How Standards Co-Shape Personal Data Protection in the European Banking Sector

Abstract

Attention for the protection of personal data has increased in recent years, but the preponderance of privacy-related scandals shows there is still a clear need for practical guidance. Companies and industries often argue for guidance in the form of standards, which are thought to have several benefits, such as creating a level playing field internationally, promoting interoperability, and allowing for straightforward conformity assessments. Conversely, standards may create confusion as to what "the rules" are if they are not fully aligned with laws, for instance when international standards and national laws govern the same practices. Given these pros and cons, to what extent do standards provide clarity and practical support in the protection of personal data? This paper explores that question through an evaluation of findings on standards in an ethnographic study of the European banking sector. The purpose of the study was to find factors that influence the protection of personal data "on the ground", with standards potentially being one of those factors.