Digital channels and the eligibility of CDR consumers

In the banking sector, a CDR consumer is eligible in relation to a particular data holder if the CDR consumer is 18 years of age or older (or is a person who is not an individual); is an account holder or secondary user for an account with a data holder that is open; and has online access to an account with the data holder (see rule 1.10B(1) and clause 2.1 of Schedule 3).

If the CDR consumer is eligible for at least one account, then all other accounts they hold with the data holder - whether or not those other accounts are located on a different digital channel - must also be available for CDR data sharing.

Where the CDR consumer has more than one account with the data holder, there should be a single dashboard for accounts on the same digital channel. However, the data holder may require the CDR consumer to authorise CDR data sharing across separate digital channels in a way that aligns with how the CDR consumer ordinarily interacts with those separate digital channels (as long as this also complies with the rules and any other data holder obligations).[1] This may include requiring the consumer to use separate dashboards for separate digital channels. Data holders should have regard to their obligations in relation to consumer dashboards, including the requirement for dashboards to be simple and straight forward to use (rule 1.15(1)(c)).

Where multiple products are held across multiple digital channels, those products may be held by an individual and a non-individual (e.g. a company). In those circumstances, eligibility is determined separately as the individual and non-individual are separate CDR consumers.

For example:

• Terry is over the age of 18 and uses the following 4 products with Cherry Bank:
  • a personal account on Cherry Bank’s personal digital channel (Cherry Personal) that Terry holds as an individual and can access online
  • a business account (1) on Cherry Bank’s business channel (Cherry Business) that Terry holds as an individual that he cannot access online because he has not set up his online login details for Cherry Business
  • a business account (2) on Cherry Bank’s business channel (Cherry Business) that Terry held as an individual but has been closed for 6 months
  • an agribusiness account on Cherry Bank’s agribusiness channel (Cherry Agribusiness) that is held by a company, Terry’s Tomatoes Pty Ltd, and that Terry as an individual has authority to make transactions on.
• As Terry is over the age of 18 and has at least one account with Cherry Bank that he can access online (the personal account), Terry is eligible in relation to Cherry Bank and therefore, CDR data sharing must be enabled for each of Terry’s accounts that he holds as an individual. However, Cherry Bank may require Terry to authorise CDR data sharing:
  • on his personal account by using Cherry Personal
  • on his business account (1) by using Cherry Business
  • on his business account (2) by using Cherry Business (for the avoidance of doubt, we note that Cherry Bank must enable data sharing in relation to required consumer data for Terry’s business account (2) despite that account being closed).[2]
• As the account held on Cherry Agribusiness is held by the company Terry’s Tomatoes Pty Ltd (which is a non-individual for the purposes of r 1.10B(1)), Cherry Bank must make a separate determination as to whether Terry’s Tomatoes Pty Ltd is an eligible CDR consumer.

[1]       For example, if a data holder provides a consumer dashboard under r 1.15, r 4A.13(2) requires the service referred to in r 4A.13(1) to be contained in that dashboard.

[2] See clause 3.2(5) of schedule 3 to the rules to learn more about required consumer data in relation to closed accounts.