-out register could become trendsetting at a European level.

Source: https://www.sidnfonds.nl/nieuws/de-eerste-pioniers-van-2019, 22 May 2019 (in Dutch).

Follow https://psd2meniet.nl for updates and become a member of our PSD2 Privacy Panel! (in Dutch)

For all its projects and affiliated activities, Privacy First is largely dependent on donations. The more financial support and donations we receive, the sooner Privacy First will be able to launch the PSD2 opt-out register.

Writing a New Year’s Column about the state of affairs concerning the protection of everyone’s privacy weighs me down this year. With the exception of a few bright spots, privacy in the Netherlands and the rest of the world has greatly deteriorated. For a while it seemed that the revelations of Edward Snowden in 2013 about secret services tracking everyone’s online behavior would be a rude wake-up call for the world. It was thought that an increasing number of data breaches and a rising number of governments and companies getting hacked, would make people realize that large amounts of data stored centrally is not the solution. The Arab Spring in 2015 would bring about major change through the unprecedented use of (social) media.

The European Union successfully voted against the exchange of data relating to travel movements, paved the way for the current General Data Protection Regulation and seemed to become the shining alternative example under the guidance of Germany, a country known for its vigilance when it comes to privacy. Unfortunately, things turned out differently. Under the Obama administration, Snowden was shunned as a traitor and other whistleblowers were clamped down on harder than ever before. Julian Assange was forced into exile while murdering people with the use of drones and without any form of trial was implemented on a large scale. Extrajudicial killings with collateral damage... While the discussion was about waterboarding... Discussions on such ‘secondary topics’ have by now become commonplace in politics, and so has the framing and blaming of opponents in the polarized public debate (the focus is usually on the person rather than on the argument itself).

Looking back on 2018, Privacy First identifies a great number of areas where the breakdown of privacy is evident:

Government & privacy

In March, an advisory referendum in the Netherlands was held on the introduction of the so-called Tapping law. Immediately after that, the referendum was abrogated. This happened in a time of unprecedented technological possibilities to organize referendums in various ways in a shared democracy. That’s outrageous. The outcome of the referendum was not taken into account and the Tapping law was introduced just like that. Moreover, it turned out that all along, the Dutch Minister of the Interior had withheld an important report on the functioning of the Dutch General Intelligence and Security Service.

Apparently this was nothing to worry about and occurred without any consequences. The recent report by the Dutch State Commission on the (re)introduction of referendums will likely end up in a drawer, not to be looked at again.

Fear of losing one’s role and the political mood of the day are all too important in a culture in which ‘professional politicians’ are afraid to make mistakes, but which is full of incidents nonetheless. One’s job or profession comes first, representing citizens comes second. Invariably, incidents are put under a magnifying glass in order to push through binding legislation with a broad scope. Without the review of compliance with guiding principles such as necessity, purpose limitation, subsidiarity and proportionality. There is an ever wider gap between government and citizens, who are not trusted but are expected to be fully transparent towards that self-same government. A government that time and again appears to be concealing matters from citizens. A government that is required by law to protect and promote privacy, but is itself still the most prominent privacy-violator.

The medical establishment & privacy

In this area things got really out of hand in 2018. Through various coordinated media offensives, the EU and the member states are trying to make us believe in the advantages of relinquishing our right to physical integrity and our humanity. Sharing biometric data with the United States continues unabatedly. We saw the police calling for compulsory DNA databases, compulsory vaccination programs, the use of smart medicines with microchips and the phasing out of alternative therapies. Furthermore, health insurance companies cautiously started to cover genetic testing and increasingly doing away with medical confidentiality, the Organ Donation Act was introduced and microchips implanted in humans (the cyborg as the highest ideal in Silicon Valley propaganda) became ever more popular.

How long before microchips become compulsory for all citizens? All (domestic) animals in the EU have already preceded us. And then there’s the Electronic Health Record, which was first rejected in the Dutch Senate but has reappeared on the minister’s agenda via a detour. Driven by commercial interests, it is being rammed down the throats of general practitioners while alternatives such as Whitebox are not taken seriously. The influence of Big Pharma through lobbying with government bodies and participating in government working groups is particularly acute. They closely cooperate with a few IT companies to realize their ideal of large and centralized networks and systems. It’s their year-end bonus and growth at the expense of our freedom and well-being.

