Executive summary

This report contains findings and recommendations based on three rounds of qualitative and quantitative Consumer Experience (CX) research, conducted from September to November 2022. In total, 290 consumers participated in research activities ranging from 1:1 moderated interview sessions to unmoderated surveys and prototype tasks.

The purpose of this research was to examine the viability of simplifying rules and standards for Consumer Data Right (CDR) consents and dashboards, as identified by the Consent Review Working Group.

Prototypes of a collection and use consent flow were used to facilitate discussion with consumer participants, and generate quantitative metrics relating to engagement, comprehension and sentiment.

Specific hypotheses, insights, and their results included:

The CX research suggests that the proposed changes to the consent flow would not meaningfully impact consumers’ comprehension, empowerment and trust.

Eight out of twelve research questions were strongly supported by the research evidence. While the evidence from this research for the remaining four questions was indeterminate, this report provides recommendations based on current and past CX research.

Can collection and use consents be granted in a single action without reducing empowerment or comprehension?

The evidence suggests yes.

Can multiple uses be requested in a single flow without impacting comprehension or trustworthiness?

The evidence suggests yes.

Can required datasets be pre-selected or clearly indicated without impacting empowerment and comprehension?

The evidence is indeterminate, but this could still be done safely and intuitively.

Where the consent duration is essential to the provision of the service, can this be pre-selected or clearly indicated without impacting empowerment and comprehension?

The evidence is indeterminate, but this could still be done safely and intuitively.

Can withdrawal information shown during consent be simplified without impacting comprehension and empowerment?

The evidence suggests yes.

Does the consistent display of supporting parties better align with consumer expectations?

The evidence suggests yes.

Can the data language ‘permissions’ be referred to in a more conversational way?

The evidence suggests yes.

Should the requirements for 90-day notifications be amended to provide clarity on their content, and to allow flexibility for consolidating them?

The evidence suggests yes.

Would specific guidance on what to include in a CDR receipt help to better meet consumer expectations?

The evidence suggests yes.

Would further guidance on when to provide a CDR receipt better meet consumer expectations?

The evidence is indeterminate, but this could be explored further.

Are dashboards necessary for once-off consents?

The evidence is indeterminate, but this could be explored further.

Would a deletion by default approach improve consumer control, empowerment and trust?

The evidence suggests yes.

Full details on the public consultation and outcomes can be found on Design Paper 321: Consumer Data Right Consent Review.

Research approach

Consent Score

Consent Scores for Existing state (round 1) compared to Iterated simplified state (round 3)

For the above Consent Scores graph, the breakdown across round 1 and 3 is as follows:

At a glance there appears to be an overall decrease in Consent Scores across rounds 1 and 3. However for the majority of round 1 and 3 scores, the differences were not statistically significant. This means there is not enough evidence to conclude that there is a real difference between round 1 and round 3 results. As such, we cannot establish a cause-and-effect relationship. The differences in scores are likely to have happened by chance (e.g. participant selection), rather than design changes.

Findings

What did we learn?

Separation of consents (bundling)

Can collection and use consents be granted in a single action without reducing empowerment or comprehension?

‣

Bundling of collection and use consents reflects consumers’ mental model

‣

Bundling of collection and use consents did not negatively impact consumer comprehension or empowerment

Supported by evidence? Yes

Can multiple uses be requested in a single flow without impacting comprehension or trustworthiness?

‣

Being able to opt-in to non-essential uses aligns with consumer expectations

Supported by evidence? Yes

Pre-selected and actively selected options

Can required datasets be pre-selected or clearly indicated without impacting empowerment and comprehension?

‣

Approach

‣

Consumers understand the connection between datasets and use cases

‣

Consumers want control over datasets, despite acknowledging an impact on service delivery

Supported by evidence? Indeterminate

Where the consent duration is essential to the provision of the service, can this be pre-selected or clearly indicated without impacting empowerment and comprehension?

‣

Approach

‣

Duration can be determined by the service, with optionality where appropriate

‣

Historic data access is dependent on personal circumstances

Supported by evidence? Indeterminate

Withdrawal of consent information

Can withdrawal information shown during consent be simplified without impacting comprehension and empowerment?

‣

The fact that consent can be withdrawn is highly valued

‣

Instructions for and consequences of withdrawal are less critical

‣

Withdrawal information elsewhere in the consent model was appreciated

Supported by evidence? Yes

Supporting parties

Does the consistent display of supporting parties better align with consumer expectations?

‣

Upfront transparency is seen as critical

‣

Access and control over third parties is desired

Supported by evidence? Yes

Data language standards

Can the data language ‘permissions’ be referred to in a more conversational way?

90-day notifications

Should the requirements for 90-day notifications be amended to provide clarity on their content, and to allow flexibility for consolidating them?

CDR receipts

Would specific guidance on what to include in a CDR receipt help to better meet consumer expectations?

Would further guidance on when to provide a CDR receipt better meet consumer expectations?

Dashboards for once-off consents

Are dashboards necessary for once-off consents?

De-identification and deletion by default

Would a deletion by default approach improve consumer control, empowerment and trust?

Next steps

The insights and considerations from this research have informed the development of a design paper for the consent review. This design paper will be consulted on publicly, followed by consultation on any proposed rules and standards.

Further CX research may be considered for future work on the consent model, including to support any further simplifications, review, and the expansion of CDR to support other sectors and functionality, such as action-initiation.