Privacy working group meeting 6 – April 17, 2023

This discussion guide is provided to assist working group members in preparing for their final meeting.

For questions or comments, please contact obbo@fin.gc.ca.

On this page:

• Discussion guide
• Outcomes

Discussion guide

Common rules to protect vulnerable consumers  

In its 2018 Final Report, the Advisory Committee on Open Banking listed financial inclusion as a key component of the vision of Canada’s open banking system. They recommended that financial inclusion be considered in the design of an open banking system and be complemented by financial education policies, programs, and resources. Open banking presents an opportunity to reduce barriers to the financial system for vulnerable consumers but could also worsen digital financial exclusion if not implemented carefully.

While there is great potential for open banking to advance financial inclusion, ensuring these benefits accrue requires intentional design of policies and products^{Footnote 1}. So far, efforts to do this have been uneven across jurisdictions with open banking systems in place. Many first mover jurisdictions looked to product innovation to address financial inclusion, but design elements can also address inclusion from the outset. Research by the Consultative Group to Assist the Poor (CGAP)^{Footnote 2} points to Mexico’s Fintech Law as an example of proactively embracing financial inclusion objectives in their open banking design by increasing market transparency and ensuring that products best suited to the unbanked will be developed. Meanwhile, Australia provides Consumer Data Right resources in multiple languages, including listening options^{Footnote 3}. Some Canadian stakeholders have also suggested requiring user experience testing with vulnerable consumers as a way forward.

A Canadian open banking system can realize financial inclusion goals in three ways:

1. policy and framework design
2. product design
3. education and awareness

To this end, additional consumer protections may need to be established with specific rules that ensure vulnerable consumers can confidently access the benefits of open banking and are adequately protected when doing so. Second, industry also has a role to play in developing products that are affordable and appropriate for the needs of vulnerable consumers. Lastly, consumer outreach and education will be needed to raise awareness of the system and empower all consumers to seek out products and services that may better suit their financial needs and goals.

Discussion

1. Are there specific rules that should be put in place to ensure all Canadians are able to access the open banking system and its benefits? In particular, to ensure greater inclusion for rural and remote communities, indigenous communities, vulnerable populations and Canadians living with disabilities.  
2. Are there activities or types of entities that need to be limited or restricted to ensure consumers are adequately protected?  
3. What technical elements may impede consumer protection and access – for example, limitations on real-time API calls? Broad default options for data use? Restricting screen scraping?  
4. What elements should be prioritized for consumer education (by government, industry, governance entity)?

Outcomes

Common rules to protect vulnerable consumers  

Discussion 1

Are there specific rules that should be put in place to ensure all Canadians are able to access the open banking system and its benefits? In particular, to ensure greater inclusion for rural and remote communities, indigenous communities, vulnerable populations and Canadians living with disabilities.

• Participants reiterated the importance of having rules around accessibility and the use of plain language when obtaining consent and disclosing key information.
• On accessibility, participants proposed customer service platforms available in multiple languages and across different channels, including call-in services or in person guidance and services.
• Participants recognized that vulnerable populations face systemic barriers that cannot be solved solely by open banking, for example broadband access in remote communities.
• Participants discussed the importance of creating a system inclusive of all entity types.

Discussion 2

Are there activities or types of entities that need to be limited or restricted to ensure consumers are adequately protected?

• Among the examples of entities suggested included data brokers and organizations that collect information for targeting consumers.
• Conversely, it was also suggested to take a principles-based approach, focusing on restricting entities that do not support positive consumer outcomes instead of specific organizations. 
• Participants agreed that strong and consistent accreditation criteria would help ensure sound market conduct from all entities.

Discussion 3

What technical elements may impede consumer protection and access – for example, limitations on real-time API calls? Broad default options for data use? Restricting screen scraping?

• There was consensus that default options should be set to protecting consumers and that consent should not be presumed or implied. Rather, consent should always be explicit and by “opt-in”.
• Participants discussed the importance of ongoing user testing for accessibility, consent management, and usability.

Discussion 4

What elements should be prioritized for consumer education (by government, industry, governance entity)?

• There was consensus that ongoing education is important. However, participants suggested a staged approach to avoid overwhelming consumers with information.
• Participants concurred that the initial focus should be to provide foundational information with education efforts advancing as the system evolves.
• Examples of consumer education topics provided included fraud, cybersecurity, measures in place to protect consumers, as well as the value proposition of open banking.
• Participants agreed that consumer education should be a shared responsibility and saw opportunities for partnerships with consumer agencies.

Privacy working group attendees