Data protection in banking and anti-money laundering and counter terrorism financing

Namen Splošne uredbe o varstvu podatkov je harmonizacija ureditev varstva osebnih podatkov v državah članicah, ki odpravlja nelojalno konkurenco podjetij in zagotavlja enotno varovanje pravic posameznikov. Splošna uredba o varstvu podatkov je prinesla nekaj novosti, ki so terjale spremembe notranjih procesov tudi v bančništvu. Med njimi so postavitev pooblaščene osebe za varstvo podatkov, obvezno poročanje o incidentih, pravice posameznikov in razširitev definicije osebnega podatka. Novosti bodo imele dolgoročen vpliv tudi na razvoj preprečevanja pranja denarja in financiranja terorizma. Veliko obveznosti iz tega boja je bilo preneseno na zavezance, s čimer se je banke zelo obremenilo. Z namenom izpolnjevanja teh obveznosti, se banke poslužujejo sodobnih tehnologij, saj ročna obdelava ni več učinkovita. Z uporabo algoritmov banke pridobivajo in ustvarjajo podatke ter z nastavljenimi scenariji spremljajo finančne transakcije za zaznavanje obstoja pranja denarja ali financiranja terorizma. V bližnji prihodnosti bodo banke obdelovale nove vrste osebnih podatkov, pridobljene iz drugih virov, ne več zgolj neposredno od strank. Del prihodnosti bo tudi uporaba strojnega učenja, s čimer bodo banke lahko ugotavljale nove tipologije in napovedovale pojav pranja denarja. Pri tem pa bodo morale spoštovati tudi načela varstva osebnih podatkov, ki zahtevajo dodatne ukrepe zavarovanja pri uporabi sodobnih tehnologij. Ti ukrepi varujejo posameznikovo zasebnost, hkrati pa zavirajo tehnološki razvoj. Varstvo osebnih podatkov in preprečevanje pranja denarja zahtevata nenehno usklajevanje pri upravljanju s tveganji, ki nastajajo na obeh področjih. Posebej takrat, ko so si cilji in načela obeh v očitnem nasprotju. Iskanje ravnotežja, ob doseganju dobička kot glavnega motiva, bo banke postavljalo v položaj med Scilo in Karibdo.The main purpose of General data protection regulation is the harmonisation of data protection, which ensures unified protection of individuals’ rights and eliminates the unfair competition of companies, in EU member states. The General data protection regulation has required banks to adapt their internal processes. Among them are appointing a data protection officer, mandatory reporting in cases of breaches of data protection, redefining individuals’ rights and broadening definition of personal data. The regulatory changes will have far-reaching effects on the development of anti-money laundering and counter terrorism financing. For these purposes, several tasks were mandated to banks. In order to comply, banks use modern technologies, as manual monitoring is not efficient anymore. Banks acquire and create data with the use of algorithms. In order to detect suspicious transactions, transaction monitoring is based on pre-defined scenarios. In the future, banks will process new categories of personal data acquired from different sources. Further into the future, they will use machine learning, which will enable them to analyse and predict potential money laundering and terrorism financing. While using modern technology, banks will have to abide by the data protection principles, which call for additional measures. These measures safeguard individuals’ privacy, although simultaneously slow down technological development. Data protection and anti-money laundering demand constant balancing while managing the risks that they create. Especially, if their principles are in conflict. Finding the balance, while pursuing the goal of maximising profit, will maintain banks in between Syclla and Charybdis