Mr. Denis Kelleher:

There are significant obligations in the general data protection regulation about the provision of information. It has to be given in concise clearly understandable form and so forth. There are clear obligations under data protection law and other laws to make it clear to people as to what will happen to them regarding the loan, how their data may be transferred and how enforcement proceedings may be brought against them. The problem is that people tend not to read this. There is the notorious situation of a whole field of people who have put up nonsensical terms and conditions such as agreeing to transferring one's immortal soul or one's first-born child in return for getting access to some social media service. People typically sign these contracts without another thought. People just do not read the terms and conditions.

There are provisions in the DPR trying to force controllers into setting out these terms and conditions in concise form. Notwithstanding that, people do not read them and even when they read them, they seem to disregard them.