• 195 Posts
  • 183 Comments
Joined 2 years ago
cake
Cake day: July 1st, 2024

help-circle


































  • FWIW, as someone working in fintech in the EU, that “KYC over-achievement” is not as overzealous as you think it is.

    It is not as reckless in the EU as it is in the USA, but still overzealous in the EU. Examples:

    • Guy in Finland was refused a home mortgage because his bank transactions revealed that he buys a lot of wine. Alcohol consumption was tracked and seen as a risk for lending.
    • Some banks’ privacy policies openly admit that they keep records of the IP address for the purpose of tracking geolocation. Yes, in Europe. And yes, it violates GDPR Art.5 (data minimisation).
    • No GSM number? No account. Some banks don’t even just accept what number you give them – they demand proof from the GSM carrier that the number belongs to the applicant (even in a region that mandates GSM registration).
    • ID card on file at a bank expired. What does the bank do? They simply cut off the card, even if it’s a Friday and the bank doesn’t reopen until next week. That is how they communicate to the customer that they need to provide an updated document. No, people’s identity does not change. It is still the same person.
    • Some EU banks now refuse to give customers a statement of account on paper, thus forcing them online.
    • Some EU banks collect frivilous data for marketing purposes which they treat as “legitimate interest”. They write this in the privacy policy. People can opt-out, but for me it’s an abuse that it’s not the other way around. It should be opt-in.

    Not KYC but still an abuse: All EU banks with mobile apps force customers to obtain their closed-source app from Google or Apple, who then collects the IMEI number of the user, their GSM number, and tracks which apps they download so Google or Apple has a record of where people do their banking. Likewise, some banks choose Microsoft or Google for their email service and they never provide a PGP key. In this case MS or Google sees where people bank and their msg payloads.

    None of that privacy abuse is legally necessary or required to execute the contract.

    And, at least at my place of employment, we take the PII protection very seriously because of GDPR.

    You could only express that in terms of your own place of employment. The DPAs in most member states report annually being understaffed. They are up to their necks in an unsurmountable ocean of Art.77 complaints because the GDPR is widely ignored.