EXPLANATORY STATEMENT

Issued by authority of the Assistant Treasurer and Minister for Financial Services

Competition and Consumer Act 2010

Competition and Consumer (Consumer Data Right) Amendment (2025 Measures No. 1) Rules 2025

Section 56BA of the Competition and Consumer Act 2010 (‘the Act’) provides that the Minister may, by legislative instrument, make consumer data rules for designated sectors in accordance with Part IVD of the Act.

A ‘designated sector’ is a sector of the Australian economy designated, by legislative instrument made under section 56AC of the Act (‘designation instrument’), as subject to the consumer data right (‘CDR’). The designation instrument for a sector also specifies the data (‘CDR data’) that is subject to the CDR and the classes of persons who hold the CDR data. Those persons, and certain other classes of persons covered by section 56AJ of the Act, are ‘data holders’ of CDR data in that sector.

The CDR framework is set out in Part IVD of the Act and the Competition and Consumer (Consumer Data Right) Rules 2020 (‘CDR Rules’). Following a sector designation, the Minister must make consumer data rules before any rights or obligations can begin to apply in relation to that sector.

Under the CDR, individuals and businesses (‘CDR consumers’) may, through trusted third parties, request access to certain data sets relating to them. Data holders are required or authorised to provide access to the data, subject to controls ensuring the data’s quality, security and confidentiality. Data holders are also required or authorised to provide access, on request, to publicly available information on specified products that they offer.

Rules applying generally across all designated sectors are set out in Parts 1 to 9 and Schedules 1 and 2 to the CDR Rules. Sector-specific rules are set out in Schedule 3 (relating to the banking sector) and Schedule 4 (relating to the energy sector).  

The purpose of the Competition and Consumer (Consumer Data Right) Amendment (2025 Measures No. 1) Rules 2025 (‘Amending Rules’) is to extend the CDR to the non-bank lending sector and narrow the scope of CDR data for the banking and non‑bank lending sectors.

The non-bank lenders sector was designated as subject to the CDR on 21 November 2022. Extending the CDR to this sector is expected to facilitate more informed consumer engagement with both banks and non-bank lenders, leading to improved financial outcomes for individuals and businesses. From a broader perspective, expansion of the CDR to non-bank lenders will increase the availability of data, encouraging innovation in financial technology and helping consumers to better understand and manage their finances.

Because of the similarity between the banking and non-bank lenders sectors, the policy intention is to maintain regulatory consistency where possible. For this reason, Schedule 3 to the CDR Rules (‘Schedule 3’) has been selected as the vehicle for bringing non-bank lenders into the CDR. While the non-bank lenders rules are predominately found in Schedule 3 alongside the banking rules, it is still considered a separate sector.

The Amending Rules apply the following core elements of Schedule 3 to non-bank lenders:

•                 eligibility requirements for consumers seeking to make requests for CDR data;

•                 criteria setting out the scope of non-bank lenders subject to CDR data sharing obligations;

•                 the process for additional non-bank lenders to choose to participate in the CDR;

•                 provisions specifying in-scope products and data sets that may, or must, be provided on request;

•                 requirements for internal and external dispute resolution.

The Amending Rules also make changes to the core provisions that affect the obligations of data holders under Schedule 3, including the following:

•                 narrowing the scope of products and data sets that must be provided on request;

•                 enabling related data holders and data holders in white labelling arrangements to discharge each other’s data sharing obligations;

•                 introducing data sharing in relation to ‘buy now, pay later’ products, subject to a deferral timetable to allow affected authorised deposit-taking institutions (ADIs) to make the necessary IT enhancements;

•                 excluding information relating to financial hardship and repayment history from the definition of ‘customer data’;

•                 excluding consumer data relating to debts bought by debt buyers or debt collectors from the definitions of ‘voluntary consumer data’ and ‘required consumer data’;

•                 deferring obligations for entities that become ADIs after the commencement of the Amending Rules, with the aim of allowing CDR consumers timely access to product data while permitting new ADIs to complete the IT uplift needed to facilitate banking data requests.

The Amending Rules set out timeframes for the staged implementation of the CDR in the non-bank lenders sector. In addition, they make minor consequential amendments to the body of the CDR Rules to reflect the widened scope of Schedule 3.

Conditions

Before making consumer data rules, the Minister must comply with the requirements in section 56BP of the Act. First, section 56BP requires the Minister to have regard to certain matters set out in section 56AD. These include the likely effect of making the rules on the interests of consumers, the efficiency of relevant markets and the privacy and confidentiality of consumers’ information, and the likely regulatory impact of allowing the rules to impose requirements. The Minister will consider each of the relevant matters when making the Amending Rules.

Second, the Minister must, before making consumer data rules, be satisfied that the Secretary of the Department has arranged for consultation and the making of a report in accordance with section 56BQ of the Act. This requirement has been met in relation to the Amending Rules.

Third, the Minister must wait at least 60 days after the day public consultation begins before making consumer data rules. With public consultation having commenced on 26 November 2024 with publication of draft exposure rules on the Treasury website, this requirement has been met.

Consultation

Stakeholder feedback has been taken into account in developing the Amending Rules, including that provided during the following consultation processes:

•                 In December 2022, the Treasury released a consultation paper on rolling out the CDR to the non-bank lenders sector. Consultation closed on 31 January 2023.

•                 In August 2023, the Treasury released exposure draft rules, explanatory materials and a draft Privacy Impact Assessment to expand the CDR to the non‑bank lenders sector. Consultation closed on 6 October 2023.

•                 In November 2024, the Treasury released exposure draft rules, explanatory materials and a Privacy Impact Assessment to expand the CDR to the non-bank lenders sector and narrow the scope of CDR data for the banking and non-bank lending sectors. Consultation closed on 24 December 2024.

Further information

The Amending Rules are disallowable and their principal instrument – the CDR Rules – is subject to sunsetting in the ordinary way.

Details of the Amending Rules are set out in Attachment A.

A Statement of Compatibility with Human Rights is at Attachment B.

The Office of Impact Analysis (OIA) has been consulted. At the time of designation of the non-bank lending sector, the regulatory costs of bringing the sector into the CDR were estimated to be between $15.7 million and $18.6 million, averaged over 10 years (OIA ref: OBPR22-02438). The OIA has agreed that further impact analysis was not required (OIA ref: OIA24-08414).

The Amending Rules are a legislative instrument for the purposes of the Legislation Act 2003.

The Amending Rules commenced on the day after registration on the Federal Register of Legislation.

In citations of provisions in this explanatory material, unless otherwise specified, references to rules are to the CDR Rules.

ATTACHMENT A

Details of the Competition and Consumer (Consumer Data Right) Amendment (2025 Measures No. 1) Rules 2025

Section 1 – Name

This section provides that the name of the Amending Rules is the Competition and Consumer (Consumer Data Right) Amendment (2025 Measures No. 1) Rules 2025.

Section 2 – Commencement

This section provides that the Amending Rules commence on the day after they are registered on the Federal Register of Legislation.

