Truly Informed Consumer Consent is Critical for Innovation and Open Finance’s Trust Goals

Did you ever check which fire safety tests your fridge or microwave passed before buying them? Do you ever fire test them yourself?

I assume that most of us would answer “no” to these questions. As a society, we agreed that it would be unreasonable to expect individual buyers to understand the fire risks and the testing protocols for household appliances. So instead, we can rely on relevant authorities to certify that the appliances we find in shops are safe.

However, the story is very different when assessing the risks associated with organisations’ use of our Personal Data. The UK General Data Protection Regulation provides individuals with Data rights and protections, e.g. the right to be informed or object. Still, in many cases, it is up to individuals to balance the risks, of loss of privacy or financial exclusion, versus the benefits like access to a service, or to a lower price, and then consent – or not – to the processing of their Data. Daniel J. Solove refers to this as a “privacy self-management” approach.

Data-driven Innovation and flagship Data-sharing initiatives, such as Open Finance, are gathering pace in Financial Services. Against this background, I believe it is essential to reflect on whether consumer consent can – on its own – give individuals meaningful control and foster an ecosystem of trust.

Open Finance, Data Innovation, and the Limitations of Consumer Consent

For those unfamiliar with it, Open Finance is a proposed regulatory initiative that will give individuals in the UK the right to request that their financial providers share their personal financial Data with authorised Third Party Providers (TPPs). These Data-sharing rights already exist for payment data – aka Open Banking. However, Open Finance will extend them to a much broader range of financial sectors and products, such as insurers, pension, or investment providers. Consumers could benefit significantly from an Open Finance ecosystem and further data-driven innovation in financial services. They could enjoy more innovative and tailored products and services, improved financial capability, and lower prices thanks to greater competition. But, at the same time, Open Finance and Data Innovation also present significant risks. According to the Financial Conduct Authority (FCA), some of the top ones relate to Data Ethics issues. They include Data-driven financial exclusion, unfair discrimination, poor outcomes for vulnerable or less Tech-savvy consumers, and low transparency and explainability of automated decisions, e.g. credit scores calculated using Artificial Intelligence (AI).

The FCA explicitly states that the use of data should “take place in a safe and ethical environment with informed consumer consent.” But the critical question is: when can consumer consent be deemed truly “informed”?

I (and Mr Solove) see some critical challenges in this respect. I will highlight three, but this is not an exhaustive list by any means:

• Our behaviours and choices are often irrational and based on incomplete knowledge.

For the sake of argument, let’s assume that businesses are 100% compliant with the Financial and Data Protection laws and that their privacy notices and contracts are as engaging and straightforward as possible. Still, Financial Services and Data Protection risks and regulations remain very complex and unfamiliar to most people, especially when innovative technologies and the use of large volumes of data are involved. This complexity will exacerbate our cognitive biases: we’ll favour immediate benefits while dismissing future risks, and rely on heuristics. This will diminish our ability as consumers to perform an adequate cost-benefit analysis – before deciding whether to grant or withhold our consent.

• Consenting to share one’s data may be the only way to access an essential service or product.

For example, it is easy to imagine a scenario where a pre-condition for most car insurance policies is consenting to share real-time car location, dashcam footage, and a driver’s behavioural data. If consumers do not wish to share this data, they may struggle to insure their cars or may need to pay higher premiums. Insurance companies may have a genuine business need to access and use that data to remain competitive and viable. Yet, a consumer’s ability to withhold their consent will be significantly impaired if doing so may result in losing access to an essential product for their everyday life. I am not sure that consent can be considered informed if withholding it would increase the risk of financial exclusion.

• We will need to manage our consent across many providers.

Discussions about consent are often conceptualised (including by me!) as a relationship between one individual and one firm. In reality, consumers interact – and will need to manage their consent – across a complex web of financial services providers. For example, I currently have contractual relationships with two banks, three credit card companies, five insurers, two pension providers, two investment platforms, and a budgeting app. I must admit I only have a very vague understanding of what Personal Data these organisations collect, why, and how they actually use it for my benefit or detriment. In my view, it is not realistic to expect the average consumer to maintain – on an ongoing basis – a fully-informed picture of the details, risks and benefits of their data-sharing and data processing agreements.

If not consent, what then?

I do believe that informed consumer consent has an essential part to play in Open Finance. My argument is that other safeguards should enhance it to make it more effective and foster trust between consumers and businesses. I do not have the ultimate answer about what these safeguards should be, nor whether regulators should impose them or companies could adopt them voluntarily. A thorough public debate is necessary to find an optimal and balanced approach. A few initial ideas for discussion could include:

• There could be default permissions and limitations regarding what Data firms can and cannot collect and how they can use it. Using the auto insurance example again, we could agree that sharing our real-time car location by default as we drive deteriorates our privacy to an unacceptable extent. On the other hand, we could agree that dashcams should be a default feature and that consumers must always share recordings with their insurers in cases of accidents.
• We could agree to require ex-ante regulatory authorisations or industry certifications before firms can deploy high-risk automated decision-making solutions. This could be the case, for example, for applications that could lead to financial exclusion or significantly impair a person’s economic opportunities. Such an approach is not miles away from what the European Union proposed with its EU AI Act.

Looking Ahead: a Necessary Conversation

I am not the first person to highlight the limitation of consumer consent in a Data-driven economy, and certainly, I am not the most eloquent on the topic. Indeed, both the Information Commissioner’s Office and the FCA are fully aware of these issues in the UK and the need to collaborate closely on them.

But in the industry debates on Open Finance and use of Customer Data that I have been a party to, these challenges are not (yet) openly debated. I often perceive a reluctance to suggest introducing additional safeguards or rules that may limit innovation. There may also be a fear of being perceived as paternalistic in implying that consumers cannot be the masters of their own affairs.

Yet, I believe we should consider and debate all options. Ultimately, Open Finance and Innovation are much more likely to succeed in the long term if consumers trust them to look after their interests and help build a better and more inclusive society.