Media & privacy

Naturally, we cannot overlook ‘fake news’. One of the premises for having privacy is being able to form your own opinion and respect and learn from the opinions of others. Furthermore, independent left and right-wing media are essential in a democratic constitutional State. It's their task to monitor the functioning of elected and unelected representatives in politics and in government. Journalists should be able to penetrate into the capillaries of society in order to produce local, national and global news.

Ever since free news gathering came about, it has been a challenge to obtain news based on facts. It’s not always easy to distinguish a press service, PR and propaganda from one another. In times of rapid technological changes and new opportunities, they should be continuously reviewed according to the principles of journalism. That’s nothing new. What is new, however, is that the European Union and our own Minister for the Interior, Kajsa Ollongren, feel they’re doing the right thing by outsourcing censorship to social media companies that are active on a global scale and have proven to be unreliable.

While Facebook and Google have to defend themselves in court for spreading fake news and censoring accounts, the governments hand over the monitoring task to them. The privacy violators and fake news distributors as the guardians of our privacy and journalism. That’s the world upside down. By so doing, this minister and this government undermine the constitutional State and show disdain for intelligent citizens. It’s time for a structural change in our media system, based on new technologies such as blockchain and the founding of a government media office whose task is to fund all media outlets through citizens’ contributions, taking into account the media’s scope and number of members. So that concerns all media, including the so-called alternative media, which should not be censored.

Finance & privacy

The erosion of one’s privacy increasingly manifests itself at a financial level too. The fact of the matter is, that the tax authorities already know in detail what the spending pattern of all companies and citizens looks like. Thanks to the Tapping Law, they can now pass on this information in real-time to the secret services (the General Intelligence and Security Service is watching along). Furthermore, a well-intended initiative such as PSD2 is being introduced in a wholly improvident and privacy-unfriendly way: basic conditions relating to the ownership of bank details (of citizens, account holders) are devoid of substance. Simple features such as selective sharing of banking details, for example according to the type of payment or time period, are not available. What’s more, payment details of third parties who have not given their consent, are sent along.

In the meantime, the ‘cash = criminal’ campaign goes on relentlessly. The right to cash and anonymous payment disappears, despite even the Dutch Central Bank now warning that the role of cash is crucial to our society. Privacy First has raised its opinion on this topic already in 2016 during a public debate. The latest development in this regard is the further linking of information through Big Data and profiling by debt-collecting agencies and public authorities. Excluding citizens from the electronic monetary system as a new form of punishment instead of letting them pay fines is a not so distant prospect. In this regard, a lot of experimentation is going on in China and there have been calls in Europe to move in the same direction, supposedly in order to fight terrorism. In other words, in the future it will become increasingly difficult to raise your voice and organize against abuse of power by governments and companies: from on high it takes only the press of a button and you may no longer be able to withdraw cash, travel or carry out online activities. In which case you have become an electronic outcast, banished from society.

Public domain & privacy

In 2018, privacy in public space has all but improved. Whereas 20 years ago, the Netherlands was deemed too small to require everyone out on the streets to be able to identify themselves, by now, all governments and municipalities in Europe are developing ‘smart city’ concepts. If you ask what the benefits and use of a smart city are (beyond the permanent supervision of citizens), proponents will say something vague about traffic problems and that the 'killer applications' will become visible only once the network of beacons is in place. In other words, there are absolutely no solid figures which would justify the necessity, subsidiarity and proportionality of smart cities. And that’s not even taking basic civil rights such as privacy into consideration.

Just to give a few examples:

• ANPR legislation applies from 1 January 2019 (all travel movements on public roads will be stored in a centralized police database for four weeks)
• A database consisting of all travel movements and stays of European citizens and toll rates as per 2023
• Emergency chips in every vehicle with a two-way communication feature (better known as spyware) as per 1 January 2019
• Cameras and two-way communication in public space, built into the lampposts among other objects as part of smart city projects
• A decision to introduce additional cameras in public transport as per 2019
• The introduction of Smart Cities and the introduction of unlimited beacons (doesn’t it sound so much better than electronic concentration camp posts?)
• Linking together all traffic centers and control rooms (including those of security companies operating on the private market)
• Citizens are permanently monitored by invisible and unknown eyes.

Private domain & privacy

It’s well known that governments and companies are keen to take a peek in our homes, but the extent to which this was being advanced last year, was outside of all proportion. Let’s start with energy companies, who foist compulsory smart meters on citizens. By way of ‘appointment to install a smart meter’, which you didn’t ask for, it’s almost impossible to stay clear of red tape. After several cancellations on my part and phone calls to energy provider Nuon, they simply continued to push forward. I still don’t have a smart meter and it will stay like that.

