Correlations between the outsourcing activity that can be caried out by credit institutions and the protection of personal data

Abstract

Listen

Translate article

In the operation of credit institutions, the legal institution of outsourcing is becoming increasingly important. In the framework of this, credit institutions perform some of their activities for financial reasons, economies of scale, or for other reasons, such as their need for access to new technologies, not independently within their own organizational framework, but with the assistance of an external service provider.2 In order to comply with prudential requirements, credit institutions shall meet a number of legal and supervisory criteria even if they wish to use the assistance of a third party for any of their activities. However, if the governing regulatory regulations are not in compliance with each other, even just in terms of concepts, it may cause a practical problem for credit institutions, which may unreasonably reduce the efficiency of their activities. Among its interpretative provisions, Act CCXXXVII of 2013 on Credit Institutions and Financial Enterprises (hereinafter referred to as Hpt.) defines the term of outsourcing: ‘outsourcing’ shall mean an arrangement where a financial institution enters into an agreement with a functionally independent service provider, by which that service provider performs continuously or regularly the activities related to its financial services or financial auxiliary services or as prescribed by law, involving the management, processing and storage of data, which would otherwise be undertaken by the financial institution itself.” [Point 58 of Section 6 (1) of Hpt.]. However, in relation to the interpretation of certain factual elements included in the definition of outsourcing, a question may arise as to which legislation is applicable to define the terms „data management, data processing, data storage”? Can data protection laws be used as background legislation for this? If the effective data protection laws are taken into account, does the legislator clearly define the concept of the Credit Institutions Act for practitioners in accordance with such laws, as well? I will examine these questions in more detail below.