Section 3 – Authority

This section provides that the Amending Rules are made under the Act.

Section 4 – Schedules

This section provides that each instrument specified in the Schedules to the Amending Rules is amended or repealed as set out in the applicable Schedule items, and that any other Schedule item has effect according to its terms.

Schedule 1 – Amendments

General amendments: references to non-bank lenders and miscellaneous minor changes

1.              Part 1 of Schedule 1 to the Amending Rules contains consequential amendments to provisions of the CDR Rules outside Schedule 3. These update existing references to the banking sector to add a reference to the non-bank lenders sector, and make a number of minor machinery changes to other provisions in the CDR Rules. These amendments include the following:

•                 removal of paragraphs from the simplified outlined in rule 1.4 for brevity. [Schedule 1, item 1, rule 1.4]

•                 reframing the overview of the CDR Rules in rule 1.6 to more accurately describe Schedules 3 and 4. [Schedule 1, item 2, subrules 1.6(12) and (13)]

•                 replacing the notes to the heading of rule 1.7 with a single note that removes unnecessary existing text and aligns with current drafting practice. [Schedule 1, item 4, note to rule 1.7 (heading)]

•                 updating the definition of ‘sector Schedule’ in rule 1.7 so that it denotes a Schedule to the CDR Rules that deals with ‘a particular designated sector or sectors’. This aligns with the expansion of Schedule 3 to include the non-bank lenders sector. Also included is a new provision that explicitly activates the Schedules. This allows the Schedules to modify the operation of core provisions of the CDR Rules in respect of particular sectors without being explicitly empowered to do so by the provision in question. [Schedule 1, items 3 and 5, rule 1.6A and subrule 1.7(1)]

•                 clarifying that a data holder must provide an online service that can be used to make product data requests, but only in relation to data that it holds. This is consistent with data holder practices and puts beyond doubt that a data holder is not required to provide an online service that can be used to make product data requests for data it does not hold. [Schedule 1, item 7, paragraph 1.12(1)(a)]

•                 removing wording in the simplified outlines of Parts 2 and 3 of the CDR Rules that that did not provide further assistance. [Schedule 1, items 8 and 9, rules 2.1 and 3.1]

•                 repealing various notes that do not provide further assistance, to improve readability and align with current drafting practice. [Schedule 1, items 6, 10 to 13, 15, 18 and 19, various notes in rules 1.7, 3.3, 3.4, 4.2, 5.5 and 5.25]

•                 including a note in the simplified outline of Part 4 (which deals with consumer data requests made by accredited persons) which clarifies that Schedule 3 to the CDR Rules modifies the application of Part 4 where a data holder moves from the non-bank lenders sector to the banking sector. [Schedule 1, item 14, rule 4.1]

1.              Amendments to the CDR Rules made in 2024 enabled pre-selection of consent elements. That is, the accredited person or CDR representative can present the consumer with each element of consent already selected, and seek the consumer’s agreement to all the elements so presented. The Amending Rules align the drafting for pre‑selecting fee-attracting data with the drafting of equivalent provisions for other elements of consent.

[Schedule 1, items 16 and 17, paragraphs 4.11(1)(d) and 4.20E(1)(e)]

1.              The Amending Rules clarify that remuneration is not payable in respect of an appointment to a Data Standards Advisory Committee established under Division 8.2 of the CDR Rules.

[Schedule 1, item 20, subrule 8.4(3)]

1.              Part 3 of Schedule 1 to the Amending Rules adds ‘non-bank lenders sector’ to references to ‘banking sector’ in notes in various provisions in the CDR Rules.
2.              Part 3 of Schedule 1 to the Amending Rules also substitutes ‘CDR Accreditor’ for ‘Data Recipient Accreditor’ in various provisions in the CDR Rules. This is needed following the corresponding change made by the Treasury Laws Amendment (Consumer Data Right) Act 2024.

[Schedule 1, items 37 and 38, multiple provisions in the CDR Rules]

Amendments to extend the consumer data right to the non-bank lenders sector

1.              Consistent with the CDR Rules and to support reader understanding, the Amending Rules include a simplified outline for Schedule 3, which now deals with both the banking and non-bank lenders sectors. The heading to Schedule 3 is also amended to include the non-bank lenders sector.                                   [Schedule 1, items 22 and 23, Schedule 3 to the CDR Rules (heading) and clause 1.1 of Schedule 3 to the CDR Rules]

Excluded data holders

1.              The Amending Rules exempt certain data holders from complying with the CDR Rules. Excluded data holders in the banking and non-bank lenders sectors are:

•                 registered religious bodies, such as religious charitable development funds, that offer covered products in advancing their charitable purposes; and

•                 foreign ADIs, foreign branches of domestic ADIs and restricted ADIs.

1.              The second class of excluded data holder reflects the current exemption of foreign ADIs, foreign branches of domestic ADIs and restricted ADIs from data-sharing obligations under Schedule 3.

[Schedule 1, item 23, clause 1.1A of Schedule 3 to the CDR Rules]

New or updated defined terms relating to the banking and non-bank lenders sectors

1.              New definitions are being added to clause 1.2 of Schedule 3 to the CDR Rules, including the following:

•                 ‘accounting standard’ means an accounting standard made under section 334 of the Corporations Act 2001;

•                 ‘banking sector data’ means CDR data covered by the Consumer Data Right (Authorised Deposit‑Taking Institutions) Designation 2019;

•                 ‘NBL sector’, or ‘non-bank lenders sector’ means the sector of the Australian economy designated by the NBL sector designation instrument;

•                 ‘NBL sector data’ means CDR data covered by the NBL sector designation instrument;

•                 ‘NBL sector designation instrument’ means the Consumer Data Right (Non-Bank Lenders) Designation 2022;

•                 ‘registered religious body’ means an entity registered under section 25-5 of the Australian Charities and Not-for-profits Commission Act 2012 with the purpose of advancing religion;

•                 ‘relevant non-bank lender’ has the meaning given by the NBL sector designation instrument (essentially, this definition covers registrable corporations for the purposes of section 7 of the Financial Sector (Collection of Data) Act 2001, but without the $50 million threshold in that section applying).

1.          In addition, the definition of ‘product’ has been broadened to reflect the meaning of that term in either the banking sector designation instrument or the NBL sector designation instrument, as applicable.

[Schedule 1, item 23, clause 1.2 of Schedule 3 to the CDR Rules]

Redundant defined terms

1.          The Amending Rules repeal the following defined terms that are no longer used in Schedule 3:

•                 ‘accredited ADI’;

•                 ‘any other relevant ADI’;

•                 ‘associate’;

•                 ‘initial data holder’;

•                 ‘phase 1 product’, ‘phase 2 product’ and ‘phase 3 product’.

[Schedule 1, item 23, clause 1.2 of Schedule 3 to the CDR Rules]

Defined terms relating to classes of CDR data in the banking and non-bank lenders sectors

1.          Existing clause 1.3 of Schedule 3 to the CDR Rules defines banking data sets by means of broad descriptors, combined with minimum inclusions and exclusions of key data. This approach allows flexibility for further refinement and permits the more detailed specification of data sets in the data standards.
2.          The Amending Rules extend the following existing definitions for classes of CDR data in the banking sector to the non-bank lenders sector.

