-----

-  There is a safer alternative: CBA believes the Consumer Data Right (“CDR”)is a safer and preferable alternative to screen scraping. CBA, along with many other financial institutions,has invested significantlyin the development of the CDRwhich is a more secure and effective way for consumers to share their data.The CDR puts consumersin control, giving them the choice of what data they want to share with other accredited institutions and for how long. By comparison,screen scraping providesunrestricted access to customer bank accounts and offersfewcontrols tomanage consumer data security and privacy.



-  Drivingadoption and innovation with the CDR: Banning screen scraping will ensure consumers are migrated to CDR, a much safer way of sharing their data. Driving increased engagement with CDR will encourage the market toinnovate using the CDR platform driving further uptake and engagement.Banning screen scraping will also provide the context to support education campaigns to Australians to promote safer data sharing.

-  Helping reducescams and fraud:Prohibitingscreen scraping will allow both banks and the Government to provide Australians a simpler message that they should not share their banking password under any circumstances and to use CDR instead.It will also reduce the risk that consumers may lose protections under the ePayments code.CBA’s view aligns withtherecent Government reviews, such asFuture Directions for the Consumer Data Right (“Farrell Review”, 2020) and the Statutory Review of the CDR (“Statutory Review”, 2022). CBA’s position remains that screen scrapingshould be phased out, starting with more mature CDR sectors,such as banking,following a 12-month notice period. A wider banin all other sectorsshould followwith a sufficient notice period.Further, CBA encourages thataban on screen scraping should precede the commencement of action initiationand follow the implementation approach taken for major and non-major bankswithin the CDR.1.


# How is Screen scraping currently used?CBA does not currently use screen scraping or have third party arrangements with companies that deploy screen scraping technologyas defined by the discussion paper,beingthe form of screen scraping that involves consumers sharing their personal login details with third parties, such as internet banking login details.1CBA notes that the common use cases of screen scraping are well summarised by the discussion paper. The Statutory Review determined that thereis currentlysignificant use of screen scraping across the economy.2In banking and financial services, screen scraping technologytypicallyprovidesaccessto a customer’s bank account using the customer login credentials. Those credentials maybestored by the third party, which means they can scrapedata from the bank account and use this information just like the customer would. Everything acustomer can see or doin their online banking can be done by the third 1https://treasury.gov.au/sites/default/files/2023-08/c2023-436961-dp.pdf(page 4)2https://treasury.gov.au/sites/default/files/2022-09/p2022-314513-report.pdf


-----

# What are the risks of Screen scraping?Risks to ConsumersThe risks to consumers from screen scraping are well established inthe discussion paper.CBA makes the following commentary on the risks raised:


-  Counters online security best practicesat the consumer level–Asking consumers to engage in any practice in which they disclose login and password information to third parties runs counter to IT security best practices. The OAIC’s latest Notifiable Data Breaches Report: January to June 2023 shows that close to half of data breaches during the period where either compromised or stolen credentials (method unknown) orphishing attacks involving compromised credentials.7Against a backdrop of heightened security awareness following recent large-scale data breachesin Australia, it may be difficult for some consumers to navigate what actions are right for them if they are given mixed messages about the risks associated with sharing their login details. Simply offering credentials to third partiescompromises safety as often consumers share credentials in an unencrypted format and frequently use the same passwords to access a wide variety of online accounts.8

-  Counters good online practices at the enterprise and sector level –In financial services, APRA’s CPS 234 drives significant investment in the Information Security for regulated entities and yet the use of screen scraping by financial service organisations with poor Information Security protocols, which are not regulated by APRA, provide a weak link in the cyber ecosystem which can be exploited by criminals.

-  Fraud-The Basel Committee on Banking Supervision haspreviously stated screen scraping can “undermine a bank’s ability to identify fraudulent transactions, as banks cannot always distinguish between the customer, data aggregator, and an unauthorised third party that is logging in and 3https://www.oaic.gov.au/newsroom/clearview-ai-breached-australians-privacy4http://www5.austlii.edu.au/au/journals/UNSWLRS/2023/3.pdf5https://www.oaic.gov.au/newsroom/global-expectations-of-social-media-platforms-and-other-sites-to-safeguard-against-unlawful-data-scraping6https://www.scamwatch.gov.au/types-of-scams/social-media-scams7https://www.oaic.gov.au/privacy/notifiable-data-breaches/notifiable-data-breaches-publications/notifiable-data-breaches-report-january-to-june-20238CyberCX (2019), Submission to the Senate Select Committee on Financial Technology and Regulatory Technology, Submission 61, accessed on 5 October 2023


-----

-  Limited regulation and effect on vulnerable customers –Asscreen scraping is not currentlyregulated, consumers may not always understand when they are using services that rely on screen scrapingnor the associated risks. Because screen scraping involves consumers providing account login details, they may also have little control over what specific data and access the third party may have and how the consumer can end the arrangement.Jevglevskaja and Buckley (2023) have written about the dangers of screen scraping against vulnerable customers as it facilitates predatory lending.10

-  Loss of consumer protections under ePayments Code–Consumers who share their login details through screen scraping maylose protections available to them under the ePayments Code to be indemnified for losses caused by unauthorised transactions. ASIC noted in its latest review of the ePayments Code that consumers use screen scrapersat their own risk, should it amount to ‘disclosure’ of a passcode.

