--- title: "EBA Q&A 2020_5570 — Q&A — Consumer explicit consent to the PISP for processing [Final Q&A]" shortTitle: "EBA Q&A 2020_5570 — Q&A — Consumer explicit consent to the PISP for processing [Final Q&A]" answer_id: EBA_QA_2020_5570 status: "Final Q&A" type: qa instrument_type: qa authority: EBA binding: false binding_character: non_binding legal_status: in_force regulation: "PSD2" psd2_level3: true mica_level2: false legal_basis: "Article 94(2) PSD2" date: 3 December 2021 source_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5570 lifecycle: "Final Q&A" text_version: "EBA Q&A register, 3 December 2021" source_url: "https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5570" check_status: matched verified: true last_checked: 2026-10-26 checked_against: "the EBA publication" source: prepared_by: "European Commission" published_by: "EBA" published_in: "EBA Single Rulebook Q&A tool" evidence: prepared_by: "Answer prepared by the European Commission because it is a matter of interpretation of Union law." locator: "EBA Q&A register entry 2020_5570, field 'Answer prepared by'" document_type: "qa_answer" legal_nature: "not_legislation" addressees: "not stated in the document" dates: published_on: "2021-12-03" question_submitted_on: "2020-10-20" locators: published_on: "EBA Q&A register entry 2020_5570, field 'Final publishing date'" question_submitted_on: "EBA Q&A register entry 2020_5570, field 'Submission date'" lifecycle_label: "Final Q&A" --- **Answer prepared by the European Commission, published in the EBA Q&A tool · not legislation · published 3 Dec 2021 [Final Q&A]** *Final Q&A · EBA Q&A register, 3 December 2021 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5570)* | | | |---|---| | **Full title** | EBA Q&A 2020_5570 — Q&A — Consumer explicit consent to the PISP for processing \[Final Q&A\] | | **Prepared by** | European Commission | | **Published by** | EBA, in the EBA Single Rulebook Q&A tool | | **Reference** | EBA_QA_2020_5570 | | **Document type** | Q&A | | **Legal nature** | Not legislation | | **Addressees** | Not stated in the document | | **Dates** | Published 3 December 2021; question submitted 20 October 2020 | | **Legal basis** | Article 94(2) PSD2 | | **Related instruments** | None recorded | | **Text on this page** | Word for word — the full text of the EBA publication | **Consumer explicit consent to the PISP for processing of personal data** ### Question Can the presentation by the consumer of its identification data to the merchant (e.g. CustomerID and IBAN through a QR code read by the Point of Interaction (POI)) be interpreted as the consumer providing explicit consent via the merchant to the usage of this data by a Payment Initiation Service Provider (PISP) that has a contractual relationship with the merchant (but not with the consumer) for the processing of data that will enable the initiation of a single (instant) credit transfer with the consumer’s Account Servicing Payment Service Provider (ASPSP), subject to sufficient information about this PISP made available beforehand to the consumer (in accordance with Articles 44 and 45 of PSD2)? Or is the explicit consent of the consumer to the PISP required by way of contract, as mentioned in section 3.2.1 of the EDPB Guidelines 06/2020 on the interplay of Directive 2015/2366/EU (PSD2) and the GDPR? ### Background Article 94(2), PSD2, states that payment service providers shall only access, process and retain personal data necessary for the provision of their payment services, with the explicit consent of the payment user. Typically for (instant) credit transfers at the POI based on consumer-presented data (e.g. a QR-code with CustomerID and IBAN read by the merchant POI), a PISP could be involved on the merchant side who use the PSD2 Application Programming Interface (API) to connect to the consumer’s ASPSP, but the same PISP might not have a relationship with the consumer (e.g. in case of a single transaction) to initiate the transaction with the consumer’s ASPSP. How can the consumer give its consent to this PISP via the merchant with respect Article 94(2), PSD2, in particular for in-store transactions? Could the fact that the consumer presents their identification data to the merchant POI (e.g. a QR-code with CustomerID and IBAN read by the merchant POI) be interpreted as an explicit consent to the PISP through the merchant? *** ### Answer As provided for by Article 94(2) of Directive (EU) 2015/2366 (PSD2), where the Payments Initiation Service Provider (PISP) is involved on the merchant side, at the point-of-interaction, the presentation of the payer´s information (e.g. Customer-ID and IBAN through a QR-code read by the merchant) can be considered to satisfy the requirements of explicit consent for processing of personal data. In order to satisfy the information requirements of Articles 44 and 45 PSD2 the payer has to be informed, or have access to clear and comprehensive information by this PISP prior to the initiation. Disclaimer: The answers clarify provisions already contained in the applicable legislation. They do not extend in any way the rights and obligations deriving from such legislation nor do they introduce any additional requirements for the concerned operators and competent authorities. The answers are merely intended to assist natural or legal persons, including competent authorities and Union institutions and bodies in clarifying the application or implementation of the relevant legal provisions. Only the Court of Justice of the European Union is competent to authoritatively interpret Union law. The views expressed in the internal Commission Decision cannot prejudge the position that the European Commission might take before the Union and national courts. *** **Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2020_5570) ## Related Level 1 articles - [Article 94 — Data protection](../../../articles/94.md)