Standards and Statutes: The Hidden Architecture of Data Protection in European Banking

Executive Summary

TL;DR: This research explores the symbiotic yet tense relationship between formal legislation (like GDPR) and industry standards (like BCBS 239 and ISO 27701) within the European banking sector. While standards provide the "how-to" for vague legal principles, they also risk reframing privacy as a technical security issue rather than a fundamental human right.

Positioning: This paper sits at the intersection of Socio-Legal Theory and Data Governance. It moves beyond a simple legal analysis to provide an ethnographic "thick description" of how regulations are actually implemented "on the ground" in complex financial institutions.

Problem & Motivation: The Implementation Gap

Legislation in democratic societies is notoriously slow. To avoid obsolescence, data protection laws like the GDPR are written to be technology-neutral. However, "technology neutrality" often translates to "practical ambiguity" for a bank's technical staff.

The authors identify a Polycentric Regulatory Regime—a messy network of actors including national regulators, trade associations, and international standard-setting bodies. The core tension is that while banks crave the predictability and interoperability of standards, these standards are often created by private entities (like ISO) where large corporations hold disproportionate influence, potentially diluting the public interest.

Methodology: High-Stakes Ethnography

To understand this interaction, the researchers conducted a year-long study (2020) involving:

• In-person and Digital Fieldwork: Observing the "three lines of defense" (Operations, Compliance/Risk, and Audit) at a major European bank.
• Expert Triangulation: 25 interviews and multiple international panels with DPOs, board members, and regulators.
• The "COVID Pivot": Transitioning from physical workspace observation to "digital co-presence" via videoconferencing, reflecting the reality of modern banking work.

Note: This diagram illustrates the relationship between the three lines of defense and how standards filter through each layer.

Methodology Detail: The BCBS 239 & GDPR Synergy

One of the most significant findings is the role of BCBS 239 (Principles for effective risk data aggregation). Although meant for financial risk reporting, its introduction in 2016 forced banks to define "data ownership" and "data quality" long before the GDPR was enforced.

Key Insights on Methodological Interaction:

• Strategic Alignment: Bank managers "piggybacked" GDPR compliance onto existing BCBS 239 infrastructure projects to secure board-level funding.
• The "Double-Edged Sword": While BCBS 239 created the governance needed for GDPR's "Accountability" principle, it also made data so clean and accessible that it tempted banks to explore secondary "consent strategies" for data monetization.

Experiments & Results: Innovation vs. Instruction

The study highlights a stark contrast between mandatory banking standards and voluntary privacy standards:

1. ISO 27701 (The Trust Broker): Professionals viewed ISO certification as a "tick the box" exercise for business-to-business trust. However, experts warned that ISO focuses on Information Security (protecting the organization), whereas GDPR focuses on the Data Subject (protecting the human).
2. Open Banking (The Innovation Driver): A significant finding was the "perceived need" for Open API standards. Banks and Third-Party Providers (TPPs) argue that the lack of cross-border API standards (like those seen in the UK's CMA mandate) is stifling innovation in the EU.

Note: A comparison of the focus areas of GDPR (Rights-based) vs. ISO Standards (Security-based).

Critical Analysis & Conclusion

The Takeaway

The paper concludes that Data Governance and Data Protection are inseparable. You cannot protect what you cannot govern. Standards are the "practical surrogates" that turn abstract law into daily routine.

Limitations & Future Outlook

• Accountability Gap: Commercial standards lack the democratic accountability of law. When ISO standards are written by the same companies they regulate (e.g., Microsoft’s involvement in ISO 27701), there is a risk of "co-regulation" becoming "self-regulation."
• The Quantification Trap: Standards thrive on what can be measured (breach counts, latency). They struggle with what cannot be measured—the "chilling effects" on human rights, anxiety, or the loss of social agency.

Future Work: Regulators must move toward "Collaborative Co-regulation," where data protection authorities actively guide standard-setting bodies to ensure the "human" is not optimized out of the data protection equation.