Open Banking - frequently asked questions

A data holder is an organisation, such as People First Bank, which holds data about consumers e.g. account information. Customers need to authorise us before we can share their data with an accredited data recipient. 

A data holder can also be an accredited data recipient. 

An accredited data recipient is an organisation that has been accredited under the Consumer Data Right to provide a service and receive information on behalf of the consumer. After receiving consent from the consumer, the accredited data recipient can ask for information from a data holder for a specific purpose and time period. One example of an accredited data recipient is an organisation offering the streamlining of finance applications or budgeting tools. 

You will have access to a data sharing dashboard, where you will be able to manage all the details of your data sharing consents. You can access your data sharing dashboard through your Digital Banking account, by clicking the ‘More’ button (three dots) in the main menu, and selecting ‘Open banking’. This will redirect you to your data sharing dashboard. 
 
Your data sharing dashboard, will enable you to review the consents you’ve given to accredited data recipients and withdraw your authorisation for us to share your data. 

Consumer Data Right is regulated by the Australian Competition and Consumer Commission (ACCC), the Office of the Australian Information Commission (OAIC) and the Data Standards Body. 
 
The ACCC enforces the rules, provides accreditations and monitors compliance. The OAIC will lead on matters relating to the protection of individual and small business consumer privacy and confidentiality and compliance with the CDR Privacy Safeguard Guidelines. The Data Standards Body develops the standards that prescribe how data is shared within the system. 
 
CDR privacy safeguards — OAIC 
CDR privacy and security — OAIC 

The data that you can share includes: 

• Customer data 
• Account data 
• Transaction data
• Product data 

The only difference between the consents process for a joint account is that all owners of the account will receive an SMS notification to advise of the authorisation to share. The initiating customer (Customer A) will receive an SMS to confirm they’ve agreed to share data, and joint account holder (Customer B) will receive an SMS notification to confirm that Customer A has authorised us to share data on the joint account. 

All joint accounts will be set to pre-approved by default (this means data on the account is available for sharing). You can change the sharing permission of your joint accounts by selecting the Accounts icon at the bottom banner in your data sharing dashboard and selecting the joint account/s to change sharing permission from 'Pre-approved' to 'Do not share'.

If a joint account holder requests the sharing permission of the joint account to be changed from ‘Do not share’, to ‘Pre-approved’, we will ask the other joint account holders if they would like to approve the change. If all joint account holders have not approved the change within 30 days of the request, the joint account will remain on the ‘Do not share’ permission. If all other account holders approve the request within 30 days, the sharing permission on the joint account will be changed to ‘Pre-approved'.

Information about data sharing on your accounts, is set out in your data sharing dashboard, located in Online Banking. 

Each joint account holder has the option to turn notifications on/off via their data sharing dashboard. It’s also possible to change the frequency of notifications by going to the Settings icon on your data sharing dashboard. This will only change the frequency for you and will not affect the frequency of notifications for the other joint account holders. 

There may be times where your situation has changed or the details you have with us may need updating. You can check your data sharing dashboard to see what consents are active and those that have expired, or you can send us a message via the App or Online Banking, or call us on 13 11 82. 

The data sharing dashboard allows you to securely view, withdraw and modify your current and historical data sharing arrangements. You can access the Open Banking dashboard through a link in your Online Banking account. Your mobile number will need to be correct for you to access your data sharing dashboard. 

You can withdraw any authorisation to share on your individual or joint accounts via your data sharing dashboard by selecting Stop sharing. This will mean that no further data will be shared to the Accredited Data Recipient from this consent. Alternatively, to withdraw your consent you can contact People First Bank by sending a message within Digital Banking or by visiting a branch or calling us on 13 11 82.

A consent can only be withdrawn with the relevant accredited data recipient by the individual who created it. If withdrawn, the consent will no longer be active and will only appear in archived consents on your data sharing dashboard.

When you authorise us to share your data, you will have two options - you can choose to share data on a single occasion or for an ongoing period (maximum of 12 months). However, when you no longer wish to share the data, you can withdraw your sharing arrangement by either contacting the third party you initially started the process with (the accredited data recipient) or you can withdraw your authorisation to share by using your data sharing dashboard, which can be found via Digital Banking. 

Once you have completed the last step of the authorisation process you will be sent an SMS confirmation. You can also access a PDF receipt via your data sharing dashboard. Your data sharing dashboard can be viewed through your Digital Banking account. Simply click on the Open Banking link, under the ‘More’ button (three dots) in the main menu.

Yes, but only if you elected to share your data for longer than 24 hours and that period has not expired (i.e. the consent is still 'Active'). You can contact the third party you started the process with (the accredited data recipient) to amend your existing data sharing arrangement.  

No. You will need to complete the consent process again with the accredited data recipient that you want to share data with.  

If you decide to withdraw your data sharing arrangement, you can contact the third party you started the process with (the accredited data recipient) and request they delete your data from their records.  

People First Bank is a data holder under the Consumer Data Right (Open Banking). We are not currently an accredited data recipient but may apply to become accredited in the future. If we decide to do this, we’ll communicate this to our customers. 
 
To become an accredited data recipient, it’s necessary to satisfy strict requirements and specific security standards, which ensure the ongoing security of your data. 
 
To remain an accredited data recipient, it’s necessary to maintain accreditation by complying with a number of ongoing obligations. An accredited data recipient can also be a data holder. 

A secondary user is an authorised signatory or power of attorney. 

To share data, a secondary user must be enabled by the account holder. This can be done through Online Banking. 

You can access Secondary user permissions via the ‘Settings’ menu of the data sharing dashboard by selecting Secondary user permission. Here you can view, enable, or disable the data sharing privileges of a Secondary user. 

All Secondary users are set to ‘Disable’ sharing status by default. The account holder will need to enable sharing privileges for a secondary user to share data. 

You can access a Secondary user via the ‘Settings’ menu of the data sharing dashboard by selecting Secondary user permission, here you can enable or disable sharing privileges of a Secondary user. 

Yes, as the account holder you have full control of the data being shared.

To enable or disable, enter the data sharing dashboard and click on Manage next to the consent you’d like to change, move the toggle to either disable or enable to control the data being shared.

Please note if you disable the account, this will stop the sharing of data from that account while keeping the consent active, any additional accounts within the consent will continue to share as long as they are enabled. 

When a Signatory or Power of Attorney is removed from an account and they were also be removed from the account as a Secondary User. 

Unexpired data sharing arrangements initiated by them will continue to be active, but data from the account from which they have been removed will no longer be shared with the Accredited Data Recipient. 

A Nominated Representative is a person who has been enabled by the Business Representative (Business Signatory) via the Consumer Dashboard within Online Banking to share data on their business accounts. These users are also required to meet eligibility criteria. 

Access the list of Nominated representatives via the ‘Settings’ menu of the data sharing dashboard by selecting Nominated representative. 
 
Here you can enable or disable Nominated representatives if you are a Business representative (Business Account holder) on the account. This functionality allows the Business representative to select who they would like to grant data sharing access to. 

Both Business representatives and Nominated representatives can enable or disable sharing on an account within a consent created by another Nominated representative. 
 
To disable, enter the data sharing dashboard and click on manage next to the consent you’d like to change, move the toggle to disable to stop the data being shared with the Accredited Data recipient. 
 
To enable, move the toggle to enable to allow data to flow to the Accredited Data recipient. Please note if you disable the account, this will stop the sharing of data with the Accredited Data Recipient while keeping the consent active which will ensure any additional accounts within the consent will continue to share as long as they are enabled. 
 
Only the Business representative or the Nominated representative that created the consent can fully withdraw the consent.