{"id":1658,"date":"2018-06-14T11:13:00","date_gmt":"2018-06-14T11:13:00","guid":{"rendered":"https:\/\/digiterrebestg.wpengine.com\/?p=1658"},"modified":"2024-05-30T13:26:38","modified_gmt":"2024-05-30T13:26:38","slug":"mifid-ii-and-gdpr-contradictory-or-meeting-customer-needs","status":"publish","type":"post","link":"https:\/\/www.digiterre.com\/us\/2018\/06\/14\/mifid-ii-and-gdpr-contradictory-or-meeting-customer-needs\/","title":{"rendered":"MiFID II and GDPR. Contradictory or meeting customer needs?"},"content":{"rendered":"
\n
\n

MiFID II and GDPR. Contradictory or meeting customer needs?<\/h1>\n\n

Over recent years financial services organizations have had to face a large number of additional complex regulatory requirements. No sooner had the MiFID II deadline passed, GDPR legislation came into effect which placed new burdens and costs on the industry. In this article, we discuss about the regulatory requirements in data protection<\/p>\n \n <\/div>\n<\/section>\n\n\n

\n
\n

Businesses feel onerous demands are being placed on them by regulators and EU directives alike. But take a wider perspective and it soon becomes clear that the time for such regulations has indeed come, especially when information security breaches such as those of TalkTalk and Equifax hit our headlines and the risks to personal data breaches grow. Whilst discrete regulations, they both address the growing data needs of customers and other stakeholders.<\/p>\n\n\n\n

At its heart, the core purpose of MiFID II is to enhance investor protection with improved governance and transparency requirements. GDPR\u2019s core purpose is to benefit individuals \u2013 including those same investors \u2013 by giving them greater control over the personal data relating to them. For a firm an individual can be a client, an employee or any third party provider. GDPR also sets in stone the right for people to know how their data is being used and the right for any information to be deleted on the individual\u2019s request.<\/p>\n\n\n\n

Even so, whilst in financial services markets investors are the ultimate beneficiaries, firms are likely to be left facing a compliance headache as they try to balance the inherent contradictions between protecting investors under MiFID II with greater transparency<\/em> about them and their activities on the one hand for regulators and acting in an appropriate manner in respect of the security and privacy<\/em> of those investors\u2019 data under GDPR on the other. What people often miss is that GDPR does not forbid the disclosure of customer information: it simply sets rules in place for the way in which this information is shared.<\/p>\n\n\n\n

The tensions between the two can be summarized in the two key areas of data collection and record keeping:<\/p>\n\n\n\n

Data collection<\/strong>: MiFID II requires the collection and retention of a large volume of client and counterparty information, including all electronic communications data. This data must be made available to regulators within 72 hours of a request. Conversely, GDPR introduces specific data subject rights around the erasure of data. It\u2019s also worth remembering that the penalties of GDPR non-compliance are significantly tougher than those of MiFID II. GDPR fines are expected to reach up to 20 million euro or 4% of global turnover for the most significant areas of non-compliance.<\/p>\n\n\n\n

Record keeping:<\/strong> Firms must be accountable for the personal data they hold and consider the purposes and period for which that data is retained. For example, under MiFID II, client email correspondence must be recorded and archived for up to five years, telephone calls for as long as seven years. GDPR states that organizations may only process data where there is a legitimate basis for doing so and document this accordingly.  The regulation also states that it is to be stored only for as long as necessary or within the statutory minimum retention periods specified by other legislation. An example of a contradiction between the two regulations is that if a client wishes to have data recorded about them deleted within the timeframe set down by MiFID II, the firm will not be compelled to comply.<\/p>\n\n\n\n

An integrated data and technology policy is a key to moving forwards<\/strong><\/p>\n\n\n\n

It\u2019s worth saying that these are most unlikely to be the last data regulations facing businesses! Technology has too often been focused on applying a single, point solution to problems immediately at hand \u2013 which has resulted in the current scattered and siloed state of much enterprise\u00a0information management. So the good news is that firstly, reconciling both MiFID II and GDPR is not only a solvable problem, but that fixing it will benefit almost every department within an enterprise greatly, from accounting to customer service and beyond. Secondly, it prompts organizations to take a more integrated and holistic approach to data management and be better prepared for future regulations and directives. Thirdly, newer, more powerful technologies are available that can address the need for more integrated data management, provide competitive advantage for firms and also be designed to maximize future proofing.<\/p>\n\n\n\n

A simple, outline data approach would include:<\/p>\n\n\n\n