Data Access and Automated Decision-Making  in European Financial Law

PFLÜCKE, Felix

doi:10.1017/err.2024.60

Download

Article (Scientific journals)

Data Access and Automated Decision-Making in European Financial Law

PFLÜCKE, Felix

2025 • In European Journal of Risk Regulation, 16 (1)

Peer Reviewed verified by ORBi

Permalink
https://hdl.handle.net/10993/62076

DOI
10.1017/err.2024.60

Files (1)Send to Details Statistics Bibliography Similar publications

Files

Full Text

Pfluecke Data Access and Automated Decision-Making.pdf

Author preprint (261.06 kB)

Download

All documents in ORBilu are protected by a user license.

Send to

RIS BibTex APA Chicago Permalink X Linkedin

Details

Keywords :

Financial Data Access Regulation; Automated Decision-Making; Financial Services; Open Finance; Cross-Border Data Access

Abstract :

[en] This article examines the regulatory landscape of financial data access within the European Union, emphasising the implications and effectiveness of recent legislative initiatives. It provides an in-depth analysis of the Financial Data Access Regulation (FIDA) proposal and its relationship with existing laws, focusing on the possibilities for data access and utilisation in the context of Open Finance. The discussion evaluates the regulatory framework for automated decision-making (ADM) in European financial law, highlighting its strengths and identifying areas for improvement. By exploring the intersections of tech resilience, financial regulation, and data protection, the article aims to clarify the practical implications of current and proposed rules, emphasising effective practices and areas needing further legislative attention.

Research center :

NCER-FT - FinTech National Centre of Excellence in Research

Disciplines :

Economic & commercial law

Author, co-author :

PFLÜCKE, Felix ; University of Luxembourg > Faculty of Law, Economics and Finance (FDEF) > Department of Law (DL)

External co-authors :

Language :

English

Title :

Data Access and Automated Decision-Making in European Financial Law

Publication date :

March 2025

Journal title :

European Journal of Risk Regulation

ISSN :

1867-299X

Publisher :

Cambridge University Press, United Kingdom

Volume :

Issue :

Peer reviewed :

Peer Reviewed verified by ORBi

Focus Area :

Law / European Law

Development Goals :

8. Decent work and economic growth

FnR Project :

NCER22/IS/16570468/NCER-FT

Available on ORBilu :

since 20 September 2024

Statistics

Number of views

208 (5 by Unilu)

Number of downloads

50 (1 by Unilu)

