PDCOB 11 Specific requirements where firms offer data export

This chapter applies to a firm which chooses to offer or provide data export.

A firm is not permitted to offer or provide data export, apart from:

1. (1)

   data export to the customer; or

2. (2)

   data export to itself.

A firm must not permit another person to offer or provide data export from the firm’s pensions dashboard platform.

A firm which chooses to offer data export to the firm must also offer data export to the customer.

A firm must not provide data export to the customer or to itself unless the customer has actively elected to select that specific type of data export.

A firm must not require the customer to agree to data export as a condition of using the qualifying pensions dashboard service.

The information exported to the firm by data export must include the customer’s pensions dashboard view data, subject to PDCOB 11.3.4R.

When providing data export to the customer, the firm must not export the customer’s full pension reference.

Where a firm exports a partial pension reference in accordance with PDCOB 11.3.4R, it must make a record of the rationale for the approach taken.

In good time before the customer elects to receive data export, a firm must provide the customer with appropriate information to help the customer make an informed choice as to whether or not to agree to data export. This information must include:

1. (1)

   the name of the person who is the data controller;

2. (2)

   the nature of the processing which will take place to export the data; and

3. (3)

   the purpose for which the data will be processed.

Before the customer agrees to data export, a firm must clearly and prominently display a warning to the customer about the risks of data export to the customer, including that:

1. (1)

   their data is valuable;

2. (2)

   it is important that they keep their data safe; and

3. (3)

   if the data export is being facilitated by download, the customer should avoid downloading the data on a shared device.

A firm must ensure that pensions dashboard view data exported to a customer is in a format which is accessible to a member of the general population.

The information exported by data export to the customer must include:

1. (1)

   subject to PDCOB 11.3.4R, the customer’s pensions dashboard view data; and

2. (2)

   any display explanations and contextual information which is required by PDCOB 5 and other legislation, such as the Dashboard Regulations.

The information provided by data export to the customer must be prominently accompanied by:

1. (1)

   the warning at PDCOB 5.5.1R(1);

2. (2)

   a signpost to the ScamSmart campaign - such as a link to ScamSmart - Avoid investment and pension scams | FCA;

3. (3)

   a message that the customer’s pensions dashboard view data is sensitive and valuable, and the customer should seek to keep their data safe;

4. (4)

   a message that, if the customer is asked to share their data with a third party, the customer should think carefully about whether a third party needs to see the data, check whether the third party is who they say they are and, if they claim to be authorised or exempt, should use the Financial Services Register to check; and

5. (5)

   signposts to impartial guidance available from MoneyHelper.

In good time before the customer elects to data export to the firm, a firm must provide the customer with appropriate information to help the customer make an informed choice as to whether or not to agree to data export to the firm. This information must include:

1. (1)

   the name of the persons who will be the data controllers both before and after the data is exported;

2. (2)

   the nature of the processing which will take place to export the data and once the data is exported; and

3. (3)

   the purpose for which the data will be processed both during data export to the firm and once the data has been exported.

Once the data is exported to the firm, the firm must not share the data with any other entities.

The information exported to the firm by data export must include the customer’s pensions dashboard view data, subject to PDCOB 11.3.4R.

Once the customer’s data has been exported to the firm, the firm must only process that data to deliver post-view services and to which the customer has consented.

Without prejudice to the application of the result matched startGDPRresult matched end where data has been obtained by the firm from data export, a firm:

1. (1)

   must obtain a customer’s express consent to store that data; and

2. (2)

   where consent is obtained, is permitted to store that data for 30 days from the date the customer consented in accordance with (1) above, after which period it must be deleted.

A firm is not permitted to store data obtained from data export where:

1. (1)

   the customer does not expressly consent; or

2. (2)

   the customer elected to export the data to themselves only.