•                 ‘Customer data’ means information that identifies or is about a person, including their name, contact details, and information provided at the time they acquired a covered product that relates to their eligibility to acquire that product. Eligibility information may include whether the product is only available to the person because they are an existing customer or a member of a particular class of customers (for example, concession card holders). For an individual, ‘customer data’ does not include the individual’s date of birth.

•                 ‘Account data’ means information that identifies or is about the operation of an account, including the account number, account balances and details of any authorisations on the account, such as direct debit deductions and scheduled payments, and details of payees stored with the account.

•                 ‘Transaction data’ means information that identifies or describes the characteristics of a particular transaction on an account under a covered product, including the amount, the date on which the transaction occurred, any identifier and other information provided by the counter-party to the transaction, and a description of the transaction, including how the transaction would ordinarily be characterised in the sector (such as debit, credit, fee or interest).

•                 ‘Product specific data’ means information that identifies or describes the characteristics of a covered product, such as its type, name, price, terms and conditions, customer eligibility requirements, features and associated benefits.

1.          In addition, the definition of ‘customer data’ is revised so it does not include ‘financial hardship information’ and ‘repayment history information’ within the meanings of subsections 6QA(4) and 6V(1) of the Privacy Act 1988 respectively, where the information is disclosed by or to a credit reporting body for credit reporting purposes. These types of data, as defined by the Privacy Act 1988, have been excluded to mitigate and reduce consumer harm from potential misuse of CDR data.
2.          Financial hardship information relates to an individual’s inability to meet their obligations in relation to consumer credit and the resultant introduction of an altered repayment arrangement. Repayment history information relates to an individual’s compliance in meeting their consumer credit payment obligations in a particular month. In practice, this information is presented as a code in tabular form on a consumer’s credit report. The exclusion of this information is not intended to override any data sharing obligations in relation to transaction data or any other data sets.

[Schedule 1, item 23, clause 1.3 of Schedule 3 to the CDR Rules]

Covered products for the banking and non-bank lenders sectors

1.          The Amending Rules replace the concept of phase 1, 2 and 3 products with the concept of a ‘covered product’. As CDR requirements now apply in respect of all banking products associated with the 3 phases, this change does not of itself alter the obligations of ADIs.
2.          The intention is that the list of covered products in clause 1.4 of Schedule 3 to the CDR Rules should capture retail products offered by banks and non-bank lenders. A ‘covered product’ will be subject to data sharing if it is publicly offered under a standard form contract. A note referring to section 27 of the Australian Consumer Law (ACL) is included. That section sets out matters that a court may take into account when determining whether a contract is a standard form contract. The note does not apply section 27 of the ACL to the CDR Rules, it merely guides CDR participants as to the intended meaning of ‘standard form contract’.  [Schedule 1, item 23, subclause 1.4(1) of Schedule 3 to the CDR Rules]
3.          A product does not need to be available to all members of the public in order to be publicly offered. For example, a product offered to consumers who meet certain eligibility requirements, such as small business consumers, could be publicly offered. An example of a product that is not intended to be considered publicly offered is an ‘invitation-only’ product offered to select individuals based on criteria that are not publicly available or are commercially sensitive. [Schedule 1, item 23, subclause 1.4(2) of Schedule 3 to the CDR Rules]

Buy now, pay later products

1.          Buy now, pay later (‘BNPL’) products are specified as covered products for both sectors. As outlined above, this creates new data sharing obligations for ADIs.

[Schedule 1, item 23, clause 1.4 of Schedule 3 to the CDR Rules]

1.          The introduction of data in relation to BNPL is consistent with the Government’s focus on priority use cases, such as personal financial management and lending. Including BNPL products will provide greater visibility of a consumer’s financial circumstances. Obligations for the compulsory sharing of CDR data in relation to BNPL products are aligned with the phased implementation of the CDR in non-bank lending.                                                                                                                
2.          Key characteristics of a BNPL product are intended to include, but not be limited to, the following:

•                 the involvement of a third-party financing entity;

•                 the provision of finance for consumers, which can be used to pay for purchases of goods, services and bills (but not for the purposes of supplying cash);

•                 the imposition of a fixed charge for providing credit under a prescribed limit instead of charging interest;

•                 the imposition of a fixed charge for missing a payment.

Reverse mortgages

1.          Sharing of product and consumer data in relation to reverse mortgages is voluntary. These products were assumed to be covered by the previous list of phased products for the banking sector. Therefore, to avoid doubt, reverse mortgages are also explicitly included as covered products. Their explicit inclusion is not intended to create new banking-sector obligations; instead, the voluntary sharing of data is intended to reduce costs.                                     [Schedule 1, item 23, clause 1.4, and subclauses 3.1(2) and (3) of Schedule 3 to the CDR Rules]

Trial products

1.          The Competition and Consumer (Consumer Data Right) Amendment Rules (No. 1) 2023 introduced the concept of ‘trial products’ to the CDR Rules. It provides that the CDR Rules do not apply to banking sector data relating to a trial product during the trial period, but that once a product ceases to be a trial product, the rules will apply, including to data that was generated while the product was a trial product. A trial product will cease to be a trial product from the time that either the product is supplied or offered after the end of the trial period, or the product begins to be supplied to more than 1,000 customers, counted from the time the product was first offered. The Amending Rules extend the application of these provisions relating to trial products to the non‑bank lenders sector.                                                                                              [Schedule 1, items 23 and 30, clauses 1.5 and 6.12 of Schedule 3 to the CDR Rules]

Eligible CDR consumers, account privileges and consumer dashboards

1.          The Amending Rules extend the existing additional eligibility requirements for the banking sector in Part 2 of Schedule 3 to the CDR Rules to the non-bank lenders sector by inserting references to the non-bank lenders sector as appropriate. The requirements remain the same in relation to the banking sector. Part 2 sets out eligibility requirements in addition to those imposed by rule 1.10B of the CDR Rules, defines ‘account privileges’ in respect of secondary users in both sectors, and requires data holders in both sectors to provide eligible CDR consumers with consumer dashboards.
2.          Rule 1.10B states that to be eligible in relation to a data holder, a CDR consumer:

•                 must be an individual who is 18 years or older, or a person who is not an individual; and

•                 must be an account holder or secondary user of an open account with the data holder, or a partner in a partnership for which there is an open account with the data holder.

