23 October 2023

Consumer Data Right Policy and Engagement Branch
Market Conduct and Digital Division
Treasury
Langton Cres
Parkes ACT 2600
data@treasury.gov.au

**Re: Screen scraping – policy and regulatory implications discussion paper**

Please find attached the submission of the Emerging Payments Association Asia (EPA Asia) to the
_Screen scraping – policy and regulatory implications discussion paper (“the Discussion Paper”)_
released by the Commonwealth Treasury in August 2023.

EPA Asia’s goal is to unify the payments agenda in the region, drive business development and
improve the regulatory landscape for all organisations within the payments value chain. We are a
community of payments organisations whose goal is to strengthen and expand the payments
industry for the benefit of all stakeholders. More information about EPA Asia can be found on our
[website www.emergingpaymentsasia.org .](http://www.emergingpaymentsasia.org/)

Please note, that while we have consulted within our membership, any views expressed in this
submission are solely the views of EPA Asia and do not necessarily represent the views of
individual contributors, EPA Asia Ambassadors or EPA Asia Members.

EPA Asia is a strong supporter of Open Data across the Asia-Pacific and has been broadly
supportive of the Australian Government’s Consumer Data Right (CDR) agenda. We broadly
support the eventual phasing out of screen scraping and its replacement with API-based, consentbased secure access to consumer data. We also believe that Government should define a
transition path and a supportive regulatory environment (both during the transition period and at the
“end state”) that finds an appropriate balance between protecting and empowering consumers,
mitigating risks, and promoting competition and innovation.

Our answers to some of the questions in the Discussion Paper are included below.

**2. Are there any other risks to consumers from sharing their login details through screen**
**scraping?**

Account holder credentials, such as username and password, provide full access to a consumer's
accounts and assets. When shared with a third-party service via screen scraping, those credentials
may be at risk either through an interception of the data or in the event of a data breach or other
form of attack. If those credentials are compromised, particularly without the knowledge of the
consumer and the account provider that could take corrective measures, a fraudster can use those
credentials to gain access to the consumer's accounts and empty the customer’s account in a
matter of minutes. The risk associated with multiple companies possessing such credentials only
magnifies the potential for a catastrophic loss of consumer funds.

There are other risks involved with the practice of screen scraping, for example screen scraping
involves the provision of credentials and access to an account at a particular point in time. The
details collected through screen scraping may not work in the future, denying the consumer access
to their account via the third-party service. Further, there is the risk to the consumer that they have
voided any regulatory or contractual rights to compensation from their account provider as a result
of sharing those credentials to a third party.

**6. Are there other proposed reforms or legal frameworks that relate to the use of screen**
**scraping?**

It would be useful to better understand how the announced changes to the Privacy Act that the
Commonwealth Government intends to introduce in 2024, such as the right to be forgotten, will or
will not apply to screen scraping and CDR.


-----

**7. Are there any other international developments that should be considered?**

Whether or not one agrees with the approach taken in Europe with PSD2 and PSD3, there is at
least clarity to both consumers and the market in respect to the transition path and end point for
screen scraping. There is clarity that screen scraping will be effectively banned and only APIs
access will be available once PSD3 comes into effect.

Further, PSD3 defines baseline functionality for API access. This provides clear guidance to
industry stakeholders as to regulatory expectations and aims to create a consistent experience for
consumers that engenders trust and drives usage. This is something that should be considered as
part of any agenda to ban screen scraping and require use of APIs.

The European experience also suggests the importance of standardising APIs. The issue the EU
experienced with PSD2 was that each financial institution could design its own APIs. This made it
difficult for third party providers to integrate across multiple APIs and aggregate financial information
across multiple FIs for a client, making aggregation of data across FIs much harder.

**8. What are your views on the comparability of screen scraping and the CDR?**

Over the long term, EPA Asia would agree that screen scraping should be banned in Australia. We
support a statutory ban within a specified time frame to give those aggregators using screen
scraping time to migrate to a secure API-based approach. We support continuing with the CDR
agenda to leverage secure, well-formed APIs as the means of integration.

However for this to proceed, data providers, and in particular FIs, must be able to properly support
APIs that enable secure consumer account access.

**9. The Statutory Review recommended that screen scraping should be banned in the near**
**future in sectors where the CDR is a viable alternative.**

**a) How should the Government determine if the CDR is a viable alternative?**

It is EPA Asia’s view that mere implementation of CDR is not necessarily enough to warrant a ban
on screen scraping. Ideally there should be widespread and easy use of APIs.

Crafting the policy response will need to keep in mind that without clear financial benefits, FIs will
treat this as a compliance requirement while third parties may have little incentive to abandon
screen scraping and embrace API-connectivity. Careful monitoring across the market will be
required.

Assignment of liability is one method that can be utilized to speed up the migration of screen
scraping to API integration. Like was done when EMV cards entered the market, consideration
should be given to assigning liability to those parties who continue to leverage screen scraping to
gain access to consumer account's financial information and only release that liability when APIs
are implemented.

**b) What are your views on a ban on screen scraping where the CDR is a viable alternative?**

As noted above, a ban on screen scraping should happen when CDR is viable. Ideally this should
be based on objective criteria that looks at the level of data provider provision, third party and
consumer uptake, impacts on competition etc as well as industry confidence and community
attitudes. There should also be significant notice provided in respect to both the commencement of
any transitional period and the end date. Care needs to be taken during any transitional period to
avoid a “soft ban” on screen scraping by data providers prior to a regulatory ban.

**c) What timeframe would be required for an industry transition away from screen scraping**
**and why?**

At this point, EPA Asia is not confident about providing exact dates, particularly as services such as
non-bank lending are not yet fully within the CDR regime. As noted above, sufficient notice needs
to be provided. Past practice would suggest a notice period of at least 12 months before any ban.


-----

We are more than happy to expand further on the items raised in this submission or to provide
further information. If you do have any comments or questions, please feel free to contact me at
camilla.bullock@emergingpaymentsasia.org or Dr Brad Pragnell at
brad.pragnell@34south45north.com.

Kind regards,

Camilla Bullock

CEO, Emerging Payments Association Asia


-----

