In order to improve trust in the open banking ecosystem, this work proposes a protocol for traceability---the ability for consumers to track how data is being used and shared, even (and especially) across organizational boundaries. Traceability will help achieve reliable, scalable detection of data misuse, leading to both better internal processes and more effective intervention by enforcement authorities when necessary.

The main participants in the open banking ecosystem are:

1. Consumers. Individuals who want to use digital financial services.
2. Data providers. Companies (e.g., traditional banks, payment providers, credit card providers) that hold consumer financial data.
3. Data recipients. Companies (e.g., fintechs, payment processors, credit reference agencies, regulators) that use consumer financial data to provide requested services.
4. Data access platforms. Intermediaries (e.g., API providers, data aggregators) that support data exchange between data providers and data recipients.

To facilitate traceability, we introduce the idea of a traceability service, which stores traceability information on behalf of consumers. Traceability services have three deployment models:

1. Self-hosted. Consumers self-host traceability services on their personal machines or in the cloud.
2. Third-party-hosted. Third-party providers (e.g., nongovernmental organizations, private companies) host traceability services.
3. Provider-hosted. Data providers host traceability services (given their existing trust relationships with consumers).

These traceability services will record various types of traceability attestations:

1. Policy attestations. These describe agreed-upon terms of granular consent, delineating the relevant data types, their intended usage, the duration of data retention, the conditions under which data may be reshared, and logging requirements.
2. Sharing attestations. These describe sharing actions on data elements includes information, such as the timestamps and purposes of sharing.
3. Activity attestations. These describe local actions on data elements (e.g., use, deletion) and includes information, such as the timestamps and purposes of the actions.
4. Rights attestations. These describe actions associated with data rights requests, such as consent grant, consent revocation, data access, data correction, and data deletion.

A traceability protocol is comprised of several subprotocols:

1. Traceability setup. This is a three-party protocol, involving a consumer, data controller (i.e., a data provider or a data recipient), and traceability service. The consumer authorizes the controller to interact with the traceability service on its behalf. Concretely, this can be implemented using OAuth, where the controller (either a data provider or a data recipient) is an OAuth client and the traceability service acts as the authorization and resource servers.
2. Data sharing setup. This is a four-party protocol, involving a consumer, data provider, data recipient, and traceability service. The consumer initiates data sharing between the provider and the recipient (e.g., using the FDX protocol), and the recipient and provider both post consent records to the traceability service.
3. Data sharing. This is a three-party protocol, involving a data provider, data recipient, and traceability service. The recipient requests data from the provider (e.g., using the FDX protocol), and receives the data and a "consentID" in return. Finally, the recipient and provider both post sharing attestations to the traceability service.
4. Data use. This is a two-party protocol, involving a data controller and traceability service. The controller posts an activity attestation to the traceability service.
5. Consumer rights request. This is a three-party protocol, involving a consumer, controller, and traceability service based on the Data Rights Protocol (DRP). The consumer initiates a rights request with the traceability service, which forwards the request to the controller. The controller posts a rights attestation to the traceability service.