Give Canadians Control of Their Data, Starting with Banking

Goals

Canada must establish a right to data portability that enables consumers to access, download, and share their personal information across service providers. This shift will promote competition, spark innovation, and return control to Canadians over their digital lives. The first priority is implementing open banking, which is ready for execution now. Our targets:

• Immediately codify the principle of a consumer data right and begin the work to establish a clear legal framework and technical standards for data portability across healthcare, telecommunications, and energy sectors by 2027
• Go live with the first phase of open banking in 2026, allowing Canadians to securely connect their financial accounts to approved third-party services without resorting to screen scraping

‍

Background and Motivation

Everyday we generate data that shapes the services we receive and how much we pay. Today though - whether it's our banking history, medical records, or electricity usage - this personal information is controlled by the companies that collect it. We create this data but we have very little control over how it's used or shared. Our digital records are an essential part of our lives and if we want to be able to chart our futures we need to be in control.

The problems with the current paradigm are particularly evident in financial services. You may have accounts at three different institutions but no easy way to view your complete financial picture. You may want to switch from one bank to another but there are huge costs involved and it often involves long delays. All of this constrains competition leading to huge costs for Canadian consumers. To give just one example, Canada’s five big banks earned roughly $7.7 billion more in 2022 from retail banking fees than comparable UK banks – an “excess” that works out to about $250 per Canadian¹.

With open banking we can change this to give consumers true control over their data.

Say you want to check what recurring subscriptions you’re signed up for. Right now you need to access three separate apps with different, confusing interfaces. Instead you could link all of them together in less than five minutes to discover you are spending $200 monthly on subscription services you barely use, allowing you to cut costs immediately.

Or, imagine your bank introduces a new fee and you want to change providers. Today this often takes weeks and involves in-person verification, physical cheques, and manually updating payment information for bills and direct deposits. Instead with open banking you could change provider in under 15 minutes without missing a single bill payment or having to update your employer.

If you’re a small business owner, the impacts are even greater. A restaurant owner could connect their point-of-sale system to their accounting software in a few clicks, automatically reconciling daily sales and saving hours of bookkeeping each week. Alternatively, they could securely share their entire transaction history with a new payment processor, to receive lower transaction fees and better deals on business loans.

Some companies are trying to build services like this in Canada. But Canadians who want to use these new tools for managing their finances must resort to cumbersome practices like sharing bank passwords with third-party apps, because there is no standardized and secure system to share data.

While we wait around on this issue, other countries have taken action. The UK required its nine largest banks to develop standardized ways for consumers to share their data, sparking a wave of innovation in financial services. The average business now saves 150 hours annually on financial tasks², and consumers have access to powerful tools that help them save and invest. Dozens of other countries including South Korea³, Japan⁴, and Brazil⁵ have followed suit in developing open banking initiatives. (It is notable that Ukraine, despite suffering large-scale invasion three years ago, is moving forward on an open banking regime⁶). And, Australia has gone further by implementing a Consumer Data Right⁷ that extends beyond banking to energy providers and telecommunications.

Canada has been working on open banking–referred to as “Consumer-Driven Banking”– for almost seven years but significant work remains and there is no clear go-live date⁸.

By implementing open banking in the right way, we can start to make progress towards broader data portability across healthcare, telecommunications, and more. This will allow Canadians to easily switch providers, compare services, and access innovative new products. For example, a consumer could instantly share their entire mobile service history when shopping for a better plan, pressuring providers to offer better deals.

What we need is a framework for data portability. The federal privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA), does not explicitly grant Canadians a right to data portability leaving Canadians at a significant disadvantage compared to citizens of countries with more modern data rights.

Some progress has been made at the provincial level. Quebec's Law 25, which came into force in September 2024, introduced a data portability right requiring organizations to provide individuals with their personal information in a structured, commonly used technological format⁹. 

At the federal level, the government's Digital Charter released in 2019 recognized that "Canadians will have clear and manageable access to their personal data and should be free to share or transfer it without undue burden."¹⁰ but this principle has not yet been translated into any enforceable rights. Bill C-27's proposed Consumer Privacy Protection Act would give individuals the right to request their personal information be transferred between organizations, but only if both organizations are part of a "data mobility framework" — a set of rules for secure data exchange. This is the right approach but this legislation is now unlikely to become law. 

In healthcare, Bill C-72 (the Connected Care for Canadians Act) had a specific attempt to address interoperability and prevent data-blocking. But it did not go far enough and is now unlikely to become law. (To see what a real approach to interoperability in healthcare would look like read Unlock Health Records, Save Canadian Lives)

We know this is a problem but we are failing to move with urgency to solve it.

‍

Real-World Solutions

The United Kingdom transformed its financial sector through open banking, which went live in 2017 as a competition remedy ordered by the UK's Competition and Markets Authority¹¹. The UK required its nine largest banks to create standardized interfaces (APIs) that allow customers to securely share their data with authorized third parties. Five years later, over seven million consumers and businesses actively use open banking services. UK businesses using open banking save significant resources, spending on average 150 fewer hours on financial tasks annually. 