-  Disclosure risks in the event of a data breach–If any screen scraping providers experience data breaches in the future, large volumes of banking login details or passwords could be exposedand compromise consumer trust online,and create detrimental impacts to the digital economy.This could give rise to ‘credential stuffing’, a type of cyber incident in which a threat actor collects and uses compromised credentials, often obtainedin other data breach incidents,to access other systems and accounts without authorisation. Scraped identity and contact information posted on ‘hacking forums’ may also be used by malicious actors in targeted social engineering or phishing attacks.11Given the risks, allowing screen scraping practices to persist contravenes current advice provided by the Australian Governmentand policy priorities. For example:

-  The Government’s current 2023-2030 Cyber Strategy consultation process prioritisesefforts to build greater community awarenessin the practical steps that consumers andbusinesses can take toimprove their cyber resilience.12

-  The ACCC’s National Anti-Scam Centre and Scamwatch website advises consumers not to share login details.13

-  MyGov’s Terms of Use outlines that only users are responsiblefor their MyGov account and that users must not share credentials14; and

-  The Australian Cyber Security Centre’s ‘Guidelines for System Hardening’details guidance for system hardening includingcontrols to protect credentials.15CBA’s action to prevent screen scraping9Basel Committee on Banking Competition, Report on open banking and application programming interfaces, November 201910https://papers.ssrn.com/sol3/papers.cfm?abstract_id=438252811https://www.oaic.gov.au/newsroom/global-expectations-of-social-media-platforms-and-other-sites-to-safeguard-against-unlawful-data-scraping12https://www.homeaffairs.gov.au/reports-and-publications/submissions-and-discussion-papers/2023-2030-australian-cyber-security-strategy-discussion-paper13https://www.scamwatch.gov.au/protect-yourself/ways-to-spot-and-avoid-scams14https://my.gov.au/en/about/terms#:~:text=You%20are%20responsible%20for%20your,these%20details%20with%20anyone%20else. 15https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism/cyber-security-guidelines/guidelines-system-hardening


-----

# Reforms and Legal Frameworks related to the screen scraping 3.1 Reform and Legal FrameworksBuy-Now-Pay-LaterIn relation tocurrently proposedresponsible lending reforms to give effect to the Government’s intention to regulate the Buy Now Pay Later, CBA does not endorse screenscraping being enabled to facilitate responsible lending processes.CBA has advocated that BNPL providers should take reasonable steps to assess whether a product is right for a consumer, including by performing comprehensive credit checks.16Greater cross-sectoral designationand adoption of uplifted security profiles such as FAPI 2.0 will promote more secure and persuasive use cases developing from the CDR. The Privacy ActRegarding the Australian Government’s recent Review of the Privacy Actand subsequent response released in September 2023, CBA notes the Government’sagreement-in-principle for reforms concerning ‘fair and reasonable information handling’. While noting the Attorney-General’s response that entities will still be permitted to collect personal information, they also state that the fair and reasonable test will ensure that the impact on individuals resulting from an entity’s handling of personal information and the public interest in protecting privacy are considered alongside the entity’s interest in carrying out its activities or functions.17This new requirement promises to help protect individuals when their personal information is used in complex data processing activities, which have emerged through technological advancement, such as screen scraping. CBA supported this recommendation thoughcautioned that given that the proposed legislated factors read ambiguously on their own, and given that the test will regulate many different types of data handling practices, there will be inconsistencies when applying across the economy.18To support implementation, CBA welcomes OAIC guidance and enforcement through determinations relying on judicial consideration to provide clarity on thefair and reasonable test over time. This is outlined in the Government’s response to the Privacy Actreview.1916https://treasury.gov.au/sites/default/files/2023-02/c2022-338372-cba.pdf17https://www.ag.gov.au/sites/default/files/2023-09/government-response-privacy-act-review-report.PDF(page 8)18https://www.ag.gov.au/sites/default/files/2023-09/government-response-privacy-act-review-report.PDF(page 8)19https://www.ag.gov.au/sites/default/files/2023-09/government-response-privacy-act-review-report.PDF


-----

4.