More statistics

Scopus citations^®

Scopus citations^®
without self-citations

OpenCitations

OpenAlex citations

Bibliography

1 See, for example, Ross P. Buckley, Douglas W. Arner, and Dirk A. Zetzsche, FinTech: Finance, Technology and Regulation (Cambridge University Press 2024) Part I;
Dirk Zetzsche, Douglas Arner, Ross Buckley, and Rolf H. Weber, “The Evolution and Future of Data-Driven Finance in the EU” (2020) 57(2) Common Market Law Review 331–336.
2 Proposal for a Regulation of 26 June 2023 on a framework for Financial Data Access and amending Regulations (EU) No 1093/2010, (EU) No 1094/2010, (EU) No 1095/2010 and (EU) 2022/2554 COM (2023) 360 final (FIDA proposal).
3 See, for example, Božina Beroš, and Marta Gabriella Gimigliano (eds), The Payment Services Directive II: A Commentary (Edward Elgar 2021) ch 1.
4 Directive (EU) 2015/2366 of 25 November 2015 on payment services in the internal market, amending Directives 2002/65/EC, 2009/110/EC and 2013/36/EU and Regulation (EU) No 1093/2010, and repealing Directive 2007/64/EC OJ L 337/35 (PSD2).
5 Proposal for a Directive of 28 June 2023 on payment services and electronic money services in the Internal Market amending Directive 98/26/EC and repealing Directives 2015/2366/EU and 2009/110/EC COM(2023) 366 final (PSD3).
6 Proposal for a Regulation of 28 June 2023 on payment services in the internal market and amending Regulation (EU) No 1093/2010 COM(2023) 367 final (PSR).
7 European Commission, “Digital Finance Strategy for the EU” COM(2020) 591 final Section 4.3.
8 Regulation (EU) No 1093/2010 of 24 November 2010 establishing a European Supervisory Authority (European Banking Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/78/EC OJ L 331/ 12.
9 Regulation (EU) No 1094/2010 of 24 November 2010 establishing a European Supervisory Authority (European Insurance and Occupational Pensions Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/79/EC OJ L 331/48.
10 Regulation (EU) No 1095/2010 of 24 November 2010 establishing a European Supervisory Authority (European Securities and Markets Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/77/EC OJ L 331/84.
11 Regulation (EU) 2022/2554 of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/ 1011 OJ L 333/1. Art 2(1) lists all entities covered by the DORA Regulation; Art 2(3) and (4) provides a number of exceptions. The Regulation deals with ICT risk management (Chapter II), ICT-related incident management, classification and reporting (Chapter III), digital operational resilience testing (Chapter IV), managing of ICT third-party risk (Chapter V), and information-sharing arrangements (Chapter VI). For a detailed analysis,
see, eg, Jannik Woxholth and Dirk A. Zetzsche, “DORA on DEFI” (SSRN, 23 June 2024) https://doi.org/10.2139/ssrn. 4874057.
12 Art 2 of the FIDA Proposal 2023.
13 Title II of the FIDA Proposal 2023.
14 Title III of the FIDA Proposal 2023.
15 Title V of the FIDA Proposal 2023.
16 Art 67 of PSD2. Buckley, Arner, and Zetzsche (n 1, CUP) 34–35.
17 Title VIII of the FIDA Proposal 2023.
18 European Commission, “Communication on a Digital Finance Strategy for the EU” COM(2020) 591 final.
19 European Commission, “A European Strategy for Data” COM(2020) 66 final.
20 Regulation (EU) 2022/868 of 30 May 2022 on European data governance and amending Regulation (EU) 2018/ 1724 (Data Governance Act) OJ L152/1.
21 Regulation (EU) 2022/1925 of 14 September 2022 on contestable and fair markets in the digital sector and amending Directives (EU) 2019/1937 and (EU) 2020/1828 (Digital Markets Act) OJ L265/1.
22 Regulation (EU) 2023/2854 of the European Parliament and of the Council of 13 December 2023 on harmonised rules on fair access to and use of data and amending Regulation (EU) 2017/2394 and Directive (EU) 2020/1828 (Data Act) OJ L71/1.
