{"page":"/blog/bank-transaction-data-advertising-gdpr-psd2","modified":"2026-11-10","license":"https://creativecommons.org/licenses/by/4.0/","columns":["Provision","What it says","Source"],"rows":[["GDPR Articles 5(1)(b), 6 and 9","The regulation sets purpose and lawful-basis requirements, with separate conditions for special categories.","Source text"],["GDPR Article 21(2)–(3)","A person can object to direct marketing, including related profiling, and processing for those purposes then stops.","Source text"],["GDPR Recital 47","The recital says processing for direct marketing may be regarded as serving a legitimate interest.","Source text"],["PSD2 Articles 66(3)(g) and 67(2)(f)","The payment services directive limits use, access or storage by payment initiation and account information service providers to the stated service purposes.","Source text"],["ePrivacy Directive Article 5(3)","Storage or access on terminal equipment requires consent unless a specified exception applies.","Source text"],["GDPR Articles 44–49","Chapter V sets conditions for transfers to third countries or international organizations.","Source text"]],"sourceUrls":[["https://eur-lex.europa.eu/eli/reg/2016/679/oj"],["https://eur-lex.europa.eu/eli/reg/2016/679/oj"],["https://eur-lex.europa.eu/eli/reg/2016/679/oj"],["https://eur-lex.europa.eu/eli/dir/2015/2366/oj/eng"],["https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02002L0058-20091219"],["https://eur-lex.europa.eu/eli/reg/2016/679/oj"]]}