The impact of the General Data Protection Regulation on the banking sector: Data subjects’ rights, conflicts of laws and Brexit

Abstract

The General Data Protection Regulation (GDPR) will undoubtedly have an impact on how businesses manage compliance in the coming years. The banking and finance sector is not immune. It does however already operate in a heavily regulated environment, because the type of personal data banks receive, while not generally fitting the definition of ‘sensitive personal data’ in the EU, is still highly vulnerable data that could see the data subject becoming a victim of fraud or other financial crime. Between the NIS Directive and the GDPR, what then will be the impact of additional toothy, large-scale regulations requiring databases full of documentation for auditability, transparency and accountability on an industry already (presumably) running a very tight compliance ship? This paper will address: ●● the key changes of the GDPR (and for completeness, the NIS); ●● what happens when these laws conflict with other applicable regulations; ●● other changes in the banking in general, including the end to banking secrecy in light of certain elements of the GDPR around sharing of personal data; and ●● the impact Brexit will have in the context of regulating privacy in a non-GDPR environment.