What’s a data holder?

You can share data from:

• Transaction accounts
• Savings accounts
• Term deposits
• Credit card accounts
• Residential home loans
• Investment property loans
• Mortgage offset accounts
• Personal loans 
• Business finance
• Investment loans
• Lines of credit (business)
• Trust accounts

A data holder is an organisation, such as People’s Choice, which holds data about consumers e.g. account information. Members need to authorise us before we can share their data with an accredited data recipient.

A data holder can also be an accredited data recipient.

An accredited data recipient is an organisation that has been accredited under the Consumer Data Right to provide a service and receive information on behalf of the consumer. After receiving consent from the consumer, the accredited data recipient can ask for information from a data holder for a specific purpose and time period. One example of an accredited data recipient is an organisation offering the streamlining of finance applications or budgeting tools.

You will have access to a data sharing dashboard, where you will be able to manage all the details of your authorisations for your data sharing consents. You can access your data sharing dashboard via your Internet Banking login, by clicking on the Open Banking icon. This will redirect you to your data sharing dashboard.

Your data sharing dashboard, will enable you to review the consents you’ve given to accredited data recipients and withdraw your authorisation for us to share your data.

Consumer Data Right is regulated by the Australian Competition and Consumer Commission (ACCC), the Office of the Australian Information Commission (OAIC) and the Data Standards Body.

The ACCC enforces the rules, provides accreditations and monitors compliance. The OAIC will lead on matters relating to the protection of individual and small business consumer privacy and confidentiality and compliance with the CDR Privacy Safeguard Guidelines. The Data Standards Body develops the standards that prescribe how data is shared within the system.

CDR privacy safeguards — OAIC
CDR privacy and security — OAIC

The data that you can share includes:

• Member data
• Account data
• Transaction data

The only difference between the authorisation of consents process for a joint account is that all owners of the account will receive an SMS notification to advise of the authorisation to share. The initiating member (Member A) will receive an SMS to confirm they’ve agreed to share data, and joint account holder (Member B) will receive an SMS notification to state that Member A has authorised us to share data on the joint account.

All joint accounts will be set to pre-approved by default (this means data on the account is available for sharing). You can change the sharing permission of your joint accounts by selecting the Accounts icon at the bottom banner in your data sharing dashboard and selecting the joint account/s to change sharing permission from Pre-approved to Do not share.

If a joint account holder requests the sharing permission of the joint account to be changed from Do not share, to Pre-approved, we will ask the other joint account holders if they would like to approve the change. If all joint account holders have not approved the change within 48 hours of the request, the joint account will remain on Do not share permission. If all other account holders approve the request within 48 hours, the sharing permission on the joint account will be changed to Pre-approved.

Information about data sharing on your accounts, is set out in your data sharing dashboard, located in Internet Banking.

Each joint account holder has the option to turn notifications on/off via their data sharing dashboard. It’s also possible to change the frequency of notifications by going to the Settings icon on your data sharing dashboard. This will only change the frequency for you and will not affect the frequency of notifications for the other joint account holders.

There may be times where your situation has changed or the details you have with us may need updating. You can check your data sharing dashboard to see what consents are active and those that have expired, or you can send a Secure Mail via Internet Banking or call us on 13 11 82.

The data sharing dashboard allows you to securely view, withdraw and modify your current and historical data sharing arrangements. You can access the Open Banking dashboard through a link in People’s Choice Internet Banking. Your mobile number will need to be correct for you to access your data sharing dashboard.

You can withdraw any authorisation to share on your individual or joint accounts via your data sharing dashboard by selecting Stop sharing. This will mean that no further data will be shared to the ADR from this consent. Alternatively, to withdraw an authorisation to disclose your data you can contact People’s Choice via secure email within Internet Banking or by visiting a branch or calling the National Contact Centre at 13 11 82 .

A consent can only be withdrawn with the relevant accredited data recipient by the individual who created it. If withdrawn, the consent will no longer be active and will only appear in archived consents on your data sharing dashboard.

When you authorise us to share your data, you will have two options - you can choose to share data on a single occasion or for an ongoing period (maximum of 12 months). However, when you no longer wish to share the data, you can withdraw your sharing arrangement by either contacting the third party you initially started the process with (the accredited data recipient) or you can withdraw your authorisation to share by using your data sharing dashboard, which can be found via Internet Banking.

Once you have completed the last step of the authorisation process you will be sent an SMS confirmation. You can also access a PDF receipt via your data sharing dashboard. Your data sharing dashboard can be viewed by logging into Internet Banking and clicking on the Open Banking icon.

Yes, but only if you elected to share your data for longer than 24 hours and that period has not expired (i.e. the consent is still 'Active'). You can contact the third party you started the process with (the accredited data recipient) to amend your existing data sharing arrangement.  

No. You will need to complete the consent process again with the accredited data recipient that you want to share data with. 

If you decide to withdraw your data sharing arrangement, you can contact the third party you started the process with (the accredited data recipient) and request they delete your data from their records.  

People’s Choice is a data holder under the Consumer Data Right (Open Banking). We are not currently an accredited data recipient but may apply to become accredited in the future. If we decide to do this, we’ll communicate this to our members.

To become an accredited data recipient, it’s necessary to satisfy strict requirements and specific security standards, which ensure the ongoing security of your data.

To remain an accredited data recipient, it’s necessary to maintain accreditation by complying with a number of ongoing obligations. An accredited data recipient can also be a data holder.

A secondary user is an authorised signatory or power of attorney.
To share data, a secondary user must be enabled by the account holder.
This can be done through Internet Banking.

You can access Secondary user permissions via the ‘Settings’ menu of the data sharing dashboard by selecting Secondary user permission.
Here you can view, enable, or disable the data sharing privileges of a Secondary user.

All Secondary users are set to ‘Disable’ sharing status by default. 
The account holder will need to enable sharing privileges for a secondary user to share data.
You can access a Secondary user via the ‘Settings’ menu of the data sharing dashboard by selecting Secondary user permission, here you can enable or disable sharing privileges of a Secondary user.

Yes, as the account holder you have full control of the data being shared.
To enable or disable, enter the data sharing dashboard and click on Manage next to the consent you’d like to change, move the toggle to either disable or enable to control the data being shared.
Please note if you disable the account, this will stop the sharing of data from that account while keeping the consent active, any additional accounts within the consent will continue to share as long as they are enabled.

When a Signatory or Power of Attorney is removed from an account and they were also be removed from the account as a Secondary User.
Unexpired data sharing arrangements initiated by them will continue to be active, but data from the account from which they have been removed will no longer be shared with the Accredited Data Recipient.

A Nominated Representative is a person who has been enabled by the Business Representative (Business Signatory) via the Consumer Dashboard within Internet Banking to share data on their business accounts. These users are also required to meet eligibility criteria.

Access the list of Nominated representatives via the ‘Settings’ menu of the data sharing dashboard by selecting Nominated representative.

Here you can enable or disable Nominated representatives if you are a Business representative (Business Account holder) on the account. This functionality allows the Business representative to select who they would like to grant data sharing access to.

Both Business representatives and Nominated representatives can enable or disable sharing on an account within a consent created by another Nominated representative.

To disable, enter the data sharing dashboard and click on manage next to the consent you’d like to change, move the toggle to disable to stop the data being shared with the Accredited Data recipient.

To enable, move the toggle to enable to allow data to flow to the Accredited Data recipient. Please note if you disable the account, this will stop the sharing of data with the Accredited Data Recipient while keeping the consent active which will ensure any additional accounts within the consent will continue to share as long as they are enabled.

Only the Business representative or the Nominated representative that created the consent can fully withdraw the consent.