The asymmetry of 'open banking'

OPEN banking, as defined by openbanking.org.uk, is the secure way to give providers access to your financial information. The site states that it "opens the way to new products and services that could help customers and small to medium-sized businesses get a better deal. It could also give you a more detailed understanding of your accounts, and help you find new ways to make the most of your money."

The underlying rational is clear - open up competition; democratise services; and place the customer at the centre. These are prerequisites to digital financial inclusion and will facilitate new opportunities that may not have been accessible before.

Ownership

The open banking process of enabling access to customer financial data hinges upon the explicit consent of the customer. At this point, you may ponder the significance of "explicit consent". Afterall, customer consent has been a standard in the world of finance.

This innocuous requirement of attaining explicit consent, combined with the obligation to then provide access to data has resulted in a truly significant consequence - the unequivocal re-designation of the customer as the true undisputed owner of their financial data. Was this a deliberate outcome or implicit consequence? Probing further, is open banking about finance or is it really, about data?

Customer consent as we knew it, had been a broad oversimplification. It was required for the collection, use and analysis of customer data for an undefined variety of purposes (the scope of which would be decided by the same financial institution collecting, using and analysing the data). Ownership over the data was questionable.

Consequences

Where the underlying objective is data liberalisation and clarity of ownership, herein lies the conundrum. It is only financial institutions which are subject to the requirements of open banking. Third party providers, not designated as financial institutions, do not have to adhere to the same requirements.

In a situation where the financial institution (Party A) is obliged to pass data to a third party provider that is not a financial institution (Party B), Party B is not under an obligation similar to Party A, to pass on the same data which it has received (even when instructed to do so by the customer).

In this case, it is fair to comment that the customer owns the data through Party A and can instruct and compel Party A to pass it on. However, the customer is no longer able to exact the same of Party B in respect of the same data. This begs the question of whether the customer remains the true owner of this data.

Alternatively, if the underlying objective was intended only for financial services, should participation be limited to only those who are subject to the same standards and expectations as financial institutions? If it looks like a duck, squeaks like a duck, walks like a duck, there is a high probability that it will bite like a duck.

Open data

The opening of data marks the dawn of a golden era of opportunity.

Whether the current iteration of open banking reflects a fragmented regulatory environment (and thereby the need for a data regulator) or reflects our genuine inability to ascertain all consequences of data liberalisation, it is certain that the benefit it has brought cannot be discounted. What is clear is our need to learn and improve on its re-iteration.

We have reached a point where data transcends industry (and even geography). Data requirements and obligations must be centred around the customer. The original requirements and obligations applied to customer data should be reflected wherever this customer data resides. As further flux occurs in this area, regulators and providers bear responsibility to customers in providing greater transparency in respect of the implications and limitations of their data ownership and consent.

davidroihardoon.com/blog

READ MORE: Your data, my business: Why data privacy is especially hazardous for startups