(4)The exemption should be limited to access to the balance and the recent transactions of a payment account without disclosure of sensitive payment data. The exemption should only apply where strong customer authentication was already applied by payment service providers for the first access through the respective account information service provider and should be renewed periodically.