1.          Rule 1.10B also stipulates that any additional criteria set out in a sector Schedule must be satisfied.
2.          For the banking and non-bank lenders sectors, the additional criterion is that the account mentioned in rule 1.10B must be set up in such a way that it can be accessed online. The intention is that online access to an account may involve a range of modalities, including access via an online portal (whether by logging in or using a one-time password) or app-based access.                                         [Schedule 1, item 23, clause 2.1 of Schedule 3 to the CDR Rules]
3.          Under the CDR Rules, a ‘secondary user’ of an account with a data holder in a designated sector is a person over 18 who has account privileges in relation to the account and is endorsed by the account holder as a secondary user. ‘Account privileges’, for a sector, has the meaning set out in the Schedule relating to that sector. (See subrule 1.7(1) of the CDR Rules for both definitions). A person with ‘account privileges’ is defined in Schedule 3 as a person able to make transactions on an account for a covered product.                                           [Schedule 1, item 23, clause 2.2 of Schedule 3 to the CDR Rules]
4.          If a data holder in the banking or non-bank lenders sector receives a consumer data request on behalf of an eligible CDR consumer, the data holder must provide the consumer with the consumer dashboard. This remains consistent with existing settings in the banking sector and is applied to the non-bank lenders sector.                                                                                                       [Schedule 1, item 23, clause 2.3 of Schedule 3 to the CDR Rules]

Banking and non-bank lenders sector data that may be accessed under the CDR Rules

1.          The Amending Rules repeal and substitute Part 3 of Schedule 3 to the CDR Rules. This Part deals with CDR data that may be accessed under the CDR Rules.
2.          The Amending Rules reproduce what is required product data for the banking sector, with some modification and simplification, and apply it to both the banking and non‑bank lenders sectors. Required product data for both sectors is data in the respective sector that is product specific data about a covered product and is held by the data holder in a digital form.
3.          To reduce compliance costs for data holders, the Amending Rules exclude certain data that relates to covered products from being required product data. These products are foreign currency accounts, consumer leases, reverse mortgages, margin loans, and asset finance that is non-standard vehicle finance. Non-standard vehicle finance is intended to include products such as novated leases and fleet finance. For completeness, data about standard vehicle finance products will continue to be required data.
4.          CDR data on these products may still be shared voluntarily.

[Schedule 1, item 23, clause 3.1 of Schedule 3 to the CDR Rules]

1.          The Amending Rules introduce the concept of a ‘relevant account’ that is applicable to Schedule 3 to the CDR Rules. This amendment achieves consistency with Schedule 4 to the CDR Rules and is not intended to affect the practical operation of how consumer data will continue to be shared in the banking sector. A relevant account in relation to a CDR consumer means is an account that is held with a data holder of banking or non-bank lending sector data that:

•                 is in the name of the CDR consumer alone; or

•                 is a joint account of which the CDR consumer is one of the account holders; or

•                 is a partnership account for a partnership in which the CDR consumer is a partner; or

•                 is an account for which the CDR consumer is a secondary user.

[Schedule 1, item 23, subclause 3.2(1) of Schedule 3 to the CDR Rules]

1.          The Amending Rules also reproduce what is ‘required consumer data’ for the banking sector, with some modification and simplification, and apply it to both the banking and non-bank lenders sectors. Required consumer data is banking or non-bank lenders sector CDR data that relates to a CDR consumer’s relevant account and is held by the data holder in digital form.
2.          To reduce compliance costs for data holders, as for required product data, the Amending Rules exclude certain data from being required consumer data (although data about these excluded products may still be shared voluntarily). These products are the same as those listed above in relation to required product data. As above, CDR data on these products may still be shared voluntarily.

[Schedule 1, item 23, subclauses 3.2(2) and (3) of Schedule 3 to the CDR Rules]

1.          The Amending Rules largely preserve the existing circumstances in which data is not required consumer data but could be voluntary consumer data, and apply these exclusions to the non-bank lenders sector. These exclusions cover the following:

•                 historical data relating to transactions occurring more than 2 years before the time a data request is made, where the relevant account is an open account (down from the previous 7-year rule);

•                 direct debit deductions that occurred more than 13 months before the time a data request is made, where the relevant account is an open account; and

•                 data that relates to a relevant account that is a closed account.

[Schedule 1, item 23, subclauses 3.2(4), (6) and (7) of Schedule 3 to the CDR Rules]

1.          The rationale for excluding data relating to transactions older than 2 years for open accounts, and all data relating to closed accounts, from data that can be required to be disclosed, is to:

•                 avoid significant build costs to non-bank lending data holders;

•                 recognise that smaller data holders may incur disproportionate costs from being required to make historic or closed account data available; and

•                 relieve data holders of costs involved in retaining and maintaining readiness to respond to data requests for data unlikely to be valuable for priority use cases.

1.          The Amending Rules do not have a retrospective impact on a consent that a consumer has given in the past prior to the Amending Rules taking effect, which includes information shared under a consent related to a closed account prior to the Amending Rules taking effect. The Amending Rules will only impact consents given after the time of the Amending Rules taking effect.
2.          The Government can reassess the value proposition of closed account data if valuable use cases are identified.
3.          In addition, the Amending Rules specify that certain data sets are excluded from data‑sharing under the CDR regime. This is done by setting out circumstances in which the relevant data is neither required nor voluntary consumer data.
4.          A new exclusion relates to CDR data in respect of the debt of a CDR consumer, if the data was acquired by a data holder in its capacity as a debt collector or debt buyer.
5.          This aims to exclude balances bought from other lenders where the customer is in financial hardship and has defaulted on their payments. Individuals who are subject to debt collection are likely to be in financial hardship. Accordingly, the mere fact that an individual’s debt is with a debt collector is likely to signal financial hardship. To protect such individuals, such data is outside the scope of the CDR in the banking and non-bank lenders sectors.

[Schedule 1, item 23, subclause 3.2(5) of Schedule 3 to the CDR Rules]

Dispute resolution processes in the non-bank lenders sector

1.          Under the CDR Rules, the expressions ‘meet the internal dispute resolution requirements’ and ‘meet the external dispute resolution requirements’ have sector‑specific meanings. Existing Part 5 of Schedule 3 sets out what it means to meet these requirements in the banking sector. This Part will be extended to cover the non‑bank lenders sector. Broadly, the intention is to reflect existing dispute resolution arrangements in the non-bank lenders sector rather than to impose new obligations. This is discussed in more detail below.                     [Schedule 1, item 24, Part 5 of Schedule 3 to the CDR Rules (heading)]

Meeting internal dispute resolution requirements

1.          Accredited persons and data holders must comply with the Australian Securities and Investments Commission’s Regulatory Guide 271. That guide deals with matters such as commitment and culture, the enabling of complaints, resourcing, responsiveness, objectivity and fairness, complaint data collection or recording, and internal reporting and analysis of complaint data.

