DSB Maintenance Iteration 10: Agenda & Meeting Notes (16 February 2022)

#DSB Maintenance Iteration 10 - Agenda & Meeting Notes (2022-02-16) Date and time: 16/02/2022, 2pm – 3:30pm AEST Location: WebEx Dial-in details: • https://treasuryau.webex.com/treasuryau/j.php?MTID=mf148de6a206fb95e1d25055ee9b7c90d • Dial In Number: +61 2 9338 2221 • Dial In Access Code: 2653 293 7148 • Quick Dial: +61-2-9338-2221,,26532937148## Australia Toll Chair: Ivan Hosgood, DSB; Maintenance overview: Further information Maintenance project board: See here Decision Proposal: This maintenance iteration is being consulted on under Decision Proposal 237

#Agenda • Wait 5 minutes for all participants to join. Kickoff at 2:05pm • Introductions • Outstanding Actions • Release plan: schedule of forwards looking standards releases • Obligation Dates • Maintenance / Release Process Changes • Open Decision Proposals: key consultation dates • Future Plan • Retrospective on Iteration 9 • Iteration 10 backlog • Any other business

Meeting notes

• Meeting Notes • Next steps Introductions This week is the first call of the 10th maintenance iteration. The purpose of the meeting is to perform a retrospective of the 9th maintenance iteration and to identify iteration candidates for the 10th maintenance iteration • Allow 5 min for participants to join • Housekeeping • Overview, purpose and intended outcomes of the meeting Outstanding Actions • ANZ to create a change request to better support cursors for returning large result sets. • (Issue #292) [IN PROGRESS] DSB to propose strawman solution • (Issue #291) [IN PROGRESS] DSB to propose strawman solution • (Issue #418) DSB will consult on a long-term strategic solution to resolve this issue however a short-term solution needs to be embedded to supports ADRs and DHs during the transition • (Issue #418) DSB to verify that the ACCC can or is providing an operational process to distribute ADR domain lists to DHs ahead of activation and DCR requests • (Issue #426) [IN PROGRESS] DSB to discuss with ADRs whether any are currently allowing token reuse • (Issue #428) [IN PROGRESS] DSB to discuss CTS support for audience claim value for DHs calling the ADR revocation endpoint • (Issue #428) [IN PROGRESS] DSB to confirm that the ACCC is updating the CTS to test the proposed wording, not the current wording • (Issue #433) [IN PROGRESS] DSB to continue discussions with the ACCC on the CTS changes and provide a response back to the community

Release plan • v1.16.0 was published on February 4th, 2022, incorporating CX standards changes from DP 222, and addressed defects from release 1.15.0 • v1.16.1 being planned. This is strictly scoped around OAS2 to OAS3 changes to make diffs straight forward • v1.17.0+: to be determined.

Obligation Dates Proposed obligation windows for 2022 2022 14th March 9th May 11th July 12th Sep 14th Nov

2023 13th March 8th May 10th July 11th Sep 13th Nov

Maintenance / Release Process Changes • OAS 3.0 files will be published in parallel to OAS 2.0 Open / Active Decision Proposals The following decision proposals are open for community feedback DP # Closing date DP 229 Placeholder Decision Proposal 229 - CDR Participant Representation

225 18/02/2022 Decision Proposal 225 - Data Recipient Security Standards

211 Pending Decision Proposal 211 - Scope of Risk-based Authentication and Identity Proofing Framework, Threat and Attack Model

210 Pending Decision Proposal 210 - Transition to FAPI 2.0 Profile

203 No closing date Normative Standards Review (2021)

Future Plan Review of Q1 and new changes: https://github.com/ConsumerDataStandardsAustralia/future-plan/projects/1

Iteration 9 Retrospective Opportunity for the community to provide feedback on the Iteration #9

Iteration 10 Backlog All open change requests can be found here: Standards Maintenance Issues. The following changes have been carried over from Iteration 9 • Confirm Register API 2022 release dates #465 • Deprecation and retirement dates for CDR Register superseded endpoint versions needs to be defined #452 • Add an unauthenticated GetDataHolderBrands endpoint exposed as a public API #444 • SSA definition: Deprecation of revocation_uri #443 • Register participant statuses do not detail data holder behaviour when ADR is revoked and SP inactive #431 • CDR Data Holders outbound connection whitelisting #418 • Alternative mechanisms for OTP #405 • Nominated representative end user for non-individual consumers #435 • Review of demand charges in energy billing transactions #423 New change requests The following change requests have been recently raised: • Sector Agnostic Register APIs #459 • Credit card balance plans and payment hierarchy: inadequate information within the CDS #292 • Credit card loyalty program data: significant gaps and lack of structure #291

Any other business • Address any other business arising from the community