Use of bank transaction data for customized discounts

Use of bank transaction data for customized discounts

The complaint aims to prosecute the use of personal data by the defendant Bank as the complainant customer understands that the processing of personal data that is carried out to build customized discount models has a completely different purpose than the one for which they were originally collected, namely for the management of transactions such as the execution or recording of payments.

Data processing in this regard

The Bank processes the personal data of its customers without explicit consent by relating with “compatibility” the same legal basis of the main data processing, banking transactions under the contract, with the second processing, creating customized discount models.

The Bank’s customer states that the secondary processing has a totally different purpose than the first one and, therefore, the legal bases are not the same, being incompatible treatments since, the defendant cannot rely on legitimate interest for the construction and training of data models for direct marketing of third parties, i.e. to offer personalized discounts on services and products of third parties.

Furthermore, according to the complainant customer there was also no clear distinction between the services “personalized information”, “personalized discounts” and model building for these services, whereby the transparency and fairness of the processing was ensured.

Comercial interest as part of the legitimate interest

As far as the Bank was concerned, it adopted legitimate interest as the legal basis for processing personal data obtained without explicit consent, understanding that the offer of this type of discounts applicable on third party products constitutes part of the Bank’s commercial interest.

The Belgian Authority has expressed its understanding of the purpose of the processing as “the construction of data models for the purpose of offering the defendant’s customers personalized discounts on third party products and services must be considered to be carried out with a legitimate interest.

It allows the Respondent to make available to its customers a similar service, as do other banks that also grant discounts in the form of cashbacks. In the data model for which the Respondent uses customer transaction data, thus including that of the Complainant, it aims to offer personalized discounts which is part of the market positioning.

The Respondent’s starting point is therefore to learn about its customers’ services by responding to societal evolutions and trends, such as digitalization and personalization of services and diversification of service offerings, which is motivated by a commercial interest. Such commercial interest is legitimate interest in accordance with Recital 47 of the GDPR and is also supported in Opinion 06/2014 of the Article 29 Data Protection Working Party.”

Value judgment of interests

It performs a value judgment of interests or “balancing test” between the interests of the controller and those of the data subject, it determines that, “the data subject at the time and in the context of the collection of the personal data can reasonably expect that the processing may take place for that purpose”.

The Belgian Authority distinguishes between the phase of construction or formation of the personal data models themselves and the phase of operationally offering personalized discounts through digital applications that make use of the models built in the previous phase. In other words, the first phase is merely an intermediate step towards the ultimate intended purpose, the offer of personalized services with discounts.

The Belgian Authority determines that the resulting models are only algorithms that do not contain personal data and, therefore, what the Bank does is, on the one hand, to reuse such data for its study and drawing of inferences and, on the other hand, to implement the offer of personalized discounts which does require prior consent.

Therefore, it understands that the impact of these offers on the customer is minimal, as is the processing of his personal data, since the Bank simply reuses the data collected on the basis of its legitimate interest and, although it reuses them in the model construction phase, the offer of personalized discounts is not activated unless the complainant himself actively consents to it.