§ 4-16. Third-party services: what the customer can use and what the providers must follow

This section gives the customer the right to use third-party services on their own payment accounts that are accessible on the internet. The Act explains in § 1-6 that a third-party service covers both payment initiation services, which initiate payments from an account offered by another service provider (tjenesteyter), and account information services (kontoinformasjonstjenester), which are internet-based services that collect account information. The account provider cannot require that there is an agreement between itself and the third-party provider.

If the account provider refuses a third-party provider access, the customer must be told immediately, in the agreed manner, and given the reason. If possible, the notice must come before access is refused. The exception is where objectively justified security considerations are threatened, or where informing the customer would be contrary to law.

The third-party provider has its own duties. The customer's personalised security credentials must not be accessible to anyone other than the party that issued them and the customer, and any transmission must take place through secure and efficient channels. The provider must not use or store information for purposes other than the service the customer has explicitly requested, and must not ask for sensitive payment data. Account number and account holder are not considered sensitive. The service may only be performed with the customer's explicit consent, and in accordance with it.

§ 4-17 and § 4-18 set out the conditions for each type of service in more detail, and the sixth paragraph allows the Government to issue regulations on the conditions. § 4-14 requires the payment initiation service provider to provide information after an order has been initiated. § 4-19 and § 4-20 concern the information the bank itself must give the customer about the account.

Example: The customer uses a third-party service, and the account provider blocks the third-party provider's access. As a starting point, the account provider must tell the customer and give the reason, and do so beforehand if possible. If there is an objectively justified security consideration, it does not have to.