Key takeaways

The most important points addressed in the Draft Circular are the following:

• Legitimate purpose and proportionality: The processing of personal data must have a legitimate purpose, be necessary and and be used in time proportional to the financial service offered.
• Data minimization: Only the information strictly necessary to fulfill the purpose of the processing should be collected.
• Prior, express and informed consent: It is mandatory to obtain a clear and differentiated consent from the data subject before or at the same time of processing his/her personal data, in cases where consent is requested for the processing of personal data for purposes additional to those strictly necessary for the provision of the service.
• Consent: Consent for the processing of personal data may be expressed by the data subject in writing, by a data message, orally or through unequivocal conduct that makes it reasonably possible to determine that consent was granted by the data subject and that it may be consulted later.
• Transparency in automated decisions: Data subjects should be informed if their data will be used in automated decisions and have the possibility to challenge them through the channels provided for the submission of petitions or complaints.
• Protection of sensitive data: It is prohibited to condition access to financial services to the provision of sensitive data, such as biometric data, unless there is a differentiated and express consent, and strict security measures are implemented.
• Mechanisms for the exercise of rights: Companies should establish visible and effective channels for data subjects to exercise their rights of access, rectification, updating and removal, among other rights granted by the regulation.
• Transmissions and transfers: Specific parameters are established for the transmission or transfer of data.
• Privacy Impact Assessments: It is recommended that privacy impact assessments be conducted to identify and mitigate risks associated with the processing of personal data.

Recommendations for Fintech ecosystem data controllers

The Draft Circular includes the following recommendations for those data controllers for the Fintech ecosystem, among others:

• Policy review and adjustment: Update privacy policies and internal procedures to align with the proposed new guidelines.
• Implementation of consent and preference mechanisms: Establish clear processes for obtaining informed consent from users. Additionally, enable mechanisms that are visible and intuitive, allowing data subjects to manage their privacy preferences and decide on the sharing of their personal data with third parties.
• Evaluation of technologies used: Analyze and adjust technologies involving automated decisions to ensure transparency and the right to challenge.
• Strengthening security measures: Reinforce technical and organizational measures to protect personal data, especially sensitive data. Similarly, the security measures implemented must be recorded and reviewed periodically, adapting to the evolution of risks.
• Access to personal data: Establish simple and agile mechanisms that are permanently available to data subjects so that they can access their personal data and exercise their rights. Likewise, the agents in the fintech ecosystem must implement procedures that guarantee the maintenance of detailed records on requests for access to personal data by third parties authorized.
• Improve the collection and processing of sensitive data: At the time of collection of this kind of data, which in any case must be exceptional, the data controller must inform the data subject of the following:

1. That since it is sensitive data, he/she is not obliged to authorize its processing.
2. Which of the data to be processed are sensitive and what are the specific purposes of such processing, for each type of sensitive personal data.

• Subscription of clauses: The subscription of the Model Contractual Clauses included in the "Implementation Guide Model Contractual Clauses for the International Transfer of Personal Data (TIDP)" of the Ibero-American Data Protection Network and its annex "Model Contractual Clauses".

Additional information

The SIC encouraged those data controllers for the Fintech ecosystem to heed the above guidelines, in order to ensure regulatory compliance, and guarantee the protection of data subjects' rights.

For more information, the SIC's Draft Circular can be consulted at the following link. Remember that those interested may send comments and observations on the Draft Circular until 21 May 2025.

Please do not hesitate to contact us in case you have any questions or require our advice.

Spanish version