01

(1) For each joint account to which this Part applies, the data holder must provide a service to each joint account holder that allows the joint account holder to: (a) change the disclosure option that applies to the account in accordance with rule 4A.7; (b) propose a change in the disclosure option to the other joint account holders in accordance with rule 4A.8; and (c) respond to a proposal by another joint account holder to change the disclosure option. (2) Such a service is a disclosure option management service.

CDR Rule 4A.6(1), (2)

5CM3.00.01

02

(3) The service must be provided online and, if there is a data holder’s consumer dashboard for a joint account holder, may be included in the dashboard. (4) The service may, but need not, also be provided other than online.

CDR Rule 4A.6(3), (4)

5CM3.00.02

03

(5) The service must give effect to a change in the disclosure option as soon as practicable.

CDR Rule 4A.6(5)

5CM3.00.03

04

(6) The service must not do any of the following in relation to the processes that it provides for changing or proposing to change the disclosure option that applies to the joint account, or responding to such a proposal (the processes): (a) add any requirements to the processes beyond those specified in the data standards and these rules; (b) offer additional or alternative services as part of the processes; (c) include or refer to other documents, or provide any other information, so as to reduce comprehensibility; (d) offer any pre-selected options.

CDR Rule 4A.6(6)

5CM3.00.04

05

(7) The service must indicate to the joint account holder which disclosure option currently applies.

CDR Rule 4A.6(7)

5CM3.00.05

06

(8) The service must be in accordance with the data standards.

CDR Rule 4A.6(8)

5CM3.00.06

07

(1) Disclosure of joint account data may be authorised only as permitted by the disclosure option that applies to the joint account. This may be any of the following: (a) the pre-approval option, under which joint account data may be disclosed in response to a valid consumer data request on the authorisation of the requester without the approval of the relevant account holders; (c) the non-disclosure option, under which joint account data may not be disclosed even in response to a valid consumer data request. (2) The data holder must provide for the pre-approval and non-disclosure options to be available for a joint account.

CDR Rule 4A.5(1)(a), (c) and (2)

5CM3.00.07

08

(1) A joint account holder may at any time choose that the non-disclosure option will apply to the joint account, using the disclosure option management service.

CDR Rule 4A.7(1)

5CM3.01.08

09

(3) If a joint account holder (account holder A) changes the disclosure option that applies to the account in accordance with this rule, the data holder must, as soon as practicable through its ordinary means of contacting the other joint account holders: (a) explain to each of them what the consumer data right is;

CDR Rule 4A.7(3)(a)

5CM3.01.09

10

(3) If a joint account holder (account holder A) changes the disclosure option that applies to the account in accordance with this rule, the data holder must, as soon as practicable through its ordinary means of contacting the other joint account holders: (b) inform them which disclosure option previously applied to the account; and (c) inform them that account holder A has changed the disclosure option, and of the disclosure option that now applies;

CDR Rule 4A.7(3)(b), (c)

5CM3.01.10

11

(3) If a joint account holder (account holder A) changes the disclosure option that applies to the account in accordance with this rule, the data holder must, as soon as practicable through its ordinary means of contacting the other joint account holders: (d) explain to them the mechanisms for changing the disclosure option again.

CDR Rule 4A.7(3)(d)

5CM3.01.11

12

ordinary means of contacting an account holder by a data holder means: (a) if the data holder has agreed with the account holder on a particular means of contacting the account holder for the purposes of the relevant provision—that means; and (b) otherwise—the default means by which the data holder contacts the account holder in relation to the account.

CDR Rule 1.7(1)

5CM3.01.12

13

Data holders MUST alert a joint account holder where an action they are about to perform may result in the other joint account holder(s) being notified. This standard applies to the authorisation flow, consumer dashboards, and the disclosure option management service where notifications to the other joint account holder(s) may be triggered. The precise wording of this notification is at the discretion of the data holder.

Notification Standards, Notifications: Joint Account Alerts, Joint account notifications: Contextual alert

5CM3.01.13

14

As part of the process of removing a joint account approval or changing to a more restrictive disclosure option, the data holder MUST advise the consumer: 1. that doing this may impact existing services, including arrangements initiated by the other account holder(s) 2. when removing an approval: ◦ that even though sharing for this service has now stopped, the other account holder(s) can still create new data sharing arrangements for the joint account ◦ how to change their disclosure option Note: The exact phrasing of the withdrawal message is at the discretion of the data holder. This standard does not affect data holders’ other notification obligations, including under rule 4A.7(3).

Withdrawal Standards, Withdrawal: Joint accounts

5CM3.01.14

15

In relation to the joint account alert standards in this section, data holders MAY provide further information about any services or processes in place for supporting vulnerable consumers or reporting risks of physical, psychological, or financial harm or abuse to the data holder.

Notification Standards, Notifications: Joint Account Alerts, Joint account notifications: Further information

5CM3.01.15

16

Data holders may consider providing a centralised location for managing various CDR account permissions, which could, for example, allow a consumer to access and manage their joint accounts, secondary user instructions, and any appropriate partnership and non-individual permissions. The disclosure option management service (DOMS) could be accessible from this location and in relation to the consumer dashboard.

