59. Does not, therefore, support third-party access to a customer's bank account information unless the system is demonstrably secure and has been thoroughly tested; notes that, in any regulation, third-party access should be limited to binary ('yes–no') information on the availability of funds, and that special attention should be paid to security, data protection and consumer rights; considers, in particular, that it should be clearly specified which parties can have access to this information on a non-discriminatory basis, and under which conditions the data can be stored, and th
at these provisions need to be subject to a contractua
...[+++]l relationship between the entities involved; stresses that a clear distinction between access to information on the availability of funds for a given transaction, and access to a customer's account information in general, should be made when establishing a regulatory framework for third-party access; calls on the Commission to ensure protection of personal data by proposing, after the consultation of the European Data Protection Supervisor, clear regulation as to which role each actor plays in collecting data and for which purpose, and a clear definition of the actors responsible for collecting, processing and retaining data; adds that card users should have the possibility to access and rectify their personal data, also in a complex cross border context; finds that data protection requirements should be implemented along the principle of ‘privacy by design/by default’ and that businesses or consumers should not bear the responsibility to protect their data; ...