Do GDPR and PSD2 contradict each other?
To comply to both regulations and satisfy their customers, companies need a granular view of their customer data and use this data according to their customers’ needs.
Since GDPR came into force, businesses are still making mistakes and learning to navigate the EU regulatory waters. PSD2 asks banks to openly share consumer data with their consent, while GDPR requires that consumer data remains private and secure. How can businesses possibly juggle the two seemingly contradictory regulations?
Ultimately, this remains a data issue and relates to how well companies can visualise and use their data. To comply to both regulations and satisfy their customers, companies need a granular view of their customer data and use this data according to their customers’ needs. However, how can businesses accomplish that without a complete IT overhaul with potentially disastrous results?
Not as easy as it seems for Financial Services organisations
Financial Services organisations will need to be able to easily access, share and protect data - a challenge indeed! FinTech competition will not miss the opportunity the new regulations present to punish the old guard and poach the customers from the unprepared organisations.
Sharing customer data with third parties, as directed by PSD2, is a great idea but difficult to carry out for banks. Banks are challenged by legacy systems, operating in silos and current IT practices, which do not facilitate data management. EU GDPR only adds further complexity to data management processes because banks have to know the source of every single bit of data they hold in their systems.
In addition, the right to erasure (article 17 of GDPR) means enterprises are required to have a good handle on customer data in order to be able to delete specific information on request. The right to data portability (article 20 of GDPR) presents the challenge for businesses to move, copy or transfer data easily from one database, storage or IT environment to another.
All Financial Services organisations will need to be able to access and analyse the data of any transaction at any time. As part of regulatory audits, banks will need to be able to summon up specific customer data very quickly and they will have to understand what that data means in the broader context of their payment history.
Data protection and privacy will be particularly difficult for unprepared companies ahead of GDPR. At worse, it could mean an overhaul of the entire IT system. Businesses will have to detect and report data breaches within 72 hours once the breach is found to avoid being fined. This could mean working on weekends for some banks if they detect the breach on a Friday.
These challenges will require some help from technology. Banks and other Financial Services organisations will have to demonstrate true digitalisation. These organisations need to provide context-specific offers to the customer, which is helped further by Open Banking, as they will be able to track data from other banks catering to the customer.
However, this type of opportunity will only be seized by organisations capable of customer-centricity and building their own marketplace economy.
Looking beyond rules towards customer-centricity
Should they want to thrive, banks cannot have a narrow view and see regulations as checkpoints to be ticked off in order to be compliant, neglecting the wider picture.
GDPR and PSD2 do not contradict themselves; they both have the exact same objective. Both regulations want to push organisations towards customer-centricity in order for business to adapt to faster to the digital age and the rise of the platform economy. In the post-GDPR era, efficient data management will be critical in order to provide services as close as possible to their customers’ need.
This requires a system or platform flexible enough to dissect very specific data that is within the scope of client consent, while restricting conditional elements from being shared. This granular level of data management would truly push them toward customer-centricity.
This is crucial, as going beyond simple compliance and handling customer data with efficiency and transparency will go a long way to rebuild customer trust. The benefits of GDPR can be seized when financial organisations can convince not only regulators, but also customers, that their data is in a safe pair of hands. A greater understanding of who the customer is, what the product is and the price point will require better management of tangible and intangible data in order to better meet expectations in a post-GDPR world.
Reviewing data management processes to make them more efficient can directly lead to enhanced customer loyalty, which will come about by creating better deals for customers through the use of all the data held by a bank. This data can help create unique revenue models and pricing solutions adapted to the customer’s needs and spending patterns. These value-added services are sure to generate increased customer satisfaction.
Concerning the data security element of GDPR, organisations need to go beyond simply applying a turnkey cyber security solution. Businesses will need to keep internal records of data protection and show regulators and customers alike what has been done to keep their data safe. An audit log of public, private and personal APIs being accessed will need to be kept in order to keep track of any access to customer data.
The multiplication of RegTech solutions might seem like good news for businesses looking to avoid fines and immediate consequences of non-compliance. However, it often presents a short-term solution to a long-term, more nuanced problem. Banks need to manage their data in a way that puts customers at the centre.
Being customer centric enables these organisations to reap the benefits this year’s new regulations entail.
The benefits of being customer-centricity:
-
Reputational benefits: it will ensure customers their data is well-protected and showing transparency when dealing with customer data will increase trust. Avoiding brand image disasters like Equifax and becoming an example of a company making an effort and caring about the duties that comes with the custody of data could lead to immense reputational benefits.