[Schedule 1, items 25 to 28, clause 5.1 of Schedule 3 to the CDR Rules]

Meeting external dispute resolution requirements

1.          Accredited persons and data holders must be members of the external dispute resolution scheme operated by the Australian Financial Complaints Authority (AFCA).
2.          The scheme operated by AFCA is recognised as an external dispute resolution scheme in relation to the banking sector under the Competition and Consumer (Consumer Data Right – Recognised External Dispute Resolution Schemes) Instrument 2021 (made for the purposes of section 56DA of the Act). The intention is that that instrument will be amended to extend the recognition of AFCA to the non-bank lenders sector.
3.          The policy intent in relation to external dispute resolution scheme membership is to reflect existing arrangements in the non-bank lenders sector. It is expected that accredited persons and most, if not all, data holders would already be members of the recognised scheme. If either the Office of the Australian Information Commissioner (OAIC) or the Australian Competition and Consumer Commission (ACCC), as co‑regulators of the CDR, receives a CDR consumer complaint in relation to the non‑bank lenders sector, the matter may be transferred to AFCA. In practice, this transfer will happen if the matter is best dealt with by AFCA, noting that there may be circumstances where the complaint is more appropriately dealt with via compliance action from the ACCC or OAIC. This ‘no wrong door’ approach reflects that taken in previous sectors, allowing disputes to be handled by the appropriate body and facilitating a seamless, consumer-centric experience.                                                       [Schedule 1, item 29, clause 5.2 of Schedule 3 to the CDR Rules]

Staged application of the CDR Rules to the non-bank lenders sector

1.          The Amending Rules repeal existing Part 6 of Schedule 3 and substitute a new Part 6 dealing principally with staged implementation for the non-bank lenders sector. Obligations are switched on progressively on the basis of both classes of non-bank lenders and categories of data to be shared. The new Part 6 preserves the ability for banks to voluntarily participate in data sharing and extends this option to non-bank lenders.                                                                             [Schedule 1, item 30, Part 6 of Schedule 3 to the CDR Rules]

Classes of non-bank lenders

1.          Non-bank lenders with data sharing obligations are classified as initial or large providers.
2.          An ‘initial provider’ is a data holder of NBL sector data that, on the commencement of the Amending Rules (the “commencement day”):

•                 has reported to the Australian Prudential Regulation Authority (APRA) under the applicable standards more than $10 billion in resident loans and finance leases for the calendar month before the commencement day; and

•                 has averaged over $10 billion in resident loans and finance leases over the previous 12 months before the commencement day, based on its reporting to APRA under the applicable standards.

1.          A ‘large provider’ is a data holder of NBL sector data that is not an initial provider and, on the commencement of the Amending Rules or on a 1 July of a later year:

•                 has reported to APRA under the applicable standards over $1 billion in resident loans and finance leases for the calendar month preceding that date; and

•                 has averaged over $1 billion in resident loans and finance leases over the previous 12 months, based on its reporting to APRA under the applicable standards; and

•                 has more than 1,000 customers.

1.          The total value of the lender’s resident loans and finance lease balances is to be calculated in accordance with the applicable accounting standards and standards made by APRA under the Financial Sector (Collection of Data) Act 2001.
2.          In calculating the averaged value of resident loans and leases reported over the 12‑month period, any calendar month in which no report was made by the lender or any of its associated non-bank lenders is disregarded.
3.          For example, Lender A has reported the total value of its resident loans and leases for 10 out of the past 12 months. When calculating the average value Lender A sums the values reported for each month and divides by 10.
4.          In addition, for both initial providers and large providers, the total value for a lender includes the resident loans and finance leases reported by the lender itself, and those reported by each of its associated non-bank lenders. A relevant non-bank lender (the first lender) will be an ‘associated non-bank lender’ of another relevant non-bank lender (the second lender) if any of the following apply:

•                 the first lender is a related body corporate (within the meaning of subsection 4A(5) of the Act) of the second lender;

•                 the first lender has an arrangement with the second lender in relation to the administration, offering, provision or underwriting of resident loans or resident finance leases;

•                 the second lender has an arrangement with the first lender for the administration, offering, provision or underwriting of resident loans or resident finance leases.

1.          For example, if:

•                 Lender A has reported a total value of resident loans and resident finance leases of $750 million to APRA under the applicable standards in relation to the most recent calendar month for which a report was made prior to the Amending Rules commencing; and

•                 Lender A has no associated non-bank lenders,

then it is intended that the limb of the large provider qualification at clause 6.2(3)(a)(i) of Schedule 3 to the Amending Rules would not be met. This would mean that Lender A would not be a non-bank lender with data sharing obligations.

1.          However, if:

•                 Lender B is a relevant non-bank lender and a related body corporate of Lender A (within the meaning of subsection 4A(5) of the Act); and

•                 Lender B has reported a total value of resident loans and resident finance leases of $300 million to APRA under the applicable standards in relation to the most recent calendar month for which a report was made prior to the Amending Rules commencing,

then it is intended that the limb of the large provider qualification at clause 6.2(3)(a)(i) of Schedule 3 to the Amending Rules would be met by both Lender A and Lender B as $750 million + $300 million is over $1 billion. If the other elements of the large provider qualification are also met, either or both lenders may be a non-bank lender with data sharing obligations.  

1.          This approach is intended to account for the complexity of lending arrangements in the non-bank lenders sector. It is to recognise that the amount of loans and finance leases reported by a particular lender to APRA under the applicable standards may not by itself be reflective of the capacity of the lender to meet CDR data sharing obligations. In such cases, under the Amending Rules, the position of any other lenders which are a related body corporate of the lender or which have another arrangement with the lender, such as for underwriting or contract management, will be taken into account.
2.          ‘Resident finance lease’ means a finance lease within the meaning of the accounting standard known as AASB 16 – Leases, if the lease is issued to persons who are resident institutional units for the purposes of Reporting Standard ARS 701.0 – ABS/RBA Definitions for the EFS Collection. That standard is currently set out in the Financial Sector (Collection of Data) (reporting standard) determination No. 5 of 2024.
3.          A ‘loan’ is a financial asset that has been created by the lender directly lending funds to a debtor which is evidenced in non-negotiable documents. A ‘resident loan’ is a loan issued by the lender to a person or group of individuals whose principal place of residence or business is in Australia.
4.          Non-bank lenders that hold NBL sector data and are also accredited persons are deemed to be large providers for the purposes of the phase-in timetable, even if they have not met the reporting criteria described above to be a large provider. Obligations for both product and consumer data sharing apply to such data holders.
5.          If such a non-bank lender ceases to be an accredited person on a later day and has not at any point before that later day met the reporting criteria to be a large provider described above, they are taken to also cease to meet the large provider qualification on that day.
6.          If a non-bank lender satisfies the ‘initial provider’ or ‘large provider’ definition the intention is that, from that point, the lender must comply with all relevant CDR obligations, even if it subsequently ceases to meet any of the criteria. For example, if a non-bank lender meets the definition of a ‘large provider’ but at a later time has fewer than 1,000 customers, it will continue to be subject to data sharing obligations. This will apply when a relevant non-bank lender has met the applicable criteria, which is appropriate as it is likely that such a lender will have ongoing capacity to meet their CDR obligations.                                    [Schedule 1, item 30, clause 6.2 of Schedule 3 to the CDR Rules]

Relevant non-bank lender that does not hold required consumer or product data

1.          Where a lender meets the initial provider qualification or large provider qualification but does not hold any required consumer data or required product data, it is not intended that the lender would be required to meet CDR obligations such as to provide data request services, undertake ACCC registration processes, map out systems and processes, or build and test for data sharing.
2.          In this case, a lender is not expected to bear the costs and burden of meeting CDR obligations unless the obligations otherwise apply, for example because the lender is an accredited person or has followed the process for voluntary application of the CDR Rules.

