Privacy - Data Security ‘Impersonation’ methods. There are understood to be 2 primary technical means used to enable leveraging internet banking access to obtain transaction, account and other data and … there are varying views on which mechanism is ‘safer’. Directly obtaining the User ID and Password from the individual using that information to obtain the data and storing those access details on a central server. – There is suggestion that these servers are but unless hacking them is totally impossible there is a risk. The AFP, the FBI, MI6 and other institutions ‘safe’ thought to be highly secure have all been compromised. It is seems reasonable to think that the servers of data in spite of best efforts are ‘alternate gatherers’ still not ‘risk free’. Currently Yodlee, their and others utilise this approach. ‘on-sellers’, Of specific note, in the FinTech Australia submission to Treasury, Yodlee is understood to have authored the section relating to this topic (Open Financial Data) and in that section they recommend is inconsistent with their current practice, however is consistent with the Secure ‘open ADIs’…which interestingly Courier method of data exchange. Via a downloaded APP using data User ID and Password from the individual that is keyed into the APP obtain the data. Here the User ID and Password – from the individual is not saved centrally. Unlike the centralised server model mobile devices hold large numbers of User IDs and Passwords, however they are frequently lost and don’t to the individual whose data is then will matter little that they are not among a larger group. compromised….and lost…it Currently, this is the approach used by Mogo and their on-sellers. Assuming that under either model there is a risk, then there could be a loss related to that risk, which the leads to a question as to how is liable for the loss. Loss Liability - E-Payments Code / Trade Practices Act / Terms and Conditions If the credit provider requests (or entices) the individual to use one of these services and there is a loss, who is liable? E-Payments Code Who is liable if, related to enabling the accessing of the alternative data, a loss was incurred? It is near universal that the T&Cs of a internet banking make clear that the sharing of user IDs and Passwords will cause the customer to customer’s be liable in the event of a loss.
Privacy - Data Security ‘Impersonation’ methods. There are understood to be 2 primary technical means used to enable leveraging internet banking access to obtain transaction, account and other data … and there are varying views on which mechanism is ‘safer’. Directly obtaining the User ID and Password from the individual – using that information to obtain the data and storing those access details on a central server. There is suggestion that these servers are ‘safe’ but unless hacking them is totally impossible there is a risk. The AFP, the FBI, MI6 and other institutions thought to be highly secure have all been compromised. It is seems reasonable to think that the servers of ‘alternate data gatherers’ in spite of best efforts are still not ‘risk free’. Currently Yodlee, their ‘on-sellers’, and others utilise this approach. Of specific note, in the FinTech Australia submission to Treasury, Yodlee is understood to have authored the section relating to this topic (Open Financial Data) and in that section they recommend ‘open ADIs’…which interestingly is inconsistent with their current practice, however is consistent with the Secure Courier method of data exchange. Via a downloaded APP – using data User ID and Password from the individual that is keyed into the APP obtain the data. Here the User ID and Password from the individual is not saved centrally. Unlike the centralised server model mobile devices don’t hold large numbers of User IDs and Passwords, however they are frequently lost and compromised….and to the individual whose data is then lost…it will matter little that they are not among a larger group. Currently, this is the approach used by Mogo and their on-sellers. Assuming that under either model there is a risk, then there could be a loss related to that risk, which the leads to a question as to how is liable for the loss. Loss Liability - E-Payments Code / Trade Practices Act / Terms and Conditions If the credit provider requests (or entices) the individual to use one of these services and there is a loss, who is liable? E-Payments Code Who is liable if, related to enabling the accessing of the alternative data, a loss was incurred? It is near universal that the T&Cs of a customer’s internet banking make clear that the sharing of user IDs and Passwords will cause the customer to be liable in the event of a loss.
sub135-data-access.docx