PSD2 contains several requirements of providers of payment initiation and account information services put in place to protect customers’ privacy. 

A payment initiation service provider may only provide a beneficiary with information about you if you have given your express permission. 

Equally, an account information service provider may only access the account or accounts that you have specified, and only with your expressed permission.