Notifying ACCC about customer numbers

1.          To simplify administration, a relevant non-bank lender that meets the requisite total value of resident loans and leases thresholds described above must notify the ACCC as soon as practicable after it has met the total value threshold but not the 1,000 customer threshold. This is to assist the ACCC to identify whether a non-bank lender meets the criteria to be a large provider. This obligation is subject to a civil penalty. Non-bank lenders separately provide information relevant to the total value threshold to APRA.                                             [Schedule 1, item 30, subclause 6.3(2) of Schedule 3 to the CDR Rules]
2.          In addition, if requested by the ACCC, non-bank lenders must provide the total value of resident loans and leases and indicate whether the lender also satisfies the customer numbers threshold. This obligation is subject to a civil penalty.  [Schedule 1, item 30, subclause 6.3(1) of Schedule 3 to the CDR Rules]

Timetable for the staged implementation

1.          The Amending Rules include dates for the staged implementation of data sharing obligations.
2.          Tranche 1 of the rollout begins on 13 July 2026, when Part 2 of the CDR Rules, which deals with product data requests, begins to apply to initial and large providers. This will result in product data being made available as early as possible to consumers while allowing non-bank lenders time to prepare the necessary infrastructure for responding to consumer data requests.
3.          Tranche 2 of the rollout begins on 9 November 2026, when Part 4 of the CDR Rules, which deals with consumer data requests, begins to apply to initial providers, except in respect of complex requests.
4.          Tranche 3 of the rollout begins on 10 May 2027, when Part 4 of the CDR Rules begins to apply to large providers, except in respect of complex requests.
5.          The Amending Rules introduce the concept of ‘complex request’ into Schedule 3, and specify that the CDR Rules do not apply to a complex request under Part 4 in relation to a relevant non-bank lender that is an initial provider or a large provider. A ‘complex request’ is defined as a consumer data request that:

•                 is made on behalf of a secondary user of the consumer; or

•                 relates to a joint account or a partnership account; or

•                 is made on behalf of a non-individual CDR consumer whose authorisations are handled by a nominated representative.

1.          The policy intent of carving out complex requests is to avoid unnecessary or duplicative compliance burden for how non-bank lenders comply with this requirement. Non-bank lenders will not be required to meet data holder obligations relevant to complex requests (being requests via the nominated representatives process, joint accounts and secondary users) that are currently in effect in the banking and energy sectors. This includes, not being required to provide the services referred to in paragraphs 1.13(1)(c) to (e) of the CDR Rules, on the basis that these paragraphs relate to services required to respond to complex requests which non-bank lenders will not be obliged to respond to.
2.          The timing for obligations to comply with consumer data requests, which has been decided in consultation with stakeholders, is intended to provide relevant non-bank lenders with appropriate time to uplift consumer authentication standards and associated IT builds.

[Schedule 1, item 30, clauses 6.1, 6.4 and 6.5 of Schedule 3 to the CDR Rules]

1.          This timetable is modified in respect of certain large providers, as set out below.

Deferred compliance arrangements for certain data holders

1.          The timing for the application of the CDR Rules to large providers is deferred based on when they attained that status. They are divided into two classes: those that were large providers on or before 13 July 2025, and those that become large providers after that date.
2.          A large provider that attains that status on or before 13 July 2025 is required or authorised to share CDR data, for product data requests under Part 2 of the CDR Rules—on and after the tranche 1 date, and for consumer data requests under Part 4 other than complex requests—on and after the tranche 3 date.
3.          Non-bank lenders that become large providers after 13 July 2025, are required or authorised to share CDR data, for product data requests under Part 2 of the CDR Rules—12 months after the day they became a large provider, and for consumer data requests under Part 4 other than complex requests—15 months after that day.
4.          As explained above, it is not intended that non-bank lenders will need to comply with the CDR Rules in relation to complex requests.

[Schedule 1, item 30, clause 6.5 of Schedule 3 to the CDR Rules]

1.          The CDR Rules will apply to an entity that becomes an unrestricted ADI after the commencement of the Amending Rules as follows:

•                 in respect of a product data request—on and after the day that is 12 months after the entity becomes an unrestricted ADI;

•                 in respect of a consumer data request made by an accredited person, other than a complex request—on and after the day that is 15 months after the entity becomes an unrestricted ADI;

•                 in respect of a complex request made by an accredited person—on and after the day that is 18 months after the entity becomes an unrestricted ADI.

[Schedule 1, item 30, clause 6.9 of Schedule 3 to the CDR Rules]

Compliance schedule for providers of BNPL products

1.          The Amending Rules set out new data sharing obligations for banking data holders that offer BNPL products. The commencement of data sharing obligations for these data holders depends on when the data holder starts offering BNPL products.
2.          If a banking data holder has offered BNPL products on or before 13 July 2026 (that is, the tranche 1 date), it must share data from the following dates:

•                 for product data requests under Part 2 of the CDR Rules – the tranche 1 date;

•                 for consumer data requests under Part 4 of the CDR Rules, other than complex requests – the tranche 2 date.

1.          If a banking data holder starts to offer a BNPL product after 13 July 2026 (that is, the tranche 1 date), the data sharing obligations depend on when the data holder started to offer that product. It may or must share such data from the following dates:

•                 for product data requests under Part 2 of the CDR Rules – 12 months after the day it first offered the BNPL product;

•                 for consumer data requests under Part 4 of the CDR Rules, other than complex requests – 15 months after the day it first offered the BNPL product.

1.          However, the deferred compliance arrangements cease on the tranche 3 date. That is, for a banking data holder that starts offering BNPL products after 10 May 2027, all data sharing obligations apply immediately as they do for other new products offered by banking data holders.
2.          As with non-bank lenders obligations outlined above, it is not intended that data holders should be required to comply with complex requests under Part 4 of the CDR Rules in relation to BNPL products.
3.           Obligations for the compulsory sharing of CDR data in relation to BNPL products is aligned with the phased implementation of the CDR in non-bank lending.
4.          The CDR Rules do not apply to a request made by an accredited person for CDR data in relation to a data holder in respect of CDR data that relates to a BNPL product.

[Schedule 1, item 30, clause 6.10 of Schedule 3 to the CDR Rules]

Voluntary participation by non-bank lenders

1.          Non-bank lenders that do not qualify as ‘initial providers’ or ‘large providers’, are not ‘excluded data holders’, and are not accredited, are exempt from having to provide product and consumer data, but can do so voluntarily.
2.          If a non-bank lender chooses to participate in the CDR, it must comply with all relevant CDR obligations.
3.          Non-bank lenders in all classes may choose to disclose data in accordance with the CDR Rules before their compliance date. For example, early data sharing may be undertaken for testing purposes.

