Special rules apply in relation to consumer data requests under Part 4 of these rules under which there is a request for disclosure of CDR data that relates to one or more joint accounts within the banking sector. This Part sets out those rules.
4.2 Application of Part
Note: This Part does not apply to all joint accounts with data holders. This clause sets out the joint accounts to which this Part applies.
This Part applies to a joint account with a data holder if all joint account holders are eligible in relation to the data holder.
Note: See subrule 1.7(1) for the meaning of “eligible”. For the banking sector, see clause 2.1 of this Schedule for when a CDR consumer is eligible.
4.3 Simplified outline of this Part
This Part does not apply to all joint accounts in the banking sector. Division 4.1 of this Part sets out, among other things, the joint accounts to which this Part applies.
CDR data that relates to a joint account to which this Part applies can be disclosed under these rules only if, among other things, an available disclosure option applies to the account. Division 4.2 of this Part sets out:
• what the available disclosure options are; and
• an obligation for data holders to provide a service (a joint account management service) for all joint accounts to which this Part applies through which joint account holders can indicate the disclosure option they would like to apply to the account; and
• when one joint account holder selects a disclosure option to apply to a joint account―a process by which the other joint account holders can select a disclosure option to apply; and
• some associated notification requirements.
All joint account holders must indicate that they would like the same disclosure option to apply to the joint account in order for the disclosure option to apply.
When an accredited person makes a consumer data request under Part 4 of these rules on behalf of a CDR consumer, and the request includes CDR data relating to one or more joint accounts of which the CDR consumer is a joint account holder, Division 4.3 deals with how the request is processed.
Division 4.3 also deals with how requests are processed when the accredited person makes a consumer data request on behalf of a secondary user of the joint account.
Division 4.2—Disclosure options, joint account management service and notification requirements
4.4 Simplified outline of this Division
This Division sets out the disclosure options that can apply to a joint account. These disclosure options are relevant when an accredited person makes a consumer data request on behalf of one joint account holder or a secondary user under Part 4 of these rules.
One is a pre‑approval option. If all joint account holders indicate that they would like a pre‑approval option to apply to a joint account, CDR data relating to the joint account can be disclosed in response to the request without the approval of the other account holder, but the other account holders can revoke the pre‑approval in relation to a particular consumer data request at any time.
Another is a co‑approval option. If all joint account holders indicate that they would like a co‑approval option to apply to a joint account, CDR data relating to the joint account can be disclosed under these rules only with the approval of the all the account holders.
Data holders must offer pre‑approval options on joint accounts, and may offer co‑approval options.
Neither disclosure option applies to a joint account if:
• the joint account holders indicate that they would like different disclosure options to apply to the account; or
• any of the joint account holders do not indicate a disclosure option they would like to apply.
For each joint account to which this Part applies, a data holder must offer a joint account management service that can be used by joint account holders to select and manage these disclosure options.
4.5 Disclosure options that can apply to joint accounts
(1) For this Part, a pre‑approval option applies to a joint account at a particular time if, at that time:
(a) all joint account holders have indicated that they would like that disclosure option to apply to the account; and
(b) none has indicated that they no longer want that disclosure option to apply.
(2) For this Part, a co‑approval option applies to a joint account at a particular time if, at that time:
(a) that disclosure option is offered on the account; and
(b) all joint account holders have indicated that they would like that disclosure option to apply to the account; and
(c) none has indicated that they no longer want that disclosure option to apply.
(3) For this Part, a disclosure option applies to a joint account if a pre‑approval option or a co‑approval option applies to the joint account.
4.6 Obligation to provide joint account management service
Obligation to provide joint account management service
(1) For each joint account to which this Part applies, the data holder must provide a service to each joint account holder that:
(a) allows the joint account holder to indicate whether they would like:
(i) the pre‑approval option to apply; or
(ii) if offered by the data holder―the co‑approval option to apply; and
(b) allows the joint account holder to indicate whether they would like a different disclosure option, or no disclosure option, to apply; and
(c) complies with this clause.
Note 1: This subclause is a civil penalty provision (see rule 9.8).
Note 2: All joint account holders must indicate that they would like the same disclosure option to apply in order for the disclosure option to apply to the joint account: see subclauses 4.5(1) and (2) of this Schedule.
(2) Such a service is a joint account management service.
Requirements for joint account management service
(3) The service must be provided online and, if there is a data holder’s consumer dashboard for a joint account holder, may be included in the dashboard.
(4) The service may, but need not, also be provided other than online.
(5) The service must give effect to a disclosure option applying or no longer applying as soon as practicable.
(6) The service must not, when allowing joint account holders to indicate which disclosure option they would like to apply, do any of the following:
(a) add any requirements to the process beyond those specified in the data standards and these rules;
(b) offer additional or alternative services as part of the process;
(c) include or refer to other documents, or provide any other information, so as to reduce comprehensibility;
(d) offer any pre‑selected options.