5CM3.01.16

17

Data holders should refer to disclosure options using plain language. A description of the disclosure option should be provided where possible. These artefacts use 'single consent' to represent pre-approval disclosure option, 'joint consent' to represent co-approval disclosure option, and 'stop all sharing from this account' or 'data sharing disabled' to represent a non-disclosure option.

5CM3.01.17

18

Community consultation suggested that identifying the specific account holder may raise privacy concerns in some instances. Data holders may identify the specific account holder in relation to the relevant rules requirement, but may also deem it necessary to omit these details in certain scenarios in accordance with CDR Rule 4A.15.

CDR Rule 4A.15

5CM3.01.18

19

Data holders may provide a mechanism for consumers to see a list of authorisations currently sharing data from that joint account.

5CM3.01.19

20

Data holders may offer an alternative notification schedule to apply at the account level and the customer level.

5CM3.01.20

21

To aid intuitive disclosure option management, data holders may choose to semantically distinguish pre-approval and co-approval changes from changing to a non-disclosure option.

5CM3.01.21

22

Existing approvals for specific authorisations are not automatically removed when a non-disclosure option is applied, but the joint account data cannot be shared due to the application of the non-disclosure option. If a joint account is changed from a non-disclosure to enable sharing again, joint account data sharing will recommence for any active authorisations that are associated with that joint account.

5CM3.01.22

23

Email is shown as an example notification only. Data holders must use ordinary means of contacting the relevant account holder(s) as outlined in CDR Rules 4A.7(3) and 1.7(1). A data holder may agree with the account holder on a “particular means of contacting the account holder for the purposes of the relevant provision”. Data holders are required to provide an online disclosure option management service, and may negotiate to provide joint account notifications online in line with this provision even where the consumer otherwise receives notifications via non-digital channels.

CDR Rule 4A.7(3), 1.7(1)

5CM3.01.23

24

Data holders can refer to accounts using recognised nicknames, icons, account numbers, and account type. They can also include information on other elements the account may refer to such as any related plans, services, properties, numbers, and products.

5CM3.01.24

01

(1) For each joint account to which this Part applies, the data holder must provide a service to each joint account holder that allows the joint account holder to: (a) change the disclosure option that applies to the account in accordance with rule 4A.7; (b) propose a change in the disclosure option to the other joint account holders in accordance with rule 4A.8; and (c) respond to a proposal by another joint account holder to change the disclosure option. (2) Such a service is a disclosure option management service.

CDR Rule 4A.6(1), (2)

5CM3.00.01

02

(3) The service must be provided online and, if there is a data holder’s consumer dashboard for a joint account holder, may be included in the dashboard. (4) The service may, but need not, also be provided other than online.

CDR Rule 4A.6(3), (4)

5CM3.00.02

03

(5) The service must give effect to a change in the disclosure option as soon as practicable.

CDR Rule 4A.6(5)

5CM3.00.03

04

(6) The service must not do any of the following in relation to the processes that it provides for changing or proposing to change the disclosure option that applies to the joint account, or responding to such a proposal (the processes): (a) add any requirements to the processes beyond those specified in the data standards and these rules; (b) offer additional or alternative services as part of the processes; (c) include or refer to other documents, or provide any other information, so as to reduce comprehensibility; (d) offer any pre-selected options.

CDR Rule 4A.6(6)

5CM3.00.04

05

(7) The service must indicate to the joint account holder which disclosure option currently applies.

CDR Rule 4A.6(7)

5CM3.00.05

06

(8) The service must be in accordance with the data standards.

CDR Rule 4A.6(8)

5CM3.00.06

07

(1) Disclosure of joint account data may be authorised only as permitted by the disclosure option that applies to the joint account. This may be any of the following: (a) the pre-approval option, under which joint account data may be disclosed in response to a valid consumer data request on the authorisation of the requester without the approval of the relevant account holders; (c) the non-disclosure option, under which joint account data may not be disclosed even in response to a valid consumer data request. (2) The data holder must provide for the pre-approval and non-disclosure options to be available for a joint account.

CDR Rule 4A.5(1)(a), (c) and (2)

5CM3.00.07

08

(1) This rule applies in relation to a particular joint account if: (a) the non-disclosure option applies to the account, and a joint account holder (account holder A) proposes, using the disclosure option management service, to change to the co-approval or pre-approval disclosure option;

CDR Rule 4A.8(1)(a)

5CM3.02.08

09

(2) The data holder must, as soon as practicable through its ordinary means of contacting the other joint account holders: (a) explain to each of them what the consumer data right is;

CDR Rule 4A.8(2)(a)

5CM3.02.09

10

(2) The data holder must, as soon as practicable through its ordinary means of contacting the other joint account holders: (b) inform them which disclosure option currently applies to the account;

CDR Rule 4A.8(2)(b)

5CM3.02.10

11

(2) The data holder must, as soon as practicable through its ordinary means of contacting the other joint account holders: (c) inform them that account holder A has proposed that the co-approval or pre-approval option apply to the account, as the case may be;

CDR Rule 4A.8(2)(c)

5CM3.02.11

12

(2) The data holder must, as soon as practicable through its ordinary means of contacting the other joint account holders: (d) explain to them that this change requires the agreement of all account holders;

CDR Rule 4A.8(2)(d)

5CM3.02.12

13

(2) The data holder must, as soon as practicable through its ordinary means of contacting the other joint account holders: (e) explain to them any alternative options for change that are available and how they can be made;

CDR Rule 4A.8(2)(e)

5CM3.02.13

14

(2) The data holder must, as soon as practicable through its ordinary means of contacting the other joint account holders: (f) invite them to either agree to or reject the proposal within a specified period.

