Data holder dashboard first share date for joint accounts

Question

In the article Data holder dashboards – disclosure on consent, the guidance is that the term 'When the CDR data was disclosed' refers to the first time that a specific data cluster was disclosed to the Acredited Data Recipient (ADR), and the expected date of the final disclosure (the authorisation's expiry date).

Consider a scenario where the data sharing arrangement includes accounts in an individual name, and also a joint account where pre-approval disclosure preference was selected during 'in-flow election' and the other joint account holder selected their pre-approval disclosure preference later in JAMS.

In this case, the joint account would have a different first share date to the other accounts being shared. Is it a requirement to show the specific date where the joint account data was first shared for each data cluster? If so, will there be CX guidelines to support this requirement?

Answer

Yes, the joint account disclosure date may be different to the individual account disclosure date.

The data cluster shared from the joint account is different to the data cluster shared from the individual account. It is shared at a different time on a different account, with some similar content and possibly with some different content. 

Consequently the date for disclosure on the joint account may differ from the date on the individual account.

For the full set of requirements for a joint account holder’s dashboard, see CDR Rules, Schedule 3, Part 4 Joint Accounts, Subdivision 4.3.2, 4.14 Consumer dashboard for relevant account holders.

The official response of the OAIC on this issue is included below.

DHs are required to show the specific disclosure date for joint accounts for each data cluster.

The DH needs to indicate 'when the CDR data was disclosed' in relation to the data cluster for that consumer, irrespective of which account the data was disclosed from.

For joint accounts, this means Account Holder B (AH-B) may see a different first disclosure date to Account Holder A (AH-A). This is because data from their shared joint account(s) may be disclosed at a later date to AH-A's individual account(s). AH-B would not see the first disclosure date of data associated with AH-A's individual account(s).

CX Guidelines, Dashboards, provides an example of how to comply with rule 7.9 and privacy safeguard 10. This example would only need to be adjusted slightly for AH-B in the above scenario.

See CDR Rules, Schedule 3, Part 4 Joint Accounts, Subdivision 4.3.2, 4.14 Consumer dashboard, for the full set of requirements for a joint account holder’s dashboard.