Once again Silicon Valley featured prominently in the news in 2018. Unelected dictatorial executives who are no less powerful than many a nation state, promote their utopias as trendy and modern among citizens. Self-driving cars take the autonomy and joy away from citizens (the number of accidents is very small considering the millions of cars on the road each day), while even children can tell that a hybrid approach is the only option. The implementation of smart speakers by these social media companies is downright spooky. By bringing smart toys onto the market, toy manufacturers equally respond to the needs that we all seem to have. We can all too readily guess what these developments will mean for our privacy. The manipulation of facts and images as well as distortion, will starkly increase.

Children & privacy

Children and youths represent the future and nothing of the above bodes well for them. Screen addiction is sharply on the rise and as children are being raised amidst propaganda and fake news, much more attention should go out to forming one’s own opinion and taking responsibility. Centralized pupil monitoring systems are introduced indifferently in the education system, information is exchanged with parents and not having interactive whiteboards and Ipads in the classroom has become unthinkable. The first thing children see every single day, is a screen with Google on it... Big Brother.

Dependence on the internet and social media results in impulsive behaviour among children, exposes them to the madness of the day and affects their historical awareness and ability to discern underlying links. The way of thinking at universities is becoming increasingly one-sided and undesirable views are marginalized. The causes of problems are not examined, books are not read though there is certainly no lack of opinions. It’s all about making your voice heard within the limits of self-censorship that’s in force in order to prevent becoming the odd one out in the group. The same pattern can be identified when it comes to forming opinions in politics, where discussing various issues based on facts seems no longer possible. Not to mention that the opinions of citizens are considered irrelevant by our politicians. Good quality education focused on forming opinions and on creating self-reflective minds instead of a robot-way of thinking, is essential for the development of a healthy democracy.

Are there any positive developments?

It's no easy task to identify any positive developments in the field of privacy. The fact is that the introduction of the GDPR and the corresponding option to impose fines has brought privacy more sharply into focus among companies and citizens than the revelations of Snowden have been able to do. The danger of the GDPR, however, is that it narrows down privacy to data protection and administrative red tape.

Another positive development is the growing number of (as of yet small) initiatives whereby companies and governments consider privacy protection as a business or PR opportunity. This is proved by the number of participants in the 2019 Dutch Privacy Awards. Recurring themes are means of anonymous communication (email, search engines, browsers), possible alternatives to social networks (messaging services like WhatsApp, Facebook, Instagram and Twitter) on the basis of subscriptions, blockchain technology and privacy by design projects by large organizations and companies.

Privacy First has teamed up with a few top quality pro bono attorneys who are prepared to represent us in court. However, judges are reluctant to go off the beaten track and come up with progressive rulings in cases such as those concerning number plate parking, average speed checks, Automatic Number Plate Recognition, the Tapping Law, etc. For years, Privacy First has been suffering from a lack of funding. Many of those who sympathize with us, find the topic of privacy a bit eerie. They support us morally but don’t dare to make a donation. After all, you draw attention to yourself when you’re concerned with issues such as privacy. That’s how bad things have become; fear and self-censorship... two bad counsellors! It’s high time for a government that seriously deals with privacy issues.

Constitutional reform should urgently be placed on the agenda

Privacy First is a great proponent of constitutional reform (see our 2017 New Year’s column about Shared Democracy), based on the principles of the democratic constitutional State and the European Convention on Human Rights (ECHR). Our democracy is only 150 years old and should be adapted to this current day and age. This means that the structure of the EU should be changed. Citizens should take on a central and active role. Government policies should focus on technological developments in order to reinforce democracy and formulate a response to the concentration of power of multinational companies.

Privacy First argues that the establishment of a Ministry of Technology has the highest priority in order to be able to stay up to date with the rapid developments in this field and produce adequate policies accordingly. It should live up to the standards of the ECHR and the Dutch Constitution and avoid becoming a victim of the increasing lobbying efforts in this sector. Moreover, it is time for a Minister of IT & Privacy who stays up to date on all developments and acts with sufficient powers and in accordance with the review of a Constitutional Court.

