Changes from report parliamentary committee draft to plenary report

RemovedConsistent with the EDPS opinion, it is suggested to exclude from the FiDA scope any data that a data holder derived or inferred from data provided by a customer as a result of profiling. Furthermore, it is suggested to explicitly link the data access obligation to those categories of customer data that the data holder collects, stores or processes in connection with the activity for which it is licensed.

Added(a) credit institutions;

RemovedArticle 3 – paragraph 1 – point 4: (4) ‘competent authority’ means the authority designated by each Member State in accordance with Article 17;

Added(b) payment institutions ▌;

RemovedDeletion of part-sentence that is unnecessary in view of Article 17 paragraph 4.

Added(c) electronic money institutions ▌;

RemovedArticle 3 – paragraph 1 – point 5: (5) ‘data holder’ means a financial institution that collects, stores or otherwise processes the data listed in Article 2(1) which relates to a customer in the context of the financial institution’s direct relationship with that customer;

Added(d) investment firms;

RemovedDeletion of part-sentence that is unnecessary in view of the definition of “financial institution” in Article 3 paragraph 8. Furthermore, clarification that a data holder is an entity that collects the data from a customer with whom it has a direct relationship.

Added(e) crypto-asset service providers;

RemovedArticle 3 – paragraph 1 – point 6 a (new): (6a) ‘financial information service‘ means the online service of collecting, consolidating, storing and processing customer data to customers;

Added(f) issuers of asset-referenced tokens;

RemovedIt is suggested to introduce a definition of ‘financial information service’. This helps to align FiDA better with PSD and gives FISPs a similar role to account information service providers. The EDPS also advocates introducing such a definition in its opinion (point 43). The suggested definition links explicitly refers to ‘financial service’, to avoid that customer data under the FiDA framework would be used for purposes that have no connection whatsoever with financial services.

Added(g) managers of alternative investment funds;

RemovedArticle 3 – paragraph 1 – point 6 b (new): (6b) ‘financial service’ means any service of a banking, credit, insurance, personal pension, investment or payment nature;

Added(h) management companies of undertakings for collective investment in transferable securities;

RemovedThis is linked to the suggested introduction of a definition of ‘financial information service’. The definition is taken from Article 2(b) of Directive 2002/65/EC on distance marketing of consumer financial services.

Added(i) insurance ▌ undertakings;

RemovedArticle 3 – paragraph 1 – point 7: (7) ‘financial information service provider’ means an entity providing a financial information service that is authorised under Article 14 to access the customer data listed in Article 2(1) for the provision of financial information services;

Added(j) insurance intermediaries and ancillary insurance intermediaries;

RemovedThis clarification also aims at contributing a level playing field and data access reciprocity.

Added(k) institutions for occupational retirement provision (IORP) that are accessible for all interested consumers, excluding small IORP as referred to in Article 5 of Directive (EU) 2016/2341;

RemovedArticle 3 – paragraph 1 – point 9: deleted

Added▌

RemovedThis definition seems unnecessary, as the term “investment account” is not used anywhere in the Regulation.

Added(m) crowdfunding service providers, which are not consumer lending platforms;

RemovedArticle 3 – paragraph 1 – point 10: (10) ‘non-personal data’ means data other than personal data;

Added(n) PEPP providers;

RemovedTo fully align with definitions as in Data governance act (Regulation (EU) 2022/868) and Data Act (as adopted; publication in OJ forthcoming).

Added(o) financial information service providers;

RemovedArticle 3 – paragraph 1 – point 28 a (new): (28a) ‘crowdfunding service provider’ means a crowdfunding service provider as defined in Article 2(1), point (e), of Regulation (EU) 2020/1503 of the European Parliament and of the Council1a; / 1a Regulation (EU) 2020/1503 of the European Parliament and of the Council of 7 October 2020 on European crowdfunding service providers for business, and amending Regulation (EU) 2017/1129 and Directive (EU) 2019/1937 (OJ L 347, 20.10.2020, p. 1).

Added(oa) operators of payment schemes.

RemovedIt is suggested to include a definition of 'crowdfunding service provider', as such providers are listed in Article 2 (2).

Added3. This Regulation applies to small enterprises as defined in Commission Recommendation 2003/361/EC from ...[12 months from the date of application of this Regulation] and shall not apply to the entities referred to in Article 2(3), points (a) to (e), of Regulation (EU) 2022/2554, the small and non‐interconnected investment firms referred to in Article 12 of Regulation (EU) 2019/2033 of the European Parliament and of the Council, or the entities referred to in Article 2(5), points (4) to (23), of Directive (EU) [2024/...] of the European Parliament and of the Council.