23 European Commission, “Modernising payment services and opening financial services data: new opportunities for consumers and businesses” (European Commission, 28 June 2023) accessed 10 December 2023.
25 Section 1 (“Reasons for and objectives of the proposal”) of the FIDA Proposal 2023.
28 EUR-Lex, “Procedure 2023/0205/COD” (EUR-Lex, 2024) accessed 10 December 2023.
29 Art 1 and Art 3(2) of the FIDA Proposal 2023.
30 Art 2(1)(a) of the FIDA Proposal 2023.
31 Art 2(1)(e) of the FIDA Proposal 2023.
32 Art 2(2)(a) of the FIDA Proposal 2023.
33 Art 2(2)(e) of the FIDA Proposal 2023. However, limits are provided in Arts 2(3) and (4).
34 Art 4 of the FIDA Proposal 2023.
36 Art 5(1) of the FIDA Proposal 2023.
37 Art 5(2) of the FIDA Proposal 2023.
38 Art 5(3)(a) of the FIDA Proposal 2023.
39 Art 5(3)(b) of the FIDA Proposal 2023.
40 Art 5(3)(c) of the FIDA Proposal 2023.
41 Art 5(3)(d) of the FIDA Proposal 2023.
42 Art 5(3)(e) of the FIDA Proposal 2023.
43 Art 6(1) of the FIDA Proposal 2023.
44 Art 6(2) of the FIDA Proposal 2023.
45 Art 6(3) of the FIDA Proposal 2023.
46 Art 6(4)(a) of the FIDA Proposal 2023.
47 Art 6(4)(c)) of the FIDA Proposal 2023.
48 Art 6(4)(b) of the FIDA Proposal 2023.
49 Art 6(4)(d) of the FIDA Proposal 2023.
50 Art 6(4)(e) of the FIDA Proposal 2023.
51 Art 6(4)(f) of the FIDA Proposal 2023.
52 Art 7 of the FIDA Proposal 2023.
53 Art 8 of the FIDA Proposal 2023.
54 Art 8(2) of the FIDA Proposal 2023.
55 Art 9 of the FIDA Proposal 2023.
56 Art 10(1)(a) of the FIDA Proposal 2023.
57 Art 10(1)(j) of the FIDA Proposal 2023.
58 Art 11 of the FIDA Proposal 2023.
59 Art 14 of the FIDA Proposal 2023.
60 Art 15 of the FIDA Proposal 2023.
61 Art 16 of the FIDA Proposal 2023.
62 Art 28 of the FIDA Proposal 2023.
63 Art 17 of the FIDA Proposal 2023.
64 Art 18 of the FIDA Proposal 2023.
65 Additionally, Art 21 introduces periodic penalty payments, Art 22 outlines circumstances considered for penalties, and Art 23 enforces professional secrecy.
66 Art 24 of the FIDA Proposal 2023. All cases would be published on the website of competent authorities, creating a wealth of case law and guidance (Art 25). In cases of disagreements between competent authorities, Art 27 allows referral to the EBA for resolution.
67 Art 26 of the FIDA Proposal 2023.
68 Art 26(5) of the FIDA Proposal 2023.
69 Dirk A. Zetzsche, Douglas W. Arner, and Ross P. Buckley, “Decentralized Finance” (2020) 6(2) Journal of Financial Regulation 197–198.
Zetzsche, Birdthistle, Arner, and Buckley outline several policy considerations regarding digital finance platforms in their article “Digital Finance Platforms: Toward a New Regulatory Paradigm” (2020) 23(1) University of Pennsylvania Journal of Business Law 325ff. Their considerations range from a hand-off approach to “test and learn” to a more interventionist approach that digital finance platforms could be viewed as public utilities and regulated accordingly, which were partly taken on board by the European Supervisory Authorities.
70 Buckley, Arner, and Zetzsche (n 1, Cambridge University Press) 44–46, 49–50, 145–146.
71 See, eg, Herwig C.H. Hofmann, Dirk A. Zetzsche, and Felix Pflücke, “The Changing Nature of ‘Regulation by Information’: Towards Real-Time Regulation?” (2023) 28(6) European Law Journal 172.
72 Art 15 of Directive (EC) 95/46 of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data OJ L181. Francesca Palmiotto, “When Is a Decision Automated? A Taxonomy for a Fundamental Rights Analysis” (2024) 25(1)
German Law Journal 4. A detailed overview on Article 22 and its exception is provided in Herwig C. H. Hofmann, “Automated Decision-Making (ADM) in EU Public Law” in Hofmann and Pflücke (eds), Governance of Automated Decision-Making and EU Law (Oxford University Press 2024, in print) 28ff.