CDR Rule 4A.8(2)(f)

5CM3.02.14

15

(3) At the end of the specified period, the data holder must, as soon as practicable through its ordinary means of contacting the joint account holders, inform them whether: (a) all the joint account holders have approved the change, and as a result the new disclosure option applies to the joint account; or (b) not all the joint account holders have approved the change, and as a result the disclosure option is unchanged.

CDR Rule 4A.8(3)

5CM3.02.15

16

ordinary means of contacting an account holder by a data holder means: (a) if the data holder has agreed with the account holder on a particular means of contacting the account holder for the purposes of the relevant provision—that means; and (b) otherwise—the default means by which the data holder contacts the account holder in relation to the account.

CDR Rule 1.7(1)

5CM3.02.16

17

Data holders MUST alert a joint account holder where an action they are about to perform may result in the other joint account holder(s) being notified. This standard applies to the authorisation flow, consumer dashboards, and the disclosure option management service where notifications to the other joint account holder(s) may be triggered. The precise wording of this notification is at the discretion of the data holder.

Notification Standards, Notifications: Joint Account Alerts, Joint account notifications: Contextual alert

5CM3.02.17

18

In relation to the joint account alert standards in this section, data holders MAY provide further information about any services or processes in place for supporting vulnerable consumers or reporting risks of physical, psychological, or financial harm or abuse to the data holder.

Notification Standards, Notifications: Joint Account Alerts, Joint account notifications: Further information

5CM3.02.18

19

Data holders may consider providing a centralised location for managing various CDR account permissions, which could, for example, allow a consumer to access and manage their joint accounts, secondary user instructions, and any appropriate partnership and non-individual permissions. The disclosure option management service (DOMS) could be accessible from this location and in relation to the consumer dashboard.

5CM3.02.19

20

Data holders should refer to disclosure options using plain language. A description of the disclosure option should be provided where possible. These artefacts use 'single consent' to represent pre-approval disclosure option, 'joint consent' to represent co-approval disclosure option, and 'stop all sharing from this account' or 'data sharing disabled' to represent a non-disclosure option.

5CM3.02.20

21

Community consultation suggested that identifying the specific account holder may raise privacy concerns in some instances. Data holders may identify the specific account holder in relation to the relevant CDR Rules requirement, but may also deem it necessary to omit these details in certain scenarios in accordance with CDR Rule 4A.15.

CDR Rule 4A.15

5CM3.02.21

22

Data holders may provide a mechanism for consumers to see a list of authorisations currently sharing data from that joint account.

5CM3.02.22

23

Data holders may offer an alternative notification schedule to apply at the account level and the customer level.

5CM3.02.23

24

Existing approvals for specific authorisations are not automatically removed when a non-disclosure option is applied, but the joint account data cannot be shared due to the application of the non-disclosure option. If a joint account is changed from a non-disclosure to enable sharing again, joint account data sharing will recommence for any active authorisations that are associated with that joint account. Data holders should inform joint account holders of this fact when changing from a non-disclosure option to pre-approval or co-approval. Data holders may want to provide a way for the joint account holder to see who will access that data when sharing is enabled again, and may want to provide a simple mechanism for removing the approvals for the relevant sharing arrangements.

5CM3.02.24

25

Data holders should indicate to the requester visually that an account requires further actions or approvals before a less restrictive disclosure option is applied.

5CM3.02.25

26

A push notification is shown as an example notification only. Data holders must use ordinary means of contacting the relevant account holder(s) as outlined in CDR Rules 4A.8(2) and 1.7(1). A data holder may agree with the account holder on a “particular means of contacting the account holder for the purposes of the relevant provision”. Data holders are required to provide an online disclosure option management service, and may negotiate to provide joint account notifications online in line with this provision even where the consumer otherwise receives notifications via non-digital channels.

CDR Rule 4A.8(2), 1.7(1)

5CM3.02.26

27

A push notification is shown as an example notification only. Data holders must use ordinary means of contacting the relevant account holder(s) as outlined in CDR Rules 4A.8(3) and 1.7(1). A data holder may agree with the account holder on a “particular means of contacting the account holder for the purposes of the relevant provision”. Data holders are required to provide an online disclosure option management service, and may negotiate to provide joint account notifications online in line with this provision even where the consumer otherwise receives notifications via non-digital channels.

CDR Rule 4A.8(3), 1.7(1)

5CM3.02.27

28

Data holders can refer to accounts using recognised nicknames, icons, account numbers, and account type. They can also include information on other elements the account may refer to such as any related plans, services, properties, numbers, and products.

5CM3.02.28