Consumer Experience (CX) Guidelines
/
Consent Management
/
Consent Management (Data holder)
/
Account permissions
/
Secondary Users
/
CX Guidelines

CX Guidelines

Read first CX Checklist attributes ◦ Area refers to the stage in the consumer journey, such as Pre-consent, Consent, Authenticate, Authorise, or Consent Management. ◦ Focus area refers to a specific theme in each stage (e.g. 01. User Identifier). ◦ Checklist ref contains a unique reference number for the item. ▪ The first values refer to the Area (e.g. 0DL.xx.xx for data language; 2AU.xx.xx for authentication). ▪ The second set values refer to the Focus area (e.g. xxx.01.xx). ▪ The last values refer to the annotation number used on the wireframe, where available (e.g. xxx.xx.02; wireframes are linked to in the Example column). ◦ Type refers to the source of the statement: Rules, Standards and Guidelines. ◦ Participant refers to the relevant CDR Participant for the item. ◦ Requirement level refers to the level of obligation. For the data standards, the key words MUST, MUST NOT, SHOULD, SHOULD NOT, and MAY are to be interpreted as described in RFC2119. CX Guidelines provide optional examples and recommendations; as such, a MAY is used to denote a CX Guideline for the purposes of this checklist regardless of the language used in the guideline statement. ◦ Statement refers to the relevant requirement or recommendation as articulated in the rules, standards, or guidelines. ◦ References points to the requirement itself, or its location; typically a rule, standard, or research. ◦ Example links to the relevant artefact, such as the CX Guideline page, which includes wireframes of example implementations, or a table in the case of data language standards. ◦ Version introduced refers to the version of the data standards that was current when the item was introduced to the CX Guidelines, starting from version 1.4.0. Items noted as introduced in 1.4.0 or earlier are requirements that exist in v1.4.0 of the CX Guidelines (PDF). ◦ Date introduced refers to the specific date the item was introduced to the CX Checklist, using August 2020 as a starting point (when v1.4.0 was introduced). The date will typically be the date of the version release, but some new items may not constitute a standards change (e.g. a revised wireframe or rules change) and as such may not align with standards versioning. ◦ Date modified refers to when an existing CX Checklist entry was updated, which is not necessarily the date the corresponding requirement (Rule, Standard or Guideline) was changed. ◦ Status refers to whether the item is active or has been retired from the CX Guidelines. An 'active' item is applicable and current. A 'retired' item may be labelled as such because it no longer applies, has been merged with another item, or has been removed from the CX Guidelines. A 'retired' item may still be a requirement. These statuses are used in the live CX Checklist and CSV to highlight changes between versions of the CX Guidelines.
Wireframe ref
Type
Requirement level
Statement
Reference
Checklist ref
Focus area

01

CDR Rule
MUST

(5) If the CDR consumer is a secondary user for an account, the data holder must also provide the account holder with an online service that: (d) is simple and straightforward to use, and is no more complicated to use than the processes for giving the authorisation or instruction;

CDR Rule 1.15(5)(d)

5CM4.01.01

02

CDR Rule
MUST

(1) A data holder must provide: (e) in relation to each account in relation to which a person has account privileges―a service that can be used by the account holder to: (ii) withdraw the instruction. Note 4: To avoid doubt, a service may be offered in an online form even if this subrule does not require it to be an online service.

CDR Rule 1.13(1)(e)(ii), (Note 4)

5CM4.01.02

03

CDR Rule
MUST

(5) If the CDR consumer is a secondary user for an account, the data holder must also provide the account holder with an online service that: (b) allows the account holder, at any time, to withdraw the secondary user instruction;

CDR Rule 1.15(5)(b)

5CM4.01.03

04

CDR Rule
MUST

(5) If the CDR consumer is a secondary user for an account, the data holder must also provide the account holder with an online service that: (c) as part of the process of withdrawing a secondary user instruction, displays a message, in accordance with the data standards, about the consequences of proceeding with withdrawing a secondary user instruction;

CDR Rule 1.15(5)(c)

5CM4.01.04

05

CX Standard
MUST

As part of the secondary user instruction withdrawal process, data holders MUST advise the consumer: 1. That removing a secondary user instruction will stop all current and future data sharing for the secondary user(s) 2. To review the consequences of withdrawal with the secondary user(s) before removing the secondary user instruction Note: The exact phrasing of this message is at the discretion of the data holder.

Withdrawal Standards, Withdrawal: Secondary User Instruction

5CM4.01.05

06

CX Guideline
MAY

Consumers may have various account permissions to manage, such as joint account disclosure option management, nominated representative services, and secondary user instructions. To facilitate consumer control and consent management, data holders should provide these services in intuitive and centralised locations in relation to their consumer dashboard.

5CM4.01.06

07

CX Guideline
MAY

If scrolling is required to view the total number of accounts, data holders should also allow consumers to search and filter their accounts. For example: A consumer may want to filter account types or data sharing preferences.

10 Usability Heuristics for User Interface Design: Flexibility and efficiency of use (Nielsen)

5CM4.01.07

08

CX Guideline
MAY

Data holders may provide optional functionality that allows a consumer to see which authorisations are associated with the account.

5CM4.01.08

09

CX Guideline
MAY

Data holders should introduce positive friction to the withdrawal flow to mitigate user error and unintended consequences. Data holders may choose to do this via a 2-step authorisation withdrawal process.

CX Research 32 | 10 Usability Heuristics for User Interface Design: Error prevention (Nielsen)

5CM4.01.09

10

CX Guideline
MAY

Data holders should notify the impacted secondary user(s) when their secondary user instruction is withdrawn. If a data holder does implement this functionality, the account owner withdrawing the instruction should be alerted to the fact that the secondary user(s) will be notified when the instruction is withdrawn.

5CM4.01.10

11

CX Guideline
MAY

Data holders should provide instructions on how to review and manage account permissions as part of the withdrawal process

5CM4.01.11

12

CX Guideline
MAY

Data holders should provide a message to consumers that withdrawal was successful. This message should be clearly visible on the dashboard and shown as soon as withdrawal has taken place.

10 Usability Heuristics for User Interface Design: Visibility of system status (Nielsen)

5CM4.01.12

13

CX Guideline
MAY

Data holders should provide support pathways at appropriate points throughout the consent model. These may include before and after key decision points, such as confirming or withdrawing a sharing arrangement or permission.

5CM4.01.13

14

CX Guideline
MAY

Data holders can refer to accounts using recognised nicknames, icons, account numbers, and account type. They can also include information on other elements the account may refer to such as any related plans, services, properties, numbers, and products.

5CM4.01.14

15

CDR Rule
MUST

(5) If the CDR consumer is a secondary user for an account, the data holder must also provide the account holder with an online service that: (e) is prominently displayed and readily accessible to the account holder.

CDR Rule 1.15(5)(e)

5CM4.01.15