Grounds for Data Processing
Mobile banking means the continuous processing of personal data, and the law confines this processing to clear grounds: it is permitted where the data subject has given consent for one or several specific purposes; where processing is necessary for the performance of an obligation under a transaction concluded with the data subject or for concluding a transaction at the subject's request; where it is provided for by law; where it is necessary for the performance of duties imposed on the controller by the legislation; and in other cases provided for by law, including the protection of vital interests and significant public interest. Every function of the application — from creating a profile to analysing transactions — must be tied to these grounds; otherwise the processing becomes baseless. Where consent is the ground, it is particularly important that it refer to specific purposes and not be folded into a general formulation.
The Consumer's Right to Information
A data subject is entitled to request from the controller confirmation of whether data concerning the subject is being processed, whether the processing is justified, and to receive free of charge, in accordance with the request, information about the data being processed, the grounds and purposes of processing, the sources of collection and the retention period. On the screen of a banking application this right takes a practical form: the consumer must be able to obtain this information easily, not merely be told that it exists somewhere in the terms. Transparency here is not a formality but the foundation of trust, and the way an institution answers information requests often says more about its compliance than any policy document.
Technical and Organizational Security Measures
The controller is obliged to take appropriate technical and organizational measures to ensure that data are processed in accordance with the law and to be able to confirm this compliance. The measures must correspond to the possible and accompanying threats of processing and include such instruments as pseudonymisation of data and the logging of access to data. In the mobile banking context this means that security is not only a matter of servers: it embraces access management, logging, and processes that restrict even employees' unjustified contact with the data. A security architecture built this way simultaneously serves the regulator's expectations and the customer's peace of mind.