Platforms that allow consumers to give access to 3rd parties

[joshuanicholson]

I feel this could be a question for the rules team.

There are several cloud-based FinTech's who are aiming to become an accredited data recipient where consumers will access and utilise their CDR data, obviously this is the objective of the CDR regime. However, these ADR's are platforms in their own right, and consumers can give access to 3rd parties such as Bookkeepers, Accountants, Lawyers, Administrators, Financial Planners, and any range of other professional advisors. My question; does the function of allowing consumers to give access to another party cause an issue for the ADR?

Please note concerning the question above these 3rd parties are not collecting, hosting or controlling the CDR data, merely having a login to 'view' data. There is a subtle but essential difference regarding other ongoing discussions around 3rd party addons/plugins/extensions and intermediaries who are involved in the collection, distribution, receipt and control of CDR data.

[CDR-API-Stream]

Hi @joshuanicholson thanks for this question. It has been referred to the CDR Rules team.

Can you please clarify when you say "3rd party access" do you mean other uses of the ADR software that the consumer gives access to via the ADR application?

In other words, if Mary is the consumer and she connects her online accounting app (the ADR) to her bank, can she give John Smith of ACME Accountants access to her data within the ADR app through a delegated access feature offered by the ADR?

You are not asking if Mary can give John permission to establish a data sharing request directly between John and her bank.

[joshuanicholson]

Thanks for your response @CDR-API-Stream .

When referring to 3rd parties, yes I just mean other "users" or more precisely other people who have a "login" to access the software solution which holds the CDR data and its various derivations.

So yes Mary has given access to her accountant John Smith and he is able to login to help Mary with her quarterly GST reporting (BAS) requirements or to help prepare her annual financial accounts, income tax return etc.

I acknowledge that there are many more scenarios about John having permissions to authorise or act on Mary's behalf, but at this stage that is not my question. The question is purely around John the accountant being able to login to see and work with Mary's CDR data.

[CDR-API-Stream]

This issue may now be resolved with the access arrangements outlined in the draft v3 Rules.

The DSB are now responding to requests for clarification via the CDR support portal. If this question is still applicable, it would be appreciated if you could raise your request there as it will likely be responded to in a more timely fashion and the resulting answer can be turned into an article for others with the same question.