73 Buckley, Arner, and Zetzsche (n 1, Cambridge University Press) 152–153.
74 Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (GDPR) OJ L119/1.
75 Hofmann in Hofmann and Pflücke (n 72) 28–29. There is also consent and necessity in light of the FIDA proposal (Articles 6(1)(a) and (b) of the GDPR)
76 Liane Huttner, La décision de l’algorithme: Étude de droit privé sur les relations entre l’humain et la machine (Thèse pour l’obtention du titre de Docteur en droit de l’Université Paris 1 Panthéon-Sorbonne, 2022) 31.
77 Recitals 5, 10, 20, 22, 25, 30, 48 and Arts 5, 7(4), 10(1)(i), 12(2) of the FIDA proposal 2023.
78 Case C-634/21 OQ v Land Hessen and SCHUFA Holding AG (as intervener) [2023] para 73.
See, eg, Liane Huttner, ‘Décisions automatisées: le réveil d’un géant endormi ?’ (2024) 2 Revue Communication Commerce électronique 7.
79 Art 25 of the GDPR;
Buckley, Arner, and Zetzsche (n 1, Cambridge University Press) 154.
80 Title 3 of the FIDA Proposal 2023.
81 Art 5 of the GDPR.
82 22(3) of the GDPR.
83 Proposal for a regulation of 21 April 2021 laying down harmonised rules on artificial intelligence (artificial intelligence act) and amending certain union legislative acts COM(2021) 206 final (AI Act). For a detailed analysis of the final AI Act, see the contribution of Oriol Mir in the present special issue.
84 Art 6(2) and Annex III of the AI Act proposal 2021. Palmiotto (n 72) 13.
85 European Data Protection Supervisor, “Tech Dispatch: Explainable Artificial Intelligence” (EDPS, 2023) accessed 20 January 2024.
See, eg, Buckley, Arner, and Zetzsche (n 1, Cambridge University Press) chapter 7.
86 Pages 6 and 13 of the preparatory work of the FIDA proposal 23.
87 Barclays, “Bias in Algorithmic Decision making in Financial Services” (Barclays, 2024) accessed 12 January 2024.
88 Title 1 of the FIDA Proposal 2023.
89 Title 3 of the FIDA Proposal 2023.
90 This issue has been discussed in light of PSD2, see European Data Protection Board, “Guidelines 06/2020 on the interplay of the Second Payment Services Directive and the GDPR: Version 2.0” (EDPB 15 December 2020) section 5.1;
Article 29 Working Party Guidelines on Automated individual decision-making and Profiling for the purposes of Regulation 2016/679, WP251rev.01, 15.
See also Recital 18 of the FIDA proposal 2023.
91 Recital 18 of the FIDA proposal (EDPB) section 6.5;
Recital 18 of the FIDA proposal (WPG) 16-17.
92 For an overview on datafication of finance in the EU, especially data-driven reporting and supervision, Zetzsche, Arner, Buckley, and Weber (n 1, CMLR) 338–339, 356–357.
93 Regulation (EU) 2018/1725 of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC OJ L295/39 (EDPR).
94 See the impact assessment report: European Commission, “Impact Assessment Report Accompanying the document Proposal for a Regulation of the European Parliament and of the Council on a framework for Financial Data Access and amending Regulations (EU) No 1093/2010, (EU) No 1094/2010, (EU) No 1095/2010 and (EU) 2022/ 2554” SWD(2023) 224 final.
95 See the impact assessment report: European Commission, “Impact Assessment Report Accompanying the document Proposal for a Regulation of the European Parliament and of the Council on a framework for Financial Data Access and amending Regulations (EU) No 1093/2010, (EU) No 1094/2010, (EU) No 1095/2010 and (EU) 2022/ 2554” Annex 2(2).
96 See the impact assessment report: European Commission, “Impact Assessment Report Accompanying the document Proposal for a Regulation of the European Parliament and of the Council on a framework for Financial Data Access and amending Regulations (EU) No 1093/2010, (EU) No 1094/2010, (EU) No 1095/2010 and (EU) 2022/ 2554” Annex 2(3).