The protection of citizens’ privacy should be facilitated and there should be privacy-friendly alternatives for current services by technology companies. For 2019, Privacy First has a few tips for ordinary citizens:

• Watch out for and stay away from ‘smart’ initiatives on the basis of Big Data and profiling!
• Keep an eye on the ‘cash = criminal’ campaign. Make at least 50% of your payments anonymously in cash.
• Be cautious when communicating through Google, Apple, Facebook and Microsoft. Look for or develop new platforms based on Quantum AI encryption and use alternative browsers (TOR), networks (VPN) and search engines (Startpage).
• Be careful when it comes to medical data and physical integrity. Use your right for there to be no exchange of medical data as long as initiatives such as Whitebox are not used.
• Be aware of your right to stay anonymous, at home and in public space. Campaign against toll payment, microchips in number plates, ANPR and number plate parking.
• Be aware of your legal rights to bring lawsuits, for example against personalized waste disposal passes, camera surveillance, etc.
• Watch out for ‘smart’ meters, speakers, toys and other objects in the house connected to the internet. Purchase only privacy by design solutions with privacy enhanced technology!

The Netherlands and Europe as guiding nations in the field of privacy, with groundbreaking initiatives and solutions for apparent contradictions concerning privacy and security issues - that’s Privacy First's aim. There’s still a long way to go, however, and we’re being blown off course ever more. That’s due in part because a comprehensive vision on our society and a democracy 3.0 is lacking. So we continue to drift rudderless, ending up in the big manipulation machine of large companies one step at a time. We need many more yellow vests before things change. Privacy First would like to contribute to shaping and promoting a comprehensive, positive vision for the future. A future based on the principles that our society was built on and the need for greater freedom, with all the inevitable restrictions this entails. We will have to do it together. Please support Privacy First actively with a generous donation for your own freedom and that of your children in 2019!

To an open and free society! I wish everyone a lot of privacy in 2019 and beyond!

Bas Filippini, Privacy First chairman

New European PSD2 legislation in force

At the start of 2019, the Payment Service Directive 2 will enter into force in the Netherlands. Under this new European banking law, consumers can share their banking details with parties other than their own bank. This first requires their explicit consent, upon which banks must share all transactional data[1] of the consumer (account holder) with an external party (financial service provider) for a period of 90 days, after which the consumer can renew his consent. The consumer can also withdraw his consent at all times.

PSD2 is a great concern to Privacy First

Privacy First is very worried about PSD2. The law focuses too much on improving competition and innovation while the privacy interest of account holders is overlooked. These are Privacy First’s greatest concerns:

• Consumers are not in a position to limit the amount of banking details. Even in case a financial service provider does not need these details, all data are shared just the same once the account holder has issued his consent.
• The bank details of a consumer include the details of contra accounts. Holders of such accounts are unaware of the fact that their details may be shared and are not in a position to prevent that. As transactional data will be analyzed much more widely with the use of Big Data and data analyses than before the introduction of PSD2, there will be a much greater risk of privacy violations.
• Banking details contain ‘sensitive personal data’ that may only be issued under strict conditions.[2] A subscription payment to a trade union, political party or organization that reveals one’s sexual preferences, should be considered sensitive personal data according to Privacy First. The same applies to transactions with health insurance companies and pharmacists. Currently, there is no way to filter out these data and they are being issued to parties that are not allowed to process them.

During an episode of the Dutch television program Radar that was broadcast on Monday 7 January 2019, Privacy First drew particular attention to these issues.

PSD2 quality label aims for transparency

Privacy First wants consumers to get honest and transparent information on what happens to their data. We advocate not for lengthy privacy statements, but rather for information that fits on a single sheet of paper. This information should not come from the financial industry, but from consumers themselves. After all, they can best decide which information they find valuable when making a choice. During 2018, Privacy First worked on this initiative along with the Volksbank and other partners from the financial sector.

PSD2 opt-out register

Privacy First is surprised that no attention has been paid to the role of ‘sensitive personal details’ in transactional data. Such details may only be shared under strict conditions and therefore have to be filtered out. Equally, consumers who do not want others to share their data with financial service providers should have the opportunity to prevent this. That is why Privacy First would like to see an opt-out register, similar to the do-not-call-me register which has been around in the Netherlands for many years. During the Radar broadcast, Privacy First announced it would bring forward this proposal, hoping to be able to develop it further together with the financial sector and policy makers. The aim is to have a compulsory opt-out register. This will, however, require amending the European PSD2 directive.

