In December 2020, the European Data Protection Board adopted new
guidelines in relation to the relationship between the second
Payment Services Directive
(“PSD2”)1 and the GDPR,
setting out clear guidance for payment service operators with
regard to how the personal data which they process may be dealt
with in a GDPR-compliant manner. The PSD2 was adopted into
Irish law in January 20182 and is a critically important
piece of EU legislation, as it seeks to ensure legal certainty for
consumers, merchants and companies within the payment chain, while
also serving to modernise the EU legal framework for the payment
services market.
The interplay between the PSD2 and the GDPR is particularly
important, due to the fact payment service operators may access and
process large quantities of personal financial data, much of which
may be ‘sensitive' personal data, and the GDPR applies
to the processing of personal data carried out in the context of
payment services. As a
