Integrated purchasing and banking data protection in the context of Directive (EU) 2015/2366: new payment service providers

Abstract

Purpose – The article analyses the limits of protection of bank users´ data in France, framing them as personal data. Its legal analysis is made amidst a context of radical changes in the European and French personal data protection law as well in the banking regulation, which is being transformed by the new payment services regulation.
 Methodology/approach/design – The article brings an interlacement of some new legal sources from the European and French law to appraise the limits of banking data protection. It tests the application of some legal norms in order to evaluate the potential protection in two areas: the security of the banking data on a new environment of payment services (fintechs and other new firms); the possibility of protection against the unauthorized data commercial usage.
 Findings – The article concludes that the European and French banking and payment services law have not the desired level of protection against bad commercial practices in a context, which is marked by both the retailers and payment services integration as well the presence of the big techs. The data protection law must complement the banking and payment services regulation in order to provide the desired level of protection.
 Practical implications – The article demonstrates the possibility of testing new kinds of legal regulation – data protection – to archive social and economic security in a different sector, like baking and commerce.
 Originality/value – The article departs from a new concept of banking data, built from the meshing of the concepts of banking information and sensible personal data. From this conceptual frame, it can evaluate the level of protection granted by the European and French law in order to sketch a possible protective regime.