# The Consumer Data RightCBA notesrecommendation 2.1 of the Statutory Review which outlined that “screen scraping should be banned in the near future in sectors where the CDR is a viable alternative”and welcomes theGovernment signallingwhen and how the implementation of a ban on screen scraping would take effect.As a starting point regarding suggestions on how to improve the CDR framework so that it becomes a more viable alternative to screen scraping, CBA acknowledgesthe issues raised by the Statutory Review, and substantial work that has commencedsinceto improve the performance and functionality of the CDR.These include:


-  Data quality–CBA does not see data quality as the primary issue hindering CDR take up. The ACCC have since conducted reported on Data Qualityin the CDRand while there are clear areas for improvement, found that the quality of consumer data is generally sufficient to support the delivery of CDR products and services.23Ensuring a strong regulatory presence, clarifying obligations to improve data quality, and improve consultation process which the CDR regulators have committedto will see data quality in the CDR ecosystemfurther improve.20Microsoft Word -cfpb_consumer-protection-principles_data-aggregation_stakeholder-insights clean (consumerfinance.gov)21https://www.consumerfinance.gov/about-us/newsroom/director-chopra-prepared-remarks-at-money-20-20/22CFPB Proposes Rule to Jumpstart Competition and Accelerate Shift to Open Banking | Consumer Financial Protection Bureau (consumerfinance.gov)23https://www.accc.gov.au/system/files/Data-Quality-in-the-Consumer-Data-Right-Findings-from-Stakeholder-Consultation.pdf


-----

-  Complexity of the system–the Statutory Review found that CDR rules and standards were overly complex and compliance focused which has prevented participants from developing new products and services. CBA agrees that as the CDR matures and stabilises, participants will likely develop the system to increase customer value.In the interim, policy makers should consider changes to the volume and frequency of rule changes which add complexity to the framework, increase compliancecosts, andconstrain innovation.

-  Lack of awareness–the priority around increasing consumer awareness of the CDR has been well documented in past treasury consultations. Of course, consumer awareness of the CDR will only emerge once persuasive use cases are in market. CBA believes that allowing screen scraping to continue alongside the CDR will result in perpetual ‘dual schemes’ being in operation, to the detriment of consumers as well as take up and participation in the broader CDR regime. Jevglevskaja and Buckley (2023) have shown that following tighter restrictionson screen scraping in the UK coming into effect, the UK saw a surge in API calls through their open banking framework: from 12 million a day in February 2020 to 24 million a day a year later, and up to 31 million a day in February 2022, or 860 million calls for the month. The UK experience in particular shows that even partial phasing out of screen scrapingcan act as a spur to ensure that APIs perform well and the ecosystem grows rapidly and with due attention to data quality.24In time, designation of more data sets will drive consumer awareness and use cases.In relation to when Government might determine that the CDR is a viable alternative, CBA suggests that it dependson the maturity of the sector within the CDR framework. For example, banking participants would be able to move relatively quickly compared to the energy sector and non-designatedsectors. It follows that screen scraping’s prohibition could be phased on a sectoral basisand come into effect after a 12-month notification period to enable businesses using screen scraping time to transition and ensure data holderscan support the additional volume of API calls.CBA notes there are various accreditation models under the CDR that organisationstransitioning away Screen Scraping business models can adopt, whichfacilitate innovation and competition.As the CDR ecosystem has matured, software and platform service providers have grown and enabledmodularised CDR solutions, without requiring a ground-up build.This enablesbenefits such as higher security standards, greater speed to market through streamlined pre-requisites for participation, and promotion of CDR ecosystem growth which supportsthedevelopment of Australian businesses. In additionto payment system reforms and licensing CBA recommends uplifts in PayTo standards,regarding liability and capital requirements,are executedanda screen scrapingprohibitionshould precede the commencement of action initiation within the CDR. Restricting screen scraping prior to enabling write access functionality was arationale followed bythe European Union when the Payment Service Directive (PSD2) prohibited third party payment service providers from screen scraping in advance of banks putting in place a communication channel that allows TPPs to access the data that they need in accordance with PSD2.25CBA maintains that combiningscreen scraping with write access functionality could introduce significant new risks into the CDR framework in relation to fraud.For example, without proper safeguards around payment initiation, a third party could act in malevolent ways contrary to the consumer’s express instructions. Finally, restrictions and enforcement action should be applied to the source initiating the screen scraping request. CBA urges that there should be no requirement under the legislation for data holders to apply restrictionsnor should there be penalties for blocking screen scraping activity when its identified. 24http://www5.austlii.edu.au/au/journals/UNSWLRS/2023/3.pdf25https://ec.europa.eu/commission/presscorner/detail/pl/MEMO_17_4961


-----

# Conclusion Proposals for aprohibition onscreen scrapingare consistent with CBA’s past submissions and findings from the Future Directions for the Consumer Data Right (“Farrell Review”, 2020) and the Statutory Review of the CDR (“Statutory Review”, 2022). Therisks from screen scraping are well established in thediscussion paper and elaborated on in this submission. Following high-profile data breaches and emergence of a high scams and fraud environment, addressing these risks should be a Government priority to protect against consumer harm and strengthen good cyber practices.A lack of clear action on screen scraping embeds policy inertia that will not serve the Australian digital economy in the longer term.CBAwelcomesaholistic, cross-government, approach to prohibiting screen scraping. A clear signal from Government through a legislated ban will ensure consumers are better protected, and incentivise businesses to more quickly transition to using safer means such as the CDR.


-----

