EP31: GDPR and PSD2 Protection Versus Access

Europe has led global regulatory innovation in the data-driven economy through GDPR and open banking (PSD2), offering key lessons for the world. GDPR has become a global benchmark for data protection, granting individuals strong rights over their personal data and forcing organizations to rethink data collection, consent and retention practices. While compliance costs have been significant—especially for banks, tech firms and smaller businesses—GDPR has also created new industries and improved marketing effectiveness through higher-quality, consent-based customer data. However, it has raised concerns about constraining innovation in data-intensive technologies such as AI, blockchain and IoT.PSD2, meanwhile, aimed to open and modernize payments by enabling secure third-party access to bank accounts via APIs and strong customer authentication. Implementation proved complex due to lack of standardization and limited immediate business incentives. Banks largely responded defensively, prioritizing compliance over innovation. Together, GDPR and PSD2 highlight the tension between data protection and data access, showing that regulation can enable trust and competition but may also slow innovation if not carefully balanced.