When Your Political or Religious Beliefs Get Your Bank Account Closed: The "Debanking" Phenomenon Under GDPR Scrutiny
A wave of investigations by US financial regulators (OCC) has uncovered a concerning practice: at least 9 major banking institutions have been accused of unilaterally terminating services for clients based on their political beliefs or religious affiliations.
Payment processors like WePay and financial giants such as PNC Bank, JPMorgan Chase, and Bank of America have come under public scrutiny after denying credit or closing accounts belonging to conservative merchants, religious non-profits, and media organizations. The official explanation from the banks? A remarkably vague justification: “reputational risk policy violations”.
How does this US phenomenon relate to European citizens and businesses? Through a direct and critical connection: personal data processing, automated profiling, and fundamental rights under GDPR.
The Real Story: How Does a Bank Know What You Believe?
For a bank to label a client as a "reputational risk" based on political or religious grounds, extensive personal data collection, monitoring, and profiling must take place.
Modern financial institutions look far beyond credit scores. Driven by risk assessment algorithms, banks analyze:
- Financial transactions and payment recipients (donations to churches, NGOs, or political causes);
- E-commerce transactions and the nature of products/books/materials sold or purchased;
- Digital footprints and, in some instances, open-source intelligence (OSINT) and social media activity.
These puzzle pieces are assembled into a detailed customer profile. When this profile triggers an arbitrarily assigned "reputational risk" flag, the account is frozen or closed without clear explanation.
Where Banks Fail
If such practices were applied to individuals or businesses within the EU (or by US banks processing EU citizens' data under the extraterritorial scope of Art. 3 GDPR), they would constitute severe violations of data protection law:
1. Processing Special Categories of Data (Art. 9 GDPR)
Political opinions and religious beliefs constitute special categories of personal data. Under Article 9 GDPR, processing this data is prohibited by default, subject only to narrow exceptions. Commercial reputational interest does not override this prohibition.
2. Profiling and Automated Decision-Making (Art. 22 GDPR)
Data subjects have the right not to be subject to decisions based solely on automated processing, including profiling, which produces legal effects or significantly affects them. Losing access to banking services has a profound socio-economic impact.
3. Lack of Transparency and Lawful Basis (Art. 5 & 6 GDPR)
GDPR mandates lawful, fair, and transparent processing. Hiding behind ambiguous "reputational risk" contract clauses violates Articles 13 and 14 (Right to be informed). Clients have the right to know what data was processed and the underlying logic of the decision.
How to Prevent and Address This Issue
- Submit a Data Subject Access Request (DSAR - Art. 15 GDPR): Request full visibility into profiling history, data sources, and internal risk scores.
- Refine Corporate Risk Policies: Ensure internal compliance risk matrices focus strictly on financial and legal metrics, excluding subjective socio-political criteria.
- Challenge Automated Decisions: Exercise Article 22 rights to demand human intervention and contest arbitrary account closures.
Conclusion
As financial services become entirely digitized, access to banking is vital. When sensitive personal data is weaponized for ideological filtering, GDPR serves as the primary shield protecting personal autonomy and fundamental freedoms.
At GDPR Consulting, we help businesses implement transparent, compliant risk-assessment frameworks while empowering individuals to enforce their privacy rights.