Non-banks could abuse open banking, say consumer groups

The Financial Rights Legal Centre, Financial Counselling Australia and Consumer Action Law Centre have published their joint submission to Treasury’s consultation on its proposed expansion of the consumer data regime (CDR), also referred to as open banking, to non-bank lenders.

The consumer bodies admitted there will be benefits from allowing non-banks to access open banking data, including improving the accuracy of lenders’ responsible lending checks and assisting the other CDR participants, such as insurers, to improve their processes.

But they have warned the data-sharing regime could exacerbate existing consumer harms, if it is not carefully handled.

The submission has looked towards lenders with higher-priced credit products, which target consumers with some degree of financial hardship, including payday lenders, buy now, pay later providers, consumer lease providers and medium amount credit contract providers.

The three consumer bodies have expressed fears that the CDR will support and increase “poor non-bank lender behaviour that profiles risk and targets financial hardship”.

They pointed towards cases of some non-bank lenders that reportedly had obtained customers’ bank account passwords to scrape financial data, before later identifying if the consumer’s account was running low in funds and then hitting them with direct marketing for high-cost loans.

“This unethical practice is highly likely to become commonplace and more widespread once CDR is applied to the non-bank lending sector,” the submission stated.

The consumer bodies have raised the alarm on Privacy Safeguard 3 under the CDR guidelines, which prohibits an accredited person from attempting to collect data unles it is in response to a “valid request” from the customer.

According to the submission, Privacy Safeguard 3 “lacks an explicit ‘fair collection’ requirement which would act to prevent and discourage unfair practices”.

“There are currently few if any restrictions on how often, how much or how regularly a non-bank lender can examine a consumer’s financial data in order to identify financial hardship and subsequently target them with offers of additional credit,” the submission read.

“There is also little preventing them from selling or providing this information to other related or unrelated businesses who target people in financial hardship such as debt management firms.”

Further, the consumer bodies warned the CDR has an over-reliance on consent and disclosure to mitigate customer harm – which they claimed was “unrealistic” to expect individuals to comprehend the information presented and to identify the risks involved when engaging with lenders.

Australia has low levels of financial literacy, the submission warned, which further magnified for people experiencing financial hardship.

Another harm the bodies focused on is the potential for the CDR to enable price discrimination and risk profiling from lenders. If this came to being, some consumers would be able to access cheaper forms of credit, while others would be subject to “high and untenable” rates.

“The CDR has the potential to widen the gap between the credit-haves and the credit have-nots,” the submission said.

It also noted the CDR expansion to non-banks could undermine comprehensive credit reporting (CCR) regulations, a set of rules that determine how lenders can interact with consumers’ credit histories.

The scheme is mandatory for the big four banks and voluntary for other lenders.

Under CCR, lenders are able to access information around customers’ debt, including “positive” data such as repayments made on time – in contrast to previous credit reports that only showed “negative” credit behaviour, such as defaults.

However, there are rules under the CCR to restrict the use of repayment history information and financial hardship information, to ensure a balance between customers seeking out hardship arrangements in their best interests and banks having enough information to make sound lending decisions.

For example, financial hardship information is deleted from credit reports after 12 months, versus 24 months for regular repayment history information.

There are also limits in place on what a lender can do with financial hardship information when they find out.

However, the consumer bodies believe that by granting access to a consumer’s entire financial history under the CDR, they could circumvent the limits of the CCR regime.

The Financial Rights Legal Centre, Financial Counselling Australia and Consumer Action Law Centre have suggested some reforms to the CDR, including:

• Limiting the scope of eligible participants to those with a credit licence and who are mandatorily or voluntarily subject to the CCR regime
• Restrict specific uses of consumer data, such as using it to identify when people are experiencing financial hardship and subsequently using it to directly market further high credit products
• Introduce a fair collection requirement under Privacy Safeguard 3
• Introducing a data fiduciary standard for CDR participants
• Decrease the complexity of the consent regime with its multiple forms of consent and multiple dashboards
• Introduce an unfair trading practices prohibition to the Australian Consumer Law, following on from the ACCC’s recommendation in its digital platforms inquiry. An unfair trading practices prohibition would aim to eliminate deliberate predatory practices aimed at targeting consumers (like those experiencing financial hardship) with sales approaches when they are vulnerable.

[Related: MFAA calls for BNPL inclusion in open finance]