The data being transmitted through the AA is encrypted. Also, AAs are not allowed to store, process and sell the customer’s data. This is designed to ensure AAs do not have a conflict of interest when designing processes to obtain consent for access to user data. They merely take it from one financial institution to another based on an individual's direction and consent. Contrary to the name, they cannot 'aggregate' the user’s data. AAs are not like technology companies which aggregate user’s data and create detailed user profiles.
The data AAs share is encrypted by the sender and can be decrypted only by the recipient. The end-to-end encryption and use of technology like the ‘digital signature’ makes the process much more secure than sharing paper documents. In short, the AA is completely ‘data blind’, acting only as a pipeline between financial institutions via a user.