[Schedule 1, item 30, clause 6.11 of Schedule 3 to the CDR Rules]

1.          The Amending Rules clarify that the CDR Rules will only apply to a relevant non-bank lender that:

•                 is an initial provider;

•                 is a large provider; or

•                 has voluntarily chosen to comply with relevant CDR Rules by notifying the ACCC that it wises Part 2 or Part 4 of the CDR Rules to apply to it from a specified date.

[Schedule 1, item 30, clause 6.6 of Schedule 3 to the CDR Rules]  

Non-applicability of Part 3 of the CDR Rules

1.          As is the case with the energy sector, direct-to-consumer data sharing is not enabled for the banking and NBL sectors.

[Schedule 1, item 30, clauses 6.7 and 6.8 of Schedule 3 to the CDR Rules]

Other rules and modifications relating to the banking and non-bank lenders sectors

1.          Part 7 of Schedule 3 to the CDR Rules sets out modifications of the CDR Rules for the banking sector and contains other miscellaneous provisions.
2.          The heading of Part 7 and the heading and text of clause 7.1 (about laws relevant to management of CDR data) are amended by adding “NBL sector” to existing references to “banking sector”.                                                       [Schedule 1, item 31, Part 7 (heading) of Schedule 3 to the CDR Rules]
3.          In addition, clause 7.2, which sets out conditions that accredited persons must meet in order to become data holders for the purposes of subsection 56AJ(4) of the Act, is amended to include non-bank lenders. The Amending Rules also clarify that this mechanism only applies if the ADI or non-bank lender in question is already subject to data sharing obligations under Part 6 of Schedule 3 to the CDR Rules in their capacity as a data holder of other CDR data. The ADI or non-bank lender will be subject to the privacy obligations that ordinarily apply to a data holder in such a situation.

[Schedule 1, items 33 to 35, clauses 7.1 and 7.2 of Schedule 3 to the CDR Rules]

Data holder may comply on behalf of another data holder in banking and NBL sectors

1.          A new clause is added to allow a data holder in the banking or NBL sector to elect to comply with the CDR Rules in the place of another data holder in the banking or NBL sector in relation to a covered product, where either:

•                 the first-mentioned data holder enters into the contract with the consumer to provide the product, but the second-mentioned data holder offers the product on behalf of the first-mentioned data holder; or

•                 both data holders are related bodies corporate for the purposes of the Act.

1.          Such an election must be made in writing, and once made, the CDR Rules apply to the first-mentioned data holder in relation to the product as if it were the second-mentioned data holder.

[Schedule 1, item 32, clause 7.1A of Schedule 3 to the CDR Rules]

1.          This clause provides data holders with the ability to transfer obligations in situations where the consumer facing entity would not ordinarily be required to comply with the relevant data holder obligations, but where it is more appropriate that they are the entity that complies.
2.      The mechanism is intended to be available, for example, where one entity (the lender of record) issues a product to a CDR consumer that is branded, marketed, and retailed to the CDR consumer by another entity (manager of the loan). In this situation, provided both entities are data holders in either the banking or non-bank lenders sector and are related bodies corporate, it is intended that the entities can agree that the manager of the loan takes on the data sharing obligations that would otherwise apply to the lender of record.
3.      The mechanism is also available for transfer of data sharing obligations between a data holder in the NBL sector and a data holder in the banking sector. This is to make the mechanism available to data holders which are related bodies corporate for the purposes of the Act but are different types of entities and therefore captured in scope of the CDR in different sectors.
4.      Note that this mechanism has not been extended to data holders in the energy sector.
5.      Where data holders have agreed to an election as described above, the first‑mentioned data holder must keep a record of the election in accordance with their record-keeping obligations under rule 9.3.

[Schedule 1, item 21, paragraph 9.3(1)(db)]

New Part 8 – entities transitioning from NBL sector to banking sector

1.      The Amending Rules add a new Part 8 to Schedule 3 to the CDR Rules to clarify the CDR obligations of an entity that ceases to be a non-bank lender in the NBL sector and, immediately afterwards, becomes a data holder in the banking sector.
2.      In these circumstances, if a product or consumer data request was in progress in the NBL sector, that request is taken to relate to the banking sector data of the data holder and must be dealt with accordingly. That is, if a consent or authorisation relates to such a request, the consent or authorisation does not expire merely because the entity has become a data holder in the banking sector.
3.      As soon as practicable after an entity becomes a data holder in the banking sector, it must notify its CDR consumers that it has ceased to operate in the NBL sector, is now operating in the banking sector, and that consumers may, under rules 4.13, 4.20J and 4.25 of the CDR Rules, choose to withdraw any consents and authorisations given in respect of existing consumer data requests. [Schedule 1, items 14 and 36, rule 4.1 and clause 8.1 of Schedule 3 to the CDR Rules]

ATTACHMENT B

Statement of Compatibility with Human Rights

Prepared in accordance with Part 3 of the Human Rights (Parliamentary Scrutiny) Act 2011

Competition and Consumer (Consumer Data Right) Amendment (2025 Measures No. 1) Rules 2025

This Legislative Instrument is compatible with the human rights and freedoms recognised or declared in the international instruments listed in section 3 of the Human Rights (Parliamentary Scrutiny) Act 2011.

Overview of the Legislative Instrument

The Competition and Consumer (Consumer Data Right) Amendment (2025 Measures No. 1) Rules 2025 (the Amending Rules) extend the consumer data right (CDR) to the non-bank lending sector. They also narrow the scope of CDR data for the banking sector.

The CDR framework is set out in Part IVD of the Competition and Consumer Act 2010 (the Act) and the Competition and Consumer (Consumer Data Right) Rules 2020 (‘CDR Rules’).

Under the CDR, individuals and businesses (‘CDR consumers’) may, through trusted third parties, request access to certain data sets relating to them. Data holders are required or authorised to provide access to the data, subject to controls ensuring the data’s quality, security and confidentiality. Data holders are also required or authorised to provide access, on request, to publicly available information on specified products that they offer.

Extending the CDR to the non-bank lenders sector is expected to facilitate more informed consumer engagement with both banks and non-bank lenders, leading to improved financial outcomes for individuals and businesses. From a broader perspective, expansion of the CDR to non-bank lenders will increase the availability of data, encouraging innovation in financial technology and helping consumers to better understand and manage their finances.

The Amending Rules apply the following to non-bank lenders:

•                 eligibility requirements for consumers seeking to make requests for CDR data;

•                 criteria setting out the scope of non-bank lenders subject to CDR data sharing obligations;

•                 the process for additional non-bank lenders to choose to participate in the CDR;

•                 provisions specifying in-scope products and data sets that may, or must, be provided on request;

•                 requirements for internal and external dispute resolution.