97 See the impact assessment report: European Commission, “Impact Assessment Report Accompanying the document Proposal for a Regulation of the European Parliament and of the Council on a framework for Financial Data Access and amending Regulations (EU) No 1093/2010, (EU) No 1094/2010, (EU) No 1095/2010 and (EU) 2022/ 2554” Annex 3.
98 European Commission Regulatory Scrutiny Board, “Open Finance Framework: Opinion” SEC(2023) 255 11220/ 23 ADD3.
99 See the previous section of this paper.
100 BEUC, “Access to Consumers’ Financial Data: BEUC position paper on the proposed Financial Data Access Regulation” (BEUC, 31 October 2023) BEUC-X-2023-137, Scope. Potential risks of data control in intragroup dependencies were also highlighted in the joint report by the European Supervisory Authorities and the European Securities and Markets Authority, “Joint-ESA Report on 2023 stocktaking of BigTech direct financial services provision in the EU” (ESA and ESMA, 1 February 2024) accessed 17 June 2024, 11ff.
101 BEUC (n 100) Data paramenters
102 Opinion of the European Economic and Social Committee on (a) Proposal for a Regulation of the European Parliament and of the Council on a framework for Financial Data Access and amending Regulations (EU) No 1093/ 2010, (EU) No 1094/2010, (EU) No 1095/2010 and (EU) 2022/2554 (COM(2023) 360 final – 2023/0205 (COD)) (b) Proposal for a Directive of the European Parliament and of the Council on payment services and electronic money services in the Internal Market amending Directive 98/26/EC and repealing Directives 2015/2366/EU and 2009/ 110/EC (COM(2023) 366 final – 2023/0209 (COD)) and (c) Proposal for a Regulation of the European Parliament and of the Council on payment services in the internal market and amending Regulation (EU) No 1093/2010 (COM(2023) 367 final – 2023/0210 (COD)), OJ C/2024/1594 (hereafter EESC Opinion) para 3.3.5.
103 EESC Opinion (n 102) para 3.3.6.
104 EESC Opinion (n 102) para 3.3.5.
105 EESC Opinion (n 102) para 3.3.8.
106 EESC Opinion (n 102) paras 3.3.10 and 3.3.11.
107 BEUC (n 100) Permission Dashboard and Alignment with EU Data Protection & Consumer Law.
109 European Commission Regulatory Scrutiny Board Opinion (n 98) paras (B) 2 and (C) 3.
110 For a general argument in favour of experience requirements regarding AI in financial law, see Buckley, Arner, and Zetzsche (n 1) 104–105.
111 EESC Opinion (n) para 3.3.6.
112 BEUC (n 100) Data Users.
113 EESC Opinion (n 102) para 3.3.7
114 Recital 30 of the FIDA Proposal 2023.
115 Arts 20–22 of the FIDA Proposal 2023.
116 BEUC (n 100) Enforcement
117 BEUC (n 100) Financial Data Sharing Schemes.
118 European Commission Regulatory Scrutiny Board Opinion (n 98) para (C) 4.
119 Art 36 of the FIDA Proposal 2023.
120 EESC Opinion (n 102) para 3.3.12.
121 Association of the Luxembourg Fund Industry, “ALFI’s response to the EU Commission’s ‘have your say’ on the proposal for a regulation on a framework for Financial Data Access” (Association of the Luxembourg Fund Industry, 27 October 2024) Section VI.
122 See, eg, Zetzsche, Birdthistle, Arner, and Buckley (n 69). Most of the authors of the previous article proposed in 2018 that data delivery should be a regulated activity, noting that only some countries had implemented such regulations: Dirk A. Zetzsche, Ross P. Buckley, Douglas W. Arner, and Janos N. Barberis “From Fintech to Techfin: The Regulatory Challenges of Data-Driven Finance” (2018) New York University Journal of Law and Business https://doi.org/10.2139/ssrn.2959925 26ff.
123 For an examination of the rules and status quo of evidence-based regulation in EU law, see, eg, Felix Pflücke, Compliance with European Consumer Law (Oxford University Press 2024) ch 2.