Guidelines 06/2020 on the interplay of the Second Payment Services Directive and the GDPR

Section 5.2  Possible derogations

53 The prohibition of Article 9 GDPR is not absolute. In particular, whereas derogations of paragraphs (b)-(f) and (h)-(j) of Article 9 (2) GDPR are manifestly not applicable to the processing of personal data in the PSD2 context, the following two derogations in Article 9 (2) GDPR could be considered:

a) The prohibition does not apply if the data subject has given explicit consent to the processing of those personal data for one or more specified purposes (Article 9 (2) (a) GDPR).

b) The prohibition does not apply if the processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject (Article 9 (2) (g) GDPR).

54 It should be pointed out that the list of derogations in Article 9 (2) GDPR is exhaustive. The possibility that special categories of personal data are included in the personal data processed for the provision of any of the services falling under the PSD2 must be recognised by the service provider. As the prohibition of Article 9 (1) GDPR is applicable to these service providers, they must ensure that one of the exceptions in Article 9 (2) GDPR is applicable to them. It should be emphasised that where the service provider cannot show that one of the derogations is met, the prohibition of article 9 (1) is applicable.