[ARCHIVE] Sharing account data for businesses

23/08/2022: This article has been archived. For Nominated Representative guidance please refer to the publication here: Nominated representatives, non-individuals, and
partnerships in the CDR

Question

It is not simple to identify ‘owners’ of business accounts. Typically, financial institutions would set up owners to have a ‘signatory’ relationship to the business account. So, they cannot differentiate the ‘owners’ from other parties, e.g. employees who are also authorised to transact on the account. Even for a sole-trader, they would typically setup the owner to have a ‘signatory’ relationship to the account, rather than an ‘owner’ relationship.

So, for business accounts with only ‘signatory’ relationships, is the financial institution still obligated to share the account data?

Are the current rules intended to allow business accounts to be shared if they are singly-owned or jointly-owned? Is the ACCC planning to revise the rules for sharing business account data in future?

Similarly, some 'sole trader' accounts are not 'simple', i.e. they are configured with multiple parties authorised to transact on the account, so we cannot identify which of these individuals is the 'sole trader' without the functionality for 'Nominated Representatives'. Is this type of account in scope for the 'Nominated Representives' logic (mandated for 1 November 2022 for non-major ADIs)?

For example, a person is a 'sole trader' with a business account, however, their spouse is also authorised to transact on the account. Because there is more than 1 person authorised to transact on this account, we cannot identify which of these 2 individuals is the account holder.

So, for 1 July 2021, a business could allow sharing for business accounts where 1 individual is authorised to transact, since we can assume this individual is the sole trader. But, if there is more than 1 individual authorised to transact on this business account, this would not be shareable until the business implements the logic for Nominated Representatives for 1 November 2022.

Would this meet the obligations for non-major ADIs?

Answer

Yes, under the current rules, a person is eligible to share CDR data from an account if they are:

(a) an individual who is 18 years of age or older, and

(b) the account holder.

(See Schedule 3, Part 2, which also contains a few other eligibility conditions). 

It is correct that data must be shared from accounts held by an individual, or jointly with one other individual (Schedule 3, clause 3.2). 

The ACCC therefore expects that for business consumers who are individuals, accounts falling within the scope of these provisions would be enabled for sharing in accordance with the current rules.  For example, an account held by an individual who was a sole trader would be within scope, and should be enabled for sharing.

The ACCC recently consulted on revised rules to enable sharing by more business consumers, including non-individual consumers (such as bodies corporate) and more complex business partnerships. This also contains information about implementation issues relating to accounts held jointly by two individuals for business purposes, which may be useful.

The intention of the proposed rules is to provide a route for business customers to nominate, to their data holder(s), one or more representatives with authority to share CDR data. The ACCC is now considering the responses we received and will make a decision about whether to revise the rules in due course.

From 1 July 2021, non-major ADIs will be required to enable consumer data sharing for eligible CDR consumers. Under the rules, these are individuals aged 18 or older, who hold an account with the data holder that is open and set up in such a way that it can be accessed online. This means accounts held by a sole trader who is an individual should be enabled for consumer data sharing.

However, where an account is held by a non-individual (including a sole trader business, if the business rather than an individual is the account holder), it would be acceptable for the data holder to enable consumer data sharing for these accounts under the nominated representatives rules. For the non-majors, these rules commence on 1 November 2022.