-
Financial benefits: being customer-centric will improve customer retention and attract new customers. Knowing and tending to the needs of your customers will increase trust and customer satisfaction: while competitors are poorly managing their data and offering customers irrelevant offers, having the reputation of being an efficient, insightful business can bring immediate financial benefits.
-
Preparation for an increasingly customer-centric economy: digital transformation is leading businesses toward an increasingly customer-centric economy. GDPR is an attempt to regulate this wave of change and make sure some businesses are not left behind. Preempting the intent of GDPR and being customer-centric ahead of the curve through impeccable data management could give businesses a competitive edge.
While GDPR and PSD2 may seem to be contradictory in their requirements, they are in fact complementary, as both regulations guide high street banks, new banks and Financial Services organisations alike toward a much needed acceleration of their digital transformation process by placing the customer in the centre.
Source: itproportal
Latest Jobs
-
- VOIP / SIP App Developer. Contract. SIP | VOIP experience needed. SC Cleared Outside IR35 Contract. London
- London
- OUTSIDE IR35
-
SIP | VOIP Developer. SC Cleared Contract. London Looking for a SC Cleared SIP / VOIP Developer to develop an application that interacts with a set of voice and video signalling API’s You will also work on developing in-house applications, browser plugins and automated tooling to support secure communication systems. Responsibilities Develop an application that will manage number mapping and associated identities using commercial SBC API’s. Develop new user-facing features using React.js or other modern JavaScript frameworks. Build reusable components and front-end libraries for future use. Collaborate with the design team to translate UI/UX design wireframes into code. Work closely with backend developers to integrate front-end code with server-side logic. Conduct code reviews and provide constructive feedback to team members. Stay up-to-date on emerging technologies and industry trends to continuously improve our front-end development practices. Troubleshoot and debug issues that arise during development and in production environments. Maintain high coding standards and practices and ensure code is well-documented. Requirement Experience of developing specialist applications using REST API’s. Good knowledge of Go, Java and Python (open to alternative combinations of languages). Proficiency in front-end languages and frameworks such as HTML, CSS, JavaScript, React.js, etc. Strong understanding of web standards, responsive design, and cross-browser compatibility. Experience with version control systems such as Git. Knowledge of RESTful APIs and asynchronous request handling. Familiarity with UI/UX design principles and tools.
-
- Senior Data Privacy Consultant. Client Facing | London
- London
- N/A
-
Senior Data Privacy Consultant. Client Facing | London Senior Data Privacy Consultant needed for a key client facing opportunity. Must be willing to undergo SC Security Clearance. Hybrid role- onsite with customer / office 2-3 days a week. London Key Responsibilities: Lead and support client facing data privacy projects. Assess compliance, define and deliver strategic projects / implement privacy solutions. Manage project teams and develop business opportunities. Required Experience: Experience in data protection and privacy standards. Background in consulting. Skills and Qualifications: Business consulting experience IAPP Privacy Manager / Privacy Technologist Location Greater London UK based role. Not able to provide VISA sponsorship.
-
- Security Analyst - Internal role. London commutable. Permanent
- London
- N/A
-
Security Analyst - Internal role. London commutable opportunity. Operational Security - Investigate, escalate and proactively work to ensure household name remains protected. Project Security - Coordinate, log change requests with project delivery teams to meet security requirements Policy / compliance - work with team to aid in uplifting these as and where needed This role is role to investigate, escalate and proactively work to protect a globally recognised brand. You must have current hands on operational analytical security experience with Microsoft technology stack Someone with a SOC Analyst / security engineering background would be well suited. This position will join a small team and would suit someone that has broad experience across the security threat landscape. Experience / knowledge across industry GRC standards such NIST, ISO27001 etc very advantageous and a priority. You will work across multiple teams proactively working to secure the business. Must be able to commute to Central London 3 days a week. Visa sponsorship not available Apply today to find out more.
-
- Network / Security Infrastructure Engineer | West London | Permanent
- London
- N/A
-
Network / Security Infrastructure Engineer | West London | Current Config, Install, upgrade experience On prem / Datacetner experience essential. Hands on experience MUST include: Routing, Switching, Network Security (firewall, IDS etc), Microsoft exchange / Exchange 365. Scripting / automation experience wanted. Python, Powershell etc Regular travel to West London is required. Visa sponsorship not available. Apply today for more information chris.holt@dclsearch.com Use this whatapp link to reach out https://wa.me/message/6USF5RAQBOZIP1