Westpac said fintech start-ups could be allowed to operate in a "sandbox" for a narrowly defined period to allow them to run pilots or tests without requiring full compliance with any regime. The parliamentary committee chaired by Liberal MP David Coleman said that customers' transaction histories, account balances, credit card usage and mortgage repayments could all be shared via "application programming interfaces". APIs are computer code allowing one party to communicate with data held in another's databases, facilitating interactivity and connectivity. The fintech industry welcomes external APIs on the basis they create a seamless experience for customers to authorise access to data, which fintechs can then use to price alternative offerings. Westpac said before an API framework was established many questions needed to be answered including whether bank liability ended when data was transferred, and obligations around confidentiality, identity verification, informed consent and governance, including privacy and data security, needed to be determined. National Australia Bank agreed that sharing customers' data must be done with the correct protocols and security regimes in place. "Moving to an open-data regime without appropriate safeguards and requirements could raise significant security concerns," a NAB spokesperson said. Commonwealth Bank of Australia appears to be adopting a more defensive approach to data sharing than the other banks. CBA believes in the principle "of always protecting the security and privacy of our customers' information and data [and] ultimately, a person's financial information should be secure and private," a spokesperson said on Monday. In a submission to the Productivity Commission, CBA warned that "if data is shared with third parties which do not offer the same level of protection, this exposes customers in the event of fraud and also puts at risk the ability of the Commonwealth Bank to continue to offer this level of assurance" that all fraud in online banking would be fully compensated. Ms Collard said ANZ was working with the Australian Payments Council on its data-sharing principles. These include ensuring data recipients adhere to the Australian Privacy Principles; data recipients are appropriately accredited to safeguard personal information; data recipients clearly indicate their intended use of data and adhere to the use; recipients specify the length of time any data will be retained, and when requested data is no longer required it is securely expunged by the recipient. After the committee report pointed to a British report that suggested each UK bank had each spent around £1 million to build open APIs, NAB said "we do not believe that overseas comparisons of costs are appropriate for an Australian initiative" and "the development of an API is likely to be a very costly exercise for banks based on the experience of implementing other regulatory streams cited earlier". Westpac said it was too early to comment on the costs of establishing open APIs. Ms Collard said it was important the Productivity Commission's inquiry on open data across the economy was allowed to finish before any changes were legislated. The commission's final report is due to be released in March next year.
Westpac has suggested that the Australian federal government should create data-sharing governance standards in order to protect the privacy of consumers and stop the loss or misuse of banking data. ANZ joined forces with Westpac, with the two firms agreeing with a parliamentary committee report requesting banks offer “open access” to customers’ data, adding the need for such standards across the sector looking at use, security and secure access. The move comes as Australia’s biggest banks, including Commonwealth Bank of Australia, National Australia Bank, ANZ, NAB and Macquarie, are all set to release their own reports on data breaches this week.