Banking Sector Data Protection Guidelines published

Updated Data Protection Guidelines for the Banking Sector have now been finalised and published on the websites of the Malta Bankers’ Association and the Office of the Information and Data Protection Commissioner.

The updated guidelines reflect and address the requirements of the EU’s General Data Protection Regulation (GDPR) which will become applicable in all member states from 25 May.

They are the result of extensive meetings held over a number of months by a joint working group consisting of members of the Malta Bankers’ Association and representatives of the Office of the Information and Data Protection Commissioner.

The GDPR will replace the EU’s Data Protection Directive 95/46/EC which was transposed into Maltese national law in 2001. Data Protection legislation regulates the processing of all personal data and the aim of the GDPR is to further strengthen such protection for all individuals within the EU.

MBA Secretary-General James Bonello explained: “These guidelines are intended to focus on those sections of the Regulation which may not be entirely clear, or which could lend themselves to differing interpretations, thereby ensuring that a common understanding is arrived at and a consistent interpretation is applied across the banking sector”.

Information and Data Protection Commissioner Saviour Cachia recognises the need for the processing of personal data by banks in this heavily regulated sector. He said that the guidelines are aimed at providing banks with a clearer interpretation of the law when dealing with specific situations involving the processing of personal data. He further emphasised the fact that: “While the guidelines are a good starting point for banks to comply with their data protection obligations, they will apply without prejudice to any decision which the Commissioner may take on complaints and on any other specific data protection issue.”