Ottawa introduces act designed to regulate data use, Torys lawyer Brigitte Goulard says
Whether it is called “open banking” or the newly coined term “consumer-driven banking,” the federal government is honouring its commitment to implement legislation, says Torys LLP partner Brigitte Goulard, who spent five years as deputy commissioner of the Financial Consumer Agency of Canada.
“That would allow consumers and small businesses to request their data relating to products and services be shared safely and securely with the entities of their choice,” Goulard adds.
On April 30, the federal government introduced the Budget Implementation Act, 2024, No. 1, as an initial step toward launching a framework for consumer-driven banking through draft legislation - the Consumer-Driven Banking Act (CBDA). It also incorporates draft amendments to the act governing the FCAC.
The draft provisions in the bill address the “elements” of government scope and process, says Goulard, but it does not introduce comprehensive consumer-driven banking legislation. Also, key aspects of the framework – such as liability and privacy – are expected to be revealed in the Budget Implementation Act No. 2, to be tabled in the fall.
Still, Goulard and others see this move towards what had, generally, up until now, been called “open banking” as the future of financial services and will bring Canada closer to what is already happening in countries such as Australia and the United Kingdom. Using application programming interface (API) technology, financial institutions will be able to provide access to their customers’ banking data to third-party service providers.
“The simplest way to explain [open banking or consumer-driven banking] is that consumers will have access to the data that is currently sitting in your financial institution, and you will be allowed to direct your financial institution to send that information to another service provider or app to help manage their money.”
The regulatory framework under the legislation would apply to data relating to, for example, deposit accounts, registered and non-registered investment accounts, lending products and payment products.
However, Goulard says that initially, the legislation would only allow “read-only” privileges - the consumer could give a third party access to data via an API as it currently exists, but not to edit that data or direct an action such as paying a bill.
However, she notes there is an expectation that the next phase will create legislation to allow consumers to direct that third party to make changes to an account or do something on the customer's behalf. But this would likely be “quite a ways” down the line because time will likely be needed to deal with any hiccups encountered in the read-only phase. She adds that participants must be comfortable with the ecosystem in read-only mode before allowing changes.
In the fall, she says, the legislation will establish the privacy requirements, address liability concerns, outline how financial institutions who participate will protect consumer data and provide specifics of the consent requirements. The government is also planning to appoint a technical body to decide what the standards will be.
When it comes to who will be allowed to participate in consumer-driven banking, “it’s not a matter of excluding” anyone, she says. “It’s whoever wants to become a participating entity.” Financial institutions that meet certain thresholds, such as large Canadian banks, must participate. “They won’t have a choice.”
However, other types of entities, such as fintechs, securities dealers, and credit unions, can decide to join and see if they meet the technical standards and requirements that will be imposed.
“If you decide to opt in, then you become a participating entity in the framework, and you must comply with the requirements of the framework, which are not yet determined, she says, and subject to the oversight of the FCAC.
One of the challenges that the government will have to consider is the broad range of entities that will be participating. “You’ll be getting some very large banks, sophisticated institutions that hold most of the information,” she says. “Then you'll have small fintechs who want to use that information to create an app.”
She adds that it has “taken a while to get even this far” with consumer-driven banking because of the challenge of incorporating federally regulated institutions like banks and those regulated provincially, like credit unions.
Still, Goulard thinks that most potential participants in consumer-driven banking “recognize that it’s coming” and want to ensure proper protection for consumers and financial institutions. But the larger banks, where most Canadians hold their money, have been pushing for a framework that protects the information, once it. Is shared with third parties.
The drafters of the legislation also want to ensure that so-called “derived” data remains proprietary. (Derived data is information gathered through a customer’s long-term relationship with a bank or what they surmise based on other sources of information.)
Goulard points out that financial institutions and fintechs are already developing many aspects of “consumer-driven” banking through “screen scraping,” which involves copying information displayed on a screen and repurposing it for other uses. For example, banking customers share their login credentials with a third party, which then uses bots to log in on their behalf and extract data from their bank’s website or application interface.
However, specific legislation will help codify how sharing this information can be done with better security and enhanced privacy. “Let’s just say unsavoury characters could easily access that screen scraping," Goulard says, pointing out that when she was Deputy Commissioner at the FCAC, "we issued an alert to Canadians telling them not to use apps that did screen scraping.”
As for timing, Goulard says it’s “hard to say” when consumer-driven banking will be in full swing in Canada. Firstly, there is still a lot of work to be done on the legislation and regulations, and there is also a federal election in the wings, which might delay things.
Either way, the Liberals and Conservatives have both expressed support for the concept of consumer-driven banking, says Goulard, so Canada is likely to have a well-defined system, one that will be able to address any concerns, in the near future.
