How we use open banking
Open banking allows people to share their bank transaction details in a secure and safe way.
Open banking is part of a government initiative called the Consumer Data Right (CDR).
The CDR is an Australian law that gives people greater access to, and control over, their own data. CDR is available in the banking and energy industries and will eventually be extended to telecommunications.
By sharing their data, people may be able to get better deals, manage their finances better or switch products more easily.
There is more information about the CDR below.
How does Way Forward use open banking?
Way Forward uses open banking to help us develop affordable budgets for our clients.
This means we will ask you to share details of your day-to-day transaction account(s). Some clients may also share credit card data to provide a fuller picture.
Our open banking provider is Basiq. There is a link to the Basiq platform in the Way Forward client portal.
We use information from open banking to:
- confirm other information you may have provided to us, such as your income, estimate of living expenses, or list of creditors
- understand your overall financial position. We use this to assess if we can make a realistic payment offer to your creditors.
We may share your open banking data with your creditors.
If for some reason open banking is not an option, we will ask you to provide 90 days of bank statements instead.
We need this information, as a minimum, whether through open banking or bank statements, to properly understand your financial position. Armed with this information, we can then talk to your creditors.
How does the open banking process work?
If you register to use open banking, you’ll see a series of screens similar to those shown below. The process involves:
Step 1 – Providing your consent to share your bank account data with Way Forward.
Step 2 – Selecting which bank to include. Your bank will then use some form of multi-factor authentication to securely identify you.
Step 3 – Choosing which accounts to share. You’ll be asked to “review and confirm” your choice. Your data will then be shared with Way Forward. (The screen shot below uses ANZ as an example.)
Step 4 – And finally, if you have accounts at another bank to share, you can then click “I Need to Add Another Account”. If your data is only with one bank, click “I’m Finished Sharing”.
Your choices about open banking (consent management)
When you give consent to share your banking data, you remain in control. You can manage your consent at any time – whether by reviewing it, updating or withdrawing it – using any of the following methods by:
- contacting us at assist@wayforward.org.au or on 1300 045 502
- clicking on the link in the email we sent to you after you completed the open banking process (this will take you to our open banking dashboard)
- directly through your banking app or internet banking.
Data Retention and De-identification
Initial access
We retain access to your open banking data for 90 days. We need this access in order to negotiate with your creditors, including answering questions they may have.
Data retention
We retain the open banking data you have shared with us in the form of a PDF document and a CSV file.
The CSV file is deleted permanently from our system after 90 days.
The PDF document will be retained for seven years after our last interaction with you and then deleted. Seven years is a common retention timeframe and is primarily driven by legal and regulatory obligations.
Data deletion or de-identification
You have the right to ask us to delete or de-identify your open banking data at any time. We will action such a request within two business days.
About the Consumer Data Right (CDR) and Accredited Data Recipients (ADRs)
The Consumer Data Right (CDR) regulates the collection and handling of CDR data in line with privacy safeguards and rules that:
- ensures users’ data is managed securely; and
- provides users with control over how their data is shared and used.
An Accredited Data Recipient (ADR) is an organisation that has been accredited under the CDR framework to receive and manage consumer data securely. ADRs are required to adhere to strict privacy and security rules, ensuring that a person’s data is used only with their consent. ADRs, such as Basiq, are expected to:
- transparently disclose how data is used;
- ensure secure storage and transfer of consumer data;
- implement privacy safeguards to protect user consent.
The benefits for people sharing their data under the CDR include:
- choice and control – you can decide what data to share, how it is used and to who the data can be disclosed;
- manage consent – you can view, modify or revoke consents at any time;
- data deletion requests – you can request that your data is deleted or de-identified.
For more information about the CDR, go to the Australian Government’s website about CDR.
