Banking sector data protection guidelines published

Updated Data Protection Guidelines for the banking sector have now been finalised and published on the websites of the Malta Bankers’ Association and of the Office of the Information and Data Protection Commissioner.

The updated guidelines reflect and address the requirements of the EU’s General Data Protection Regulation, which will become applicable in all member states, including Malta, as from 25 May.

These guidelines are the fruit of extensive meetings held over a number of months by a joint working group consisting of members of the MBA and representatives of the Office of the Information and Data Protection Commissioner.

The GDPR will replace the EU’s Data Protection Directive 95/46/EC which was transposed into our national law in 2001. Data Protection legislation regulates the processing of all personal data and the aim of the GDPR is to further strengthen such protection for all individuals within the EU.

James Bonello, MBA secretary general, explained that “these guidelines are intended to focus on those sections of the regulation which may not be entirely clear, or which could lend themselves to differing interpretations, thereby ensuring that a common understanding is arrived at, and a consistent interpretation is applied, across the banking sector”.

The Information and Data Protection Commissioner, Saviour Cachia, recognises the need for the processing of personal data by banks in this heavily regulated sector. He said that these guidelines are aimed at providing banks with a clearer interpretation of the law when dealing with specific situations involving the processing of personal data.

He further emphasised that “while the guidelines are a good starting point for banks to comply with their data protection obligations, these shall apply without prejudice to any decision which the Commissioner may take on complaints and on any other specific data protection issue”.