KBC Bank criticised for “misleading” policies on user data

Belgian banking giant KBC will now make it more difficult for banking app users to avoid personalised advertising, De Standaard reported on Friday. Privacy activists are preparing a complaint. “Every bank nowadays collects data from its customers. But if KBC does that by leading people astray, it is 100 per cent in violation of the European rules around data protection”, says privacy activist Matthias Dobbelaere-Welvaert.

Since the most recent update to that app, anyone using KBC's mobile app to conduct banking business, buy train tickets or top up call credit has been asked again which “commercial messages” they wish to receive. Notably, KBC is now making it particularly difficult for users to block personalised advertising messages, De Standaard writes.

For instance, the most far-reaching option is prominently highlighted in the drop-down menus. Ticking it gives KBC permission to “analyse and use all your data”. In return, the bank promises “special discounts, better tailored to your situation”, which the user gets via push notifications, e-mail, SMS and Whatsapp. Only through a complicated drop-down menu can app users still opt out of having KBC analyse and use their data for tailored advertising.

Those who do not want to receive any advertising at all can not make this choice in the app itself. Instead, they have to make their way through several small-print menus only to find out that they can only opt-out by sending a separate e-mail to KBC.

In a reaction to De Standaard, privacy activist Matthias Dobbelaere-Welvaert heavily criticised the modus operandi of Belgium’s second-largest bank-insurer. “KBC has been moving into problematic territory with its app for some time”, he says. “With the way it also attracts non-customers to its platform, by also selling train tickets or parking tickets, for example, it is well on its way to becoming the Belgian version of the Chinese “super app” WeChat. KBC thus gets its hands on a lot of personal data, which it then tries to commercialise.”

"It is a textbook example of what is called a dark pattern in the jargon, a misleading user interface designed specifically to make people make choices they don’t actually want to make.”

By asking users again whether they want to receive personalised advertising messages or not, and now doing so via complicated drop-down menus, KBC is going one step further, Dobbelaere-Welvaert says. “Most users will immediately click away those drop-down menus, automatically agreeing to everything. It is a textbook example of what is called a dark pattern in the jargon, a misleading user interface designed specifically to make people make choices they don’t actually want to make.”

Dobbelaere-Welvaert told De Standaard that he and his non-profit organisation Ministry Of Privacy are preparing a complaint against KBC with the Data Protection Authority, Belgium’s privacy watchdog. “Every bank nowadays collects data from its customers. (…) It is true, however, that banks must first clearly ask for permission to do so. But if KBC does that by leading people astray, it is 100 per cent in violation of the European rules around data protection, the GDPR. This legislation stipulates not only that users must be able to give their consent freely, but also that there must be no ambiguity.”

In a written response to De Standaard, KBC said that although it collects personalised data from customers, it absolutely does not resell any of this data to external parties. However, KBC did not clarify the company's agreements with external commercial partners - such as Dreamland and JBC, where customers receive discounts in exchange for sharing personal information with the bank via the app. The fact that customers can only unsubscribe from all forms of advertising via a separate email is “not a new practice”, the company claims.

(BRV)

^{#FlandersNewsService © BELGA PHOTO VIRGINIE LEFOUR}