(7) The service must, when allowing a joint account holder to indicate which disclosure option they would like to apply, notify them:
(a) of the following information about each disclosure option offered using the service:
(i) what the effect of the disclosure option applying is;
(ii) that they can indicate at any time that they would no longer like the disclosure option to apply;
(iii) how they can indicate this;
(iv) what the effect of indicating this is;
(v) how the disclosure option operates if there is a secondary user for the joint account; and
(b) if more than one disclosure option is available―of the difference between the available disclosure options; and
(c) that, if joint account holders do not indicate that they would like the same disclosure option to apply to the joint account, disclosure of joint account data relating to the account will ordinarily not be authorised under these rules; and
(d) that when CDR data relating to the joint account is disclosed under these rules, the data holder will ordinarily provide each joint account holder and, if applicable, each secondary user, with a consumer dashboard through which they will be able to see information about the disclosure.
(8) The service must be in accordance with the data standards.
4.7 Asking other joint account holders to indicate disclosure option for joint account
Application of clause
(1) This clause applies in relation to a particular joint account to which this Part applies if a joint account holder (account holder A) indicates, using the joint account management service, that they would like:
(a) if no disclosure option applies to the account―a particular disclosure option to apply; or
(b) if a disclosure option applies to the account―a different, or no, disclosure option to apply.
Obligation to invite other account holders to indicate disclosure option
(2) The data holder must, through its ordinary methods for contacting the other joint account holders:
(a) explain to each of them what the consumer data right is; and
(b) inform them that account holder A has indicated that they would like the disclosure option referred to in subclause (1), or no disclosure option, to apply to the account, as applicable; and
(c) inform them that, at present, no disclosure option applies to the account; and
(d) explain to them that no disclosure option will apply to the account unless all account holders have indicated that they would like the same disclosure option to apply; and
(e) if account holder A selected a particular disclosure option―invite them to indicate that they would like the same disclosure option as indicated by account holder A to apply to the account; and
(f) if account holder A gave an indication pursuant to clause 4.10 of this Schedule—identify the accredited person.
Division 4.3—Consumer data requests that relate to joint accounts
Subdivision 4.3.1—Preliminary
4.8 Application of Division
(1) This Division applies in relation to a consumer data request to a data holder under Part 4 of these rules that is for disclosure of any of the following CDR data in relation to a particular joint account to which this Part applies:
(a) account data in relation to the joint account;
(b) transaction data in relation to the joint account;
(c) product specific data in relation to a product that a joint account holder uses and that relates to the joint account.
(2) This Division applies whether or not the request is also for disclosure of other CDR data.
(3) If a particular consumer data request to a data holder under Part 4 of these rules relates to more than one joint account to which this Part applies, this Division applies separately in relation to each such joint account.
4.9 Interpretation
For this Division:
(a) the requester is the person on whose behalf the consumer data request referred to in clause 4.8 was made; and
(b) the relevant account holders are:
(i) if the requester is a secondary user―all joint account holders; and
(ii) if the requester is a joint account holder―the other joint account holders; and
(c) joint account data is the CDR data that is referred to in subrule 4.8(1) of this Schedule that was the subject of the request.
Subdivision 4.3.2—How consumer data requests to data holders under Part 4 of these rules that relate to joint accounts are handled
4.10 Asking requesting account holder to indicate disclosure option for joint account
(a) the requester is a joint account holder; and
(b) a data holder asks the requester to authorise disclosure in accordance with Division 4.4 of these rules; and
(c) the requester has not indicated which disclosure option they would like to apply to the account.
(2) The data holder must also ask the requester to indicate:
(a) through the joint account management service; and
(b) in accordance with the data standards;
the disclosure option they would like to apply to the account.
Note 1: This subclause is a civil penalty provision (see rule 9.8).
Note 2: The disclosure option will not apply to the account unless the relevant account holders indicate that they would like the same disclosure option to apply.
Note 3: If the requester indicates a disclosure option that they would like to apply to the joint account, the data holder would then need to ask the relevant account holders to indicate which disclosure option they would like to apply to the joint account in accordance with clause 4.7 of this Schedule.
Note 4: See paragraph 4.16(1)(b) of this Schedule for a similar requirement in the case that the requester is a secondary user of the joint account.
4.11 Asking relevant account holders for approval to disclose joint account data
(a) the requester has authorised, under Division 4.4 of these rules, the disclosure of the joint account data; and
(b) a co‑approval option applies to the joint account.
(2) The data holder must, through its ordinary methods for contacting the relevant account holders:
(a) indicate that an accredited person has requested disclosure of CDR data that relates to the joint account on behalf of the requester; and
(b) outline the matters referred to in subclause (1); and
(c) indicate the matters referred to in paragraphs 4.23(a), (b), (c), (d) and (e) of these rules so far as they relate to the request; and
(d) ask the relevant account holders whether they approve the joint account data being disclosed; and
(e) indicate the time by which the data holder needs the relevant account holders to give this approval; and
(f) inform them that any one of them may, at any time, remove the approval; and
(g) provide them with instructions for how to remove the approval; and
(h) indicate what the effect of removing the approval would be.
