Consent should be explicit

[WestpacOpenBanking]

We agree with the comment made by da-banking on the draft standards. That is, in accordance with the legislation and ACCC draft rules framework consent should be express, informed and specific as to use. In particular, our expectation is that customers should be able to choose which accounts are in the scope of a consent.

[lukepopp]

Thanks @WestpacOpenBanking, I'll park this under new labels for consent and feedback.

[rjshanahan]

While Tic:Toc Home Loans agrees that consent should be explicit, there needs to be a mechanism by which the extent of the consent scope is indicated.

Consumers shouldn't be able to obfuscate their banking relationship by excluding some accounts from consent. For example, excluding a credit card when applying for a consumer credit product. This will result in organisations reverting to traditional, 'closed' mechanisms such as scraping and credit bureaus.

A boolean that indicates that accounts have been excluded from the consent would go some way to addressing this.

[JamesMBligh]

Under the CDR authority for sharing derives directly from the customer. Sharing under the regime is not expected to be an implied statement of a full financial profile and more than a manual statement provided voluntarily by a customer would be assumed to be true without attestation and verification.

In direct response to the issue raised by @WestpacOpenBanking, and in light of the recently published ACCC draft rules, the following is assumed by the standards:

• Data holders may (or may not) provide a mechanism for a customer to select the accounts that will be included under the authorisation
• Data holders may (or may not) provide a mechanism for a customer to change this election at a later time
• The customer may lose the right to share a specific account at any point due to changes in access privileges (i.e. for joint accounts or read access to non-owned accounts)
• These elections will be held by the data holder only and will not be communicated to an accredited data recipient. The recipient will have no indication of the existence of an account that is not shared
• The technical standards are silent on the mechanisms for account selection. This is left to the competitive space (although the CX stream may include some guidance)

Hope this helps clarify.

-JB-