Australia's Consumer Data Right (CDR) established a comprehensive framework giving consumers the right to safely share data companies hold about them. After successfully implementing open banking in 2020, Australia extended the system to energy providers and is planning an expansion to telecommunications¹². The CDR is designed as an economy-wide reform that can expand to any sector where increased data portability would improve competition. Early results show increased switching between providers and the emergence of innovative comparison services that help consumers find better deals.

Other countries are moving ahead. Brazil included a right to data portability in Lei Geral de Proteção de Dados (LGPD). Japan amended their Act on the Protection of Personal Information to include a form of data portability¹³. Singapore amended their Personal Data Protection Act in 2020 to add a data portability provision¹⁴. And, South Korea launched a “MyData” initiative in the finance sector to empower individuals to aggregate and share their financial data¹⁵.

‍

What Needs To Be Done

We must act decisively to establish data portability as a fundamental right for Canadian consumers, starting with open banking and expanding to other sectors.

• Create a new framework for data portability across industries in Canada. We need to amend PIPEDA to explicitly establish data portability as a fundamental right for Canadian consumers. This amendment should give PIPEDA real enforcement teeth and include provisions for the development of industry-specific frameworks and standards. The legislation should establish that individuals have the right to access, download, and transfer their personal information in a structured, machine-readable format across service providers without unreasonable hindrance. The framework will create a foundation for extending data portability across sectors including healthcare, financial services, telecommunications, and energy.
  
  
• Finish the First "Read Only" Phase of open banking immediately. The government should expedite implementation of the initial phase of open banking by simplifying requirements and adopting a pragmatic approach. We should defer to existing federal privacy law consent requirements rather than creating new ones to avoid unnecessary delays. The program should allow non-accredited entities to be "sponsored" under the framework to increase participation. We must broaden the scope to include all consumer and small business financial information, not just limited account data. All financial institutions should be mandated to include chequing, savings, investment, credit products, and payment routing information in the system.
  
  
• Start a Second "Read & Write" Phase of open banking within 12 months. Beyond just allowing consumers to access their data, we must quickly move to enable third parties to initiate transactions on behalf of consenting consumers. This phase will enable truly transformative services like automated savings tools, intelligent bill payment systems, and personalized financial management applications. This capability will position Canada to leverage upcoming agentic AI innovations and allow consumers to fully benefit from their financial data. We should learn from the UK's implementation challenges and establish clear liability frameworks and dispute resolution mechanisms from the start.
  
  
• Begin the work to extend data portability to other sectors. For healthcare, implement the proposals in Unlock Health Records, Save Canadian Lives. In energy, look at Australia's model that requires energy providers to make consumer usage data available in standardized formats. Consider requiring telecommunications providers to make customer data - including usage history, service details, and account information - portable in standardized formats. This will help hasten the reforms to telecom competition as discussed in Affordable Mobile Everywhere in Canada - For Good.

‍

Common Questions

Won't giving third parties access to financial data create security and privacy risks? We're not suggesting open access, but rather secure, consumer-authorized sharing through properly regulated channels. The current situation where consumers share banking passwords with third parties is far more problematic. Our approach includes strong authentication requirements, ongoing supervision of participants, and limiting data access to only what is necessary for the authorized purpose.

Why should the government intervene rather than letting the market develop solutions? After years of industry-led initiatives showing minimal progress, it's clear that regulatory intervention is necessary. Similar market failures in the UK, Australia, and Brazil were successfully addressed through decisive government action, resulting in more competitive and innovative financial services. Even the US ultimately landed on a government-led open banking push after efforts by industry failed¹⁶.

Won't this place an unreasonable burden on Canadian banks and other businesses? Implementation costs are manageable and will be offset by new business opportunities and operational efficiencies. In the UK, even banks initially resistant to open banking now offer improved services built on the same infrastructure. We will establish reasonable timelines and provide clear technical standards to minimize implementation challenges while maximizing benefits to consumers and the broader economy.

How will you ensure vulnerable populations aren't left behind by these digital innovations? Data portability creates opportunities to better serve vulnerable populations through more accessible and affordable services. We should require that technical standards consider accessibility needs and work with community organizations to ensure vulnerable groups understand and can exercise their data rights. The government should monitor adoption across demographic groups and address any access gaps that emerge.

Isn't open banking just a solution looking for a problem? The problems are real and costly: Canadians pay billions in excessive fees, innovative startups are stymied, and millions of consumers resort to unsafe password-sharing practices to access financial tools. Countries that have implemented open banking have seen tangible benefits including reduced fees, time savings for businesses, and innovative new services. Canadians deserve the same advantages that consumers in similar countries already enjoy.

‍

Conclusion

Canada must establish data portability as a fundamental consumer right, beginning with urgent implementation of open banking. By empowering Canadians to access, control, and share their data, we will stimulate competition, reduce costs, and unlock innovation across our economy. The implementation roadmap outlined here provides a clear path forward: leveraging executive authority to launch open banking quickly, modernizing privacy legislation to establish broader data rights, and developing technical standards for secure data exchange. These actions will position Canada to catch up with global leaders and build a more dynamic, competitive economy that better serves consumers. The time for studies and consultation is over – we must act now to give Canadians control of their data.

‍

‍

‍