Note: For removal of an approval, see clause 4.14 of this Schedule.
4.12 Continuation and removal of approvals
(1) Any relevant account holder may remove an approval given under this Division at any time (regardless of whether the approval was given expressly under a co‑approval option or whether a pre‑approval option applies).
(2) If each relevant account holder approves of the disclosure in accordance with this Division, the approval is taken to apply while the authorisation referred to in paragraph 4.11(1)(a) of this Schedule is current, unless removed sooner in accordance with this Division.
4.13 Joint account data the data holder is authorised to disclose
(1) For paragraph 4.6A(2) of these rules, the data holder must not disclose joint account data to the accredited person unless:
(a) the requester has authorised the data holder to disclose that CDR data under Division 4.4 of these rules; and
(b) subclause (2), (3) or (4) applies.
Pre‑approval option
(2) This subclause applies if:
(a) a pre‑approval option applies to the joint account; and
(b) no relevant account holder has removed the approval using its consumer dashboard.
Co‑approval option
(3) This subclause applies if:
(a) a co‑approval option applies to the joint account; and
(b) for each relevant account holder, either:
(i) the relevant account holder approved the disclosure in accordance with clause 4.11 of this Schedule within the time frame referred to in paragraph 4.11(2)(e) of this Schedule and has not removed the approval using their consumer dashboard; or
(ii) the data holder considers it necessary to avoid seeking the approval of the relevant account holder in order to prevent physical or financial harm or abuse.
Note: Data holders are required to offer the disclosure option referred to in subclause (2). Data holders may, but are not required to, offer the disclosure option referred to in subclause (3). See subclause 4.6(1) of this Schedule.
No disclosure option applies but circumstances of physical or financial harm or abuse might exist
(4) This subclause applies if:
(a) no disclosure option applies to the joint account; and
(b) the data holder considers it necessary to avoid inviting at least one of the relevant account holders to choose a disclosure option in order to prevent physical or financial harm or abuse.
4.14 Consumer dashboard for relevant account holders
Obligation for data holder to provide relevant account holders with consumer dashboard
(1) If a disclosure option applies or has applied to the joint account, the data holder must ensure that each relevant account holder has an online service that:
(a) if a disclosure option applies to the account―can be used by the relevant account holders to manage approvals to disclose CDR data in response to consumer data requests under Part 4 of these rules for CDR in relation to the joint account; and
(b) contains the details referred to in paragraph 1.15(1)(b) of these rules that relate to requests for CDR data under Part 4 of these rules in relation to the joint account; and
(c) if a disclosure option applies to the account―has the functionality referred to in paragraph 1.15(1)(c) of these rules, as if:
(i) references in that paragraph to authorisations were instead references to approvals; and
(ii) references in that paragraph to withdrawals were instead references to removals.
(2) Such a service is the data holder’s consumer dashboard for the relevant account holder.
(3) A data holder does not contravene subrule (1) in relation to subparagraphs 1.15(1)(c)(ii) and (iii) of these rules as referenced by paragraph (1)(c) so long as it takes reasonable steps to ensure that the functionality complies with those subparagraphs.
Exception in the case of physical or financial harm or abuse
(4) Despite this clause and clause 4.15 of this Schedule, the data holder may decline:
(a) to provide a relevant account holder with a consumer dashboard; or
(b) if a relevant account holder already has a consumer dashboard―to reflect details of the request relating to the joint account in their dashboard;
if it considers it necessary to do either in order to prevent physical or financial harm or abuse.
4.15 Consumer dashboard for the requester
For paragraph 1.15(1)(d) of these rules, if a relevant account holder’s consumer dashboard contains details of approvals under clause 4.14 of this Schedule, the dashboards of the other joint account holders must contain those details.
4.16 Notification requirements for consumer data requests on joint accounts
(1) If the requester gives, amends or withdraws an authorisation, or if an authorisation expires, the data holder must:
(a) as soon as practicable, notify each relevant account holder through its ordinary means of contacting them; and
(b) if:
(i) the requester is a secondary user of the joint account; and
(ii) no disclosure option applies to the joint account;
ask the relevant account holders to indicate which disclosure option they would like to apply to the account:
(iii) through the joint account management service; and
(iv) in accordance with the data standards; and
(c) if a co‑approval option applies to the account―in the case of an amendment, include in the notification:
(i) the nature of the amendment; and
(ii) how they can remove an approval to prevent further CDR data relating to the joint account being disclosed under these rules.
(2) If a relevant account holder:
(a) using their consumer dashboard, gives or removes an approval; or
(b) does not provide an approval within the time frame referred to in paragraph 4.11(2)(e) of this Schedule;
the data holder must notify the requester and any other relevant account holder through its ordinary means of contacting them.
(3) However, a notification to a particular account holder under this clause is not required if the data holder considers it necessary to avoid notifying that account holder in order to prevent physical or financial harm or abuse.