Open Banking: Gordian Legal Knots in the Uncomfortable Cohabitation between the PSD2 and the GDPR

Abstract

This work analyses problems in the legal framework of Open Banking enabled by the Payment Services Directive 2 (PSD2). It goes through the role of EU law in the regulation of payment services up to their transition towards digitalization and fintech, to show the scale of the changes brought by the PSD2 in a territory unfamiliar to traditional banking. The resulting conflation between banking and the data economy reveal a brand-new market. The normative intersection between the PSD2 and the General Data Protection Regulation (GDPR) expose not only poor coordination but also a growing entanglement of legal knots. The legal inconsistencies, loopholes, and interpretative difficulties are examined to expose operational risks beyond difficulties of legal technicism. A rethinking, or at least a correction, of the European regime of Open Banking is necessary to reconcile the needs of an emerging market and the protection of its users.