First Reference company logo

Inside Internal Controls

News and discussion on implementing risk management

machine cogs image

Advisory committee on open banking releases report on consumer-directed finance

open banking

On January 31, 2020, the Advisory Committee on Open Banking (the “Committee”) issued its first report (the “Report”) in connection with the Department of Finance Canada’s (“Finance Canada”) consultation process on open banking.

The Report presented the following recommendations and observations:

  • The Report suggested the use of the term “consumer-directed finance” to replace the term “open banking”. The Report suggested that this change in terminology could more meaningfully capture the role of the consumer in an open banking model, and lay the stage for the potential broadening of the concept beyond the banking sector.  This term appears to some extent inspired by Australia’s concept of a “consumer data right”. Indeed, the Report also recommended that “consumer directed finance principles […] be applied to the broader economy.”

However, we would note that the term would appear to be overly narrow as it refers to “consumers” only, and therefore excludes businesses such as small and medium sized businesses.  As noted in the Report, open banking “has the potential to be of particular benefit to small business owners” and therefore perhaps, in our view, a more accurate and inclusive term would be “customer-directed finance” rather than “consumer-directed finance”.

  • The Report summarized the consultation themes and key-takeaways as follows:
     
    • Financial inclusion – “Consumer-directed finance has the potential to deliver greater financial inclusion, but in order to achieve this, government must consider unintended consequences, design for inclusion and ensure that vulnerable consumers are adequately protected.”
       
    • Cybersecurity – “Cyber security best practices and standards should be core to any consideration of how government proceeds, existing frameworks should be leveraged, and industry expertise should be integrated.”
       
    • Privacy – “Privacy and data protection should be at the heart of consumer-directed finance implementation. Existing privacy frameworks may need to be adapted to enable and operationalize consumer-directed finance.”
       
    • Financial stability – “Canada’s financial stability is viewed as a global competitive advantage; any changes should not weaken the existing system’s prudential integrity or the high level of consumer trust in the system. At the same time, further consideration should be given to fostering efficiency and utility.”
       
    • Liability – “All market participants in the ecosystem must be responsible for securing and protecting consumer data, following the general principle that liability should rest with the party at fault. For consumers, there must be a clear process by which issues are resolved and redress provided.”
       
    • Technical standards – “Technical standards should be market-based and industry-led, but consistent with government objectives.”
       
  • The Report recommended the development of a “robust consumer-directed framework” to “support a more innovative and competitive sector by setting rules and protections around data use, and requiring data to be transferred in more secure form”. The Report noted that Canadians are already taking part in data aggregation and data sharing, notwithstanding the lack of existing framework, and that there is a pressing need to have in place a more secure, reliable way to do so, with the Report stating “the Committee is of the view that the risks in-market today need to be addressed expeditiously”.  The Report did not however provide details on the scope or nature of such framework.
  • The Report acknowledged that “privacy and security risks are present in the marketplace today and are currently unaddressed in a screen-scraping environment” and supported the adoption of a market framework to set ground rules and protections to address those risks. The Report noted that there was broad agreement among stakeholders that an accreditation system to admit service providers into the ecosystem could be an appropriate way to manage and address privacy and security risks.  According to the Report, an accreditation system could require participants to meet minimum standards and could be subject to the oversight of either a regulator or an independent expert body.  The need for strong processes to authorize and identify consumers to ensure the security of the system and prevent financial crimes was also highlighted.
  • The Report identified opportunities to modernize the existing privacy framework, including the consent process. The Report posits that consumer-directed finance would rest on a process to establish meaningful, opt-in consent by consumers when they direct their bank to share information with other participants. The consent process could be enhanced by:
    • clearly defining what consumers are agreeing to, and what the implications are of that agreement, in plain language;
    • providing a level of control over what data could be shared with what party, for what purposes and for how long;
    • providing control over cancellation of permissions at any point by the consumer; and
    • being accountable to and traceable for consumers.
  • The Report recommended that the approach taken by the Government of Canada recognize the following three high level principles:
    • Providing for consumer choice and meaningful control by consumers;
    • Engendering consumer confidence and trust and reflecting a respect for privacy and security, and providing clear mechanisms for accountability and liability for loss; and
    • Fostering innovation and “the growth of a vibrant financial ecosystem”.
  • In addition, the Report noted the importance of ensuring interoperability of any technological solution, both domestically and internationally. In particular, the Report noted “there was strong support for examining technical standards currently in use in other jurisdictions and adapting them for use in Canada.”
  • The Report recommended a collaborative approach between government and industry in respect of open banking. The Report recommended engaging and collaborating with a broad range of industry players as well as regulators engaged in parallel initiatives, to ensure alignment, including initiatives relating to “payments modernization, updates to privacy frameworks, consideration of digital identity and the Department of Innovation, Science and Economic Development’s digital and data initiatives”, such as Canada’s Digital Charter. 
  • The Report recommended that the Government of Canada “announce a bold, clear and concrete timeline for delivering consumer-directed finance” and suggested based on the experience of other jurisdictions a timeline of one to two years.

Next steps

The Report also stated that Finance Canada and the Committee now “intend to explore in greater depth some of the themes raised by stakeholders in the context of the roundtables, among them: liability, accreditation, governance, the question of how screen-scraping should be dealt with and how to build an ecosystem that is accessible to all participants”, with the aim of having Finance Canada then deliver a white paper setting forth a proposed framework for industry consultation and commentary. 

By Ana Badour and Christine Ing

Follow us

McCarthy Tétrault LLP

McCarthy Tétrault is a Canadian law firm that delivers integrated business law, litigation services, tax law, real property law, labour and employment law nationally and globally.McCarthy publishes a series of blogs to share information with companies to help them comply and manage their businesses. On the Inside Internal Controls blog we will share some of those blog posts sharing their expertise among others, in the areas of Competition/Anti-trust, Corporate and Commercial Law, Intellectual Property, Privacy, Environmental Law, Technology and Litigation. Read more here
Follow us

, , , ,

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.