Search

This thesis analyses the legal structure of open banking frameworks of the two leading common-law jurisdictions (Australia and the United Kingdom) to determine whether they should incorporate legal features equivalent to those which support efficiency and safety in banking payment systems. The analysis shows that legal assessment of open banking frameworks should include evaluation against banking law principles because of the functional equivalence of customer data and customer funds as valuable information. More specifically, this research addresses the question: Should open banking frameworks include the legal features for the sharing and use of customer banking data which are comparable to those included in banking payment systems for the payment and use of customer money? The thesis develops a conceptual framework to enable a functional comparison to be made between the laws which govern the transfer and use of customer data under open banking frameworks and those which govern the payment and holding of customer money under banking and payment systems, from the foundation that both are networks for the transfer of valuable infrormation. It uses this to compare the open banking laws and regulations of Australia and the UK by reference to the legal rights to share data, the legal responsibilities for shared data and the legal relationships in sharing data. The differences are evaluated against the legal features of banking payment systems which perform similar functions with respect to customer funds, to determine deficiencies in the frameworks' legal design. The risks that arise from these deficiencies are then identified and assessed, using a risk classification developed from communication systems and banking payment systems. From this analysis, it is concluded that the some of the legal features which support effectiveness and safety in the frameworks are impaired when evaluated against equivalent features in banking payment systems. Recommendations are made for improvements by reference to the legal features of banking payment systems. The thesis provides new principles for the legal design of open banking frameworks based on the laws which protect and promote banking payment systems. Their use can ensure that when customers are ‘banking on data’ under these frameworks they are supported and protected by legal rights, responsibilities and relationships equivalent to those which customers rely on to support and protect them when they are banking with their money.

In recent years, “data privacy” has vaulted to the forefront of public attention. Scholars, policymakers, and the media have, nearly in unison, decried the lack of data privacy in the modern world. In response, they have put forth various proposals to remedy the situation, from the imposition of fiduciary obligations on technology platforms to the creation of rights to be forgotten for individuals. All these proposals, however, share one essential assumption: we must raise greater protective barriers around data. As a scholar of corporate finance and a scholar of corporate law, respectively, we find this assumption problematic. Data, after all, is simply information, and information can be used for beneficial purposes as well as harmful ones. Just as it can be used to discriminate and to embarrass, information can be used to empower and to improve. And while data privacy is often pitched at ending unauthorized data sharing, it all too often leads simply to the end of data sharing, period. This comes at a cost. Data silos can inhibit consumer choice, protect the positions of powerful incumbents, and reduce the efficiency of markets. The best example of these costs comes from the financial industry. For more than a century, banks and other financial institutions have built their information technology systems to keep financial records as private and nonshareable as possible. While security concerns can be a primary reason for such closed systems, banks also understand that financial data is an advantage that can protect them from market entry and competition. Banks can hold up consumers with unfavorable rates and inferior products as a result, and a set of market failures make it difficult for consumers to opt out. First, information asymmetries between consumers and financial institutions are large and difficult to resolve. Second, search and switch costs—the difficulty of finding out more information about the risks and benefits of financial products and of switching to a better financial service—are high in the financial industry. Finally, individuals struggle to take advantage of even simple financial strategies to save, borrow, and invest. Data sharing can help resolve these problems. The emergence of a new regulatory and technological framework called “open banking” raises the possibility of consumers being able to task trusted intermediaries with automatically analyzing their financial data, nudging them to achieve their goals, and switching them to better products, all in order to reduce the substantial inefficiencies in their financial lives. There is one problem, however. A combination of market failure and regulatory ambiguity has led to a situation in which data is limited, siloed, and inaccessible, thereby preventing individuals from using their data in efficient ways. Ultimately, this Article contends, resolving these problems will require us to replace the clarion call of “data privacy” with a new, more comprehensive concept, that of “data autonomy”—the ability of individuals to have control over their data. Data autonomy balances the need for data to be protected and secure with the need for it to be accessible and shareable. In this Article, we lay out a set of key principles that grant individuals a legal right to data autonomy, including a right of ownership over data, as well as obligations on institutions to safely share standardized and interoperable data with third parties that consumers so choose. Perhaps counterintuitively, the only way of expanding consumer welfare and protection today is by breaking down the barriers of data privacy.