RemovedArticle 3 – paragraph 1 – point 28 b (new): (28b) ‘trade secret’ means trade secret as defined in Article 2, point (1), of Directive (EU) 2016/943;

Added3a. By way of derogation from paragraph 3, this Regulation applies to the entities referred to in Article 2(3), point (e), of Regulation (EU) 2022/2554 if they so wish, provided that they prove their compliance with the relevant provisions of that Regulation.

RemovedIs is suggested to include a definition of 'trade secret', as the term appears in the Regulation. This definition is aligned with the Data Act (as voted, publication in OJ forthcoming.)

Added3b. This Regulation does not apply to special categories of data referred to in Article 9(1) of Regulation (EU) 2016/679 unless the requirements referred to in Article 9(2) of that Regulation are met.

RemovedArticle 3 – paragraph 1 – point 29: deleted

Added4. This Regulation does not affect the application of other Union legal acts regarding access to and re-use of customer data referred to in paragraph 1, unless specifically provided for in this Regulation.

RemovedThis definition is no longer needed if Article 13 is deleted.

Added4a. This Regulation is without prejudice to Union and national law on the protection of personal data, privacy and confidentiality of communications and integrity of terminal equipment, which shall apply to personal data processed in connection with the rights and obligations laid down herein, in particular Directive 2002/58/EC, including the powers and competences of supervisory authorities and the rights of data subjects. Insofar as users are data subjects, the legal obligation laid down in Chapter II of this Regulation is without prejudice to the rights of access by data subjects and rights to data portability under Articles 15 and 20 of Regulation (EU) 2016/679.

RemovedArticle 4 – title: Obligation on a data holder to make data available to the customer

Added4b. This Regulation is without prejudice to accessing and using data on a purely contractual basis without making use of the data access obligations established by this Regulation.

RemovedTo mirror the title of Article 5.

AddedFor the purposes of this Regulation, the following definitions apply:

RemovedArticle 4 – paragraph 1: The data holder shall, upon request from a customer submitted by electronic means, make the readily available data listed in Article 2(1) available to the customer via an online or mobile customer interface in an easily readable format, without undue delay, free of charge, and where relevant and technically feasible, continuously and in real-time.

Added(1) ‘consumer’ means a consumer as defined in Article 2, point (1), of Directive 2011/83/EU of the European Parliament and of the Council;

RemovedIt seems useful to specify explicitly, for the avoidance of any doubt, that data holders shall make available data to the customers via online or mobile interfaces. Furthermore, closer alighment with Data Act (as adopted; publication in OJ forthcoming).

Added(2) ‘customer’ means a natural person resident in the Union or a legal person established in the Union who is a consumer or a micro, small or medium-sized enterprise that is party to or has applied to an agreement for the use of financial products and services;

RemovedArticle 5 – paragraph 1: 1. The data holder shall, upon explicit request from a customer submitted by electronic means, make available to a data user acting on behalf of the customer the customer data listed in Article 2(1) only for the purposes relating to the specific service for which the customer has given explicit permission for the use of their data. The customer data shall be made available to the data user without undue delay, and where relevant and technically feasible, continuously and in real-time.

Added(3) ‘customer data’ means personal and non-personal data in digital form that is collected, stored and managed by a financial institution as part of its normal course of business in connection with a relationship between a customer and the financial institution as the data holder for the provision of such services, which covers both data provided by a customer and transaction data related to a customer held by a financial institution and which excludes data created as a result of profiling as defined in Article 4(4) of Regulation (EU) 2016/679 and trade secrets as defined in Article 2, point (1), of Directive (EU) 2016/943;

RemovedBefore enabling access to their data, customers should give explicit permission for clearly specified purposes.

Added(4) ‘competent authority’ means the authority designated by each Member State in accordance with Article 17 ▌;

RemovedArticle 5 – paragraph 1 a (new): 1a. Any undertaking designated as a gatekeeper, pursuant to Article 3 of Regulation (EU) 2022/1925, shall not be an eligible data user under this Regulation.

Added(5) ‘data holder’ means a financial institution▌ that collects and stores one or more categories of data listed in Article 2(1) ;

RemovedIt is suggested to introduce a provision to prevent gatekeepers under the Digital Markets Act to access data under FiDA. The wording is inspired by Article 5 paragraph 3 of the Data Act (as adopted; publication on OJ forthcoming).

Added(6) ‘data user’ means any of the entities listed in Article 2(2) who, following the permission of a customer, has lawful access to customer data listed in Article 2(1);

RemovedArticle 5 – paragraph 3 – point e: (e) protect the confidentiality of trade secrets and intellectual property rights.

Added(6a) ‘financial information service’ means the online service provided by a data user of collecting and consolidating customer data to customers and does not include the provision of services regulated under existing Union financial services legislation and reserved for financial institutions authorised under Union law;