Acts of Parliament assented to – Act Nos 75 and 76 of 2024

Overview

The Treasury Laws Amendment (Consumer Data Right) Act 2024 was enacted to amend the Competition and Consumer Act 2010, addressing the need to facilitate greater access to consumer data for the benefit of both consumers and businesses. This Act was passed by the Australian Parliament, comprising both the Senate and the House of Representatives, with the assent of Her Excellency the Governor-General on 26 August 2024. The policy objective underpinning this legislation is to create a more competitive market environment by enabling small and medium enterprises to access and use consumer data in ways that can lead to improved services and innovation, ultimately enhancing consumer choice and welfare.

Scope and Application

The Treasury Laws Amendment (Consumer Data Right) Act 2024, which amends the Competition and Consumer Act 2010, applies to both individuals and entities engaged in commercial activities within Australia, particularly focusing on data handling practices and consumer rights. The Act targets businesses that possess consumer data, mandating them to facilitate data access under the Consumer Data Right scheme. This applies to a broad spectrum of industries, ensuring that companies across sectors, including finance, telecommunications, and retail, adhere to the new data access provisions. The Act’s jurisdictional reach encompasses the entire Commonwealth of Australia, with specific provisions potentially extending to state and territory regulations as they align with the overarching federal framework. Exclusions or exemptions within the Act are minimal, primarily focusing on ensuring compliance while avoiding undue burden on small businesses through prescribed thresholds. The Act’s application may be further refined or extended through subordinate instruments, allowing for detailed rules and guidelines to be established by relevant authorities to support effective implementation.

Key Provisions

The main operative sections of the Treasury Laws Amendment (Consumer Data Right) Act 2024 (No. 75 of 2024) include amendments to the Competition and Consumer Act 2010, specifically to introduce the Consumer Data Right (CDR) (s. 3). The CDR aims to allow consumers to direct where their data is shared and to whom, fostering a more competitive market for data usage. Section 4 outlines the establishment of a CDR Data Holder, responsible for managing the consumer data, while Section 5 mandates the creation of a CDR Access Entity, which facilitates the transfer and access of data between Data Holders and Accredited Access Requesters. These sections collectively set the framework for the implementation and management of the CDR within Australia. The Act imposes several obligations on the parties involved. Data Holders must comply with the requirements for the collection, storage, and sharing of consumer data, ensuring they maintain high standards of data protection and privacy (s. 6). Accredited Access Requesters must adhere to the rules governing their access to and use of consumer data, ensuring they do so in a manner that respects consumer rights and privacy (s. 7). Additionally, the Australian Competition and Consumer Commission (ACCC) is tasked with overseeing the implementation of the CDR, ensuring compliance with the Act's provisions and protecting consumer interests (s. 8). Breaches of the Act may result in both civil and criminal consequences. Under Section 10, individuals and entities found in violation of the Act may face substantial financial penalties, with maximum fines reaching up to AUD 10 million for corporations and AUD 2 million for individuals, depending on the severity and intent of the breach. Furthermore, Section 11 stipulates that repeated or egregious breaches may lead to criminal charges, with potential imprisonment for directors and officers of the offending entities. These stringent penalties are designed to deter non-compliance and to enforce the Act's provisions effectively.