Blocked or suspended accounts and temporarily locked accounts: consumer eligibility and refusals to disclose data

This article was updated on 10 April 2024 to clarify that a CDR consumer who is temporarily unable to access their account online remains an eligible CDR consumer and their relevant account is not blocked or suspended under the CDR Rules. 

Blocked or suspended accounts

Rules 3.5 and 4.7 state that a data holder may refuse to disclose required consumer data in relation to a CDR consumer’s account that is blocked or suspended. We consider this only applies to an account that has been permanently or temporarily disabled because it is not operative or usable. In these circumstances, the data holder must keep and maintain records of the relevant refusals in accordance with rule 9.3 and report on these refusals in accordance with rule 9.4.

A blocked or suspended account will not cause a CDR consumer to be ineligible in relation to a data holder. This means that authorisations do not expire and disclosures that had stopped under rules 3.5 and 4.7 may continue once the account is no longer blocked or suspended. Data holders have discretion as to how they block or suspend an account.

Temporarily locked accounts

If a CDR consumer is temporarily unable to access their account online (for example due to a number of failed login attempts or a forgotten password), we consider that only the consumer’s access to the account has been disabled, while the relevant account remains operative and usable.

For example, a consumer in the banking sector who is temporarily unable to access their account online due to several failed login attempts, can still use their account in many ways, like using a debit card. Third parties can also access the relevant account by making debits from or payments to the account. As such, we consider that the temporarily locked account is still operative and therefore, not blocked or suspended under the CDR Rules.

A CDR consumer who is temporarily unable to log into their account online, remains an eligible CDR consumer because their account is still technically set up, or designed to be accessible online. Therefore, authorisations do not expire merely because a CDR consumer’s account has been temporarily locked. Data should continue to be shared in relation to a valid consent even if a consumer is temporarily unable to log into their account online.

Closed accounts

In contrast, a closed account may cause a CDR consumer to be ineligible in relation to a data holder if the CDR consumer has no other accounts with the data holder that satisfy the eligibility criteria in rule 1.10B and additional sector-specific requirements for eligibility (see e.g. clause 2.1 of schedule 3).