[1] Additional information: it concerns all transactional data. The extent to which these data go back in time varies per bank. See the overview (in Dutch) of the Dutch consumer association: The majority of account holders saves their bank statements for at least five years https://www.consumentenbond.nl/betaalrekening/meerderheid-bewaart-rekeningafschriften-ten-minste-5-jaar.
[2] Additional information: this is included in Article 9 of the GDPR and in Article 22 of the Dutch GDPR implementation Act. In short, processing sensitive personal data is unlawful, with a few exceptions. See (in Dutch) https://wetten.overheid.nl/BWBR0040940/2018-05-25.

During a Dutch press meeting about the new Payment Service Directive 2 (PSD2), an initiative to launch a privacy quality label for payment services was announced. This quality label should encourage financial service providers and fintech companies to focus on the privacy of consumers.

Volksbank

If you struggle to make ends meet, sooner or later you will get physical complaints, two Utrecht physicians wrote in Dutch newspaper AD/Utrechts Nieuwsblad of 7 March 2018. Those who want to lead a healthy life, will first have to make sure they’re in a healthy financial position. Being in control of your own finances and all related data is a part of that. De Volksbank offers a helping hand in both these areas.

The new European Payment Service Directive 2 (PSD2) paves the way for payment apps of new parties. Banks no longer have the exclusive right to offer payment services. This appears to be good news for consumers. But there is a downside too. Customers who share their data with any such new service provider, should take into account that part of those data are privacy-sensitive. A bank cannot recover such data once in the hands of other financial service providers, so the consumer cannot resort to anyone but himself if he regrets his decisions.

The Dutch Consumers' Association (Consumentenbond) has recently warned that personal data are already being collected on a large scale for commercial reasons. With the introduction of PSD2, this will only increase. Ninety days of access to personal information is sufficient for service providers to create digital profiles that can be traded. De Volksbank does not want to create profiles and is of the opinion that client information should be secure in the hands of the bank: ‘‘That means that we don’t sell information of clients, neither on an individual nor on an aggregated level. We earn our money as a bank, not by selling the data of our clients.'’

De Volksbank considers it to be its role of helping clients deal with their data in a secure and deliberate way in an environment that has changed. By providing information (free is never really free), but also by encouraging clients to take additional measures:

• When it comes to taking deliberate decisions on sharing data, clients should increase their self-awareness by operating a Main Switch. The default setting of the Main Switch should be ‘off’. Before a client is able to authorize the bank to share his data with third parties, he should first flick the Main Switch. The client should then authorize the sharing of data for each party. In so doing, he can stop sharing his data with any party at any moment. Alternatively, he can flick the Main Switch, blocking the access to his data of all parties in a single instant.
• In cooperation with De Volksbank, several other banks, KPMG and fintech companies, Privacy First is developing a PSD2 quality label. This should answer the call of the Central Bank of the Netherlands (DNB), which ascertained that as of yet there is no such quality label, while there is the need to have one. As far as we know, the Netherlands is the first country to be working on this issue. Thanks to the PSD2 quality label, consumers should at once be able to tell which parties they can or cannot entrust their data to. De Volksbank is working hard on further developing the quality label in order for it to be ready as soon as the Payment Service Directive 2 has been transposed into Dutch legislation.

Privacy First

The Privacy First Foundation supports the PSD2 privacy quality label. Privacy First would like it to become an international label which is recognized and supported by banks, fintech companies, financial service providers, regulators and consumer organizations.

PSD2 offers advantages, but also puts people’s privacy at risk. People are more than just consumers. Privacy First doubts whether the measures laid down in PSD2 to protect the data and therewith the privacy of people, will be sufficient. For the protection of personal data, PSD2 relies heavily on the new General Data Protection Regulation (GDPR). This regulation has not yet come into force and we don’t know which effects PSD2 will have in practice and what the monitoring of it will look like. Many organizations are not yet ready to comply with all of the GDPR requirements. However, they will not hold off providing their services. In turn, regulators are not yet ready to enforce all aspects of the GDPR. Introducing PSD2 is like going out to fly without checking the parachute.

We hope that the quality label will encourage financial service providers and fintech companies to start considering consumers as human beings. We want the requirements of the label to be set higher each year. We also want service providers to consider the ‘information behind the information’:

• The disclosure of behavior and data by others
• Services with the underlying aim of collecting data (improper application)
• Deducting data, such as transaction data from which sensitive personal data can be deduced.

We call on fintech companies to continue to explore ways to limit the amounts of data they collect and store. Think of excluding transaction data that could indicate religion, political preference or health status. Limiting the retention period of transaction data is another measure to take into consideration.

This article has also been published on privacy-web.nl.