The Amending Rules also make changes to the obligations of data holders in the banking sector (some of which correspondingly apply to the non-bank lenders sector), including the following:

•                 narrowing the scope of products and data sets that must be provided on request;

•                 enabling related data holders and data holders in white labelling arrangements to discharge each other’s data sharing obligations;

•                 introducing data sharing in relation to ‘buy now, pay later’ products;

•                 making certain exclusions for information about financial hardship, repayment history, and debts bought by debt buyers or debt collectors;

•                 deferring obligations for entities that become authorised deposit-taking institutions (ADIs) after the commencement of the Amending Rules, with the aim of allowing CDR consumers timely access to product data while permitting new ADIs to complete the IT uplift needed to facilitate banking data requests.

Human rights implications

The Amending Rules engage the right to protection from unlawful or arbitrary interference with privacy under Article 17 of the International Covenant on Civil and Political Rights (ICCPR) because they make amendments that impact on the disclosure of consumers’ CDR data.

The right in Article 17 may be subject to permissible limitations, where these limitations are authorised by law and are not arbitrary. In order for an interference with the right to privacy to be permissible, the interference must be authorised by law, be for a reason consistent with the ICCPR and be reasonable in the particular circumstances. The UN Human Rights Committee has interpreted the requirement of ‘reasonableness’ to imply that any interference with privacy must be proportional to the end sought and be necessary in the circumstances of any given case.

Extension of the CDR to the non-bank lenders sector generally

In the context of the non-bank lenders sector, the Amending Rules enable a person to directly access or to direct another person or entity to disclose personal information about themselves to another person or entity.

Under the existing CDR Rules, data holders can disclose consumer data to accredited data recipients, where the consumer to whom the data pertains has provided consent for their data to be transferred. The privacy of the consumer is protected by several privacy safeguards and other obligations that require data holders and accredited data recipients to ensure the protection of the consumers for whom they hold data.

The Amending Rules provide for new data holders – being non-bank lenders – to disclose consumer data to accredited data recipients using the existing mechanisms in the CDR Rules. To the extent that privacy safeguards and civil penalties apply to accredited data recipients in the CDR, they will also apply to accredited data recipients when they deal with non-bank lender sector CDR data.

The CDR is a right for consumers to authorise data sharing and use. Pursuant to the CDR framework, the disclosure of personal information is generally only permitted if the party seeking to disclose information has obtained the agreement of the individual the information relates to.

Part IVD of the Act protects against arbitrary interference with privacy by establishing a set of CDR-specific privacy safeguards, modelled on the existing Australian Privacy Principles but with additional obligations. The privacy safeguards included in the Act are the following:

•                 restrictions on the use, collection and disclosure of information received through the CDR Rules, including information derived from this information (in general, the consumer’s express consent is required);

•                 requirements to have in place privacy policies that are easily accessible and clearly set out a complaints handling process;

•                 obligations on data holders and accredited data recipients to correct information;

•                 obligations on data holders and accredited data recipients to notify the consumer when information is disclosed;

•                 requirements to destroy information that is purportedly shared under the CDR Rules but has been disclosed in error; and

•                 restrictions on direct marketing.

The CDR framework provides strong powers for regulators, including the Office of the Australian Information Commissioner (OAIC), and remedies for breaches, including through external dispute resolution arrangements.

The OAIC will advise on and enforce privacy protections in relation to data sharing in the non-bank lenders sector, and will provide complaint handling for breaches of the privacy safeguards. Non-bank lender sector consumers will have a range of avenues to seek remedies for breaches of their privacy or confidentiality, including access to internal and external dispute resolution and direct rights of action.

Part IVD of the Act also creates an accreditation process that provides protection against arbitrary or unlawful interference with privacy. Only accredited data recipients and trusted third parties are able to access data from data holders at the consumer’s direction. The ACCC is responsible for accrediting entities. The requirements that need to be met, set out in the CDR Rules, address matters such as:

•                 having systems, resources and procedures in place which enable an entity to comply with their consumer data right obligations including the security of information; and

•                 having internal dispute resolution procedures in place and being a member of a recognised external dispute resolution body.

The limitations presented by the Amending Rules are consistent with the prohibition on arbitrary interference with privacy as they seek to achieve legitimate objectives and are reasonable, proportionate and necessary to the attainment of those objectives.

Non-bank lenders sector trial products

The Amending Rules also engage Article 17 by exempting trial products in the non‑bank lenders sector from the requirements under the CDR Rules. However, the following requirements ensure that consumers’ privacy protection will not be adversely affected:

•                 the number of customers that may be supplied with a trial product is limited to 1,000 people;

•                 when offering the product, the period of time for which it will operate as a trial product must be stated (the trial period), ending no more than 6 months after the initial offering;

•                 when offering the product, it must be fully disclosed that it is a ‘pilot’ or a ‘trial’, that the product may be terminated before the end of the trial period, and that in this event, any CDR data collected in relation to the trial product may not be available for subsequent sharing.

This ensures that before consumers agree to participate in a trial product in the non‑bank lenders sector, they will be well-informed of the nature of the product and how it differs from products that are covered by the CDR.

Amendments affecting the banking sector

The above analysis about the extension of the CDR to the non-bank lenders sector applies to the introduction of data sharing for ‘buy now, pay later’ products, which expands the range of personal information that a person can directly access or direct another entity to disclose to a third party. Again, the legitimate objective is increasing availability of data to help consumers better understand and manage their finances.

The measure to enable related data holders and data holders in white labelling arrangements to discharge each other’s data sharing obligations could be considered to engage Article 17 by creating more flexibility in who performs data-handling roles. This mechanism provides data holders with the ability to transfer obligations in situations where the consumer facing entity would not ordinarily be required to comply with the relevant data holder obligations, but where it is more appropriate in practice that they are the entity that complies.

Importantly, this mechanism is only available where both parties are data holders, and thus are both subject to the Act’s privacy safeguards and other features of the CDR framework that protect consumer privacy.

The following components of the Amending Rules have the effect of reducing the flow of personal information through the CDR system, therefore reducing the extent to which the CDR engages with consumers’ right to privacy:

•                 narrowing the scope of products and data sets that must be provided on request;

•                 making certain exclusions for information about financial hardship, repayment history, and debts bought by debt buyers or debt collectors;

•                 deferring obligations for entities that become ADIs after the commencement of the Amending Rules, with the aim of allowing CDR consumers timely access to product data while permitting new ADIs to complete the IT uplift needed to facilitate banking data requests.

Civil penalty provisions

The Amending Rules introduce or alter some civil penalty provisions in the CDR Rules. These civil penalty provisions potentially invoke Articles 14 and 15 of the ICCPR. Although the Articles cover criminal process rights, in international human rights law, where a civil penalty is imposed, it must be determined whether it nevertheless amounts to a ‘criminal’ penalty. As with the existing civil penalties in the current CDR Rules, the new civil penalty provisions should not be considered ‘criminal’ for this purpose. While they are intended to deter non-compliance with CDR obligations, they are not directed at the general public, but at a class of businesses that should be reasonably aware of their obligations under the CDR. In addition, none of the provisions carry a penalty of imprisonment for non-payment of a penalty.

Conclusion

The Amending Rules are compatible with human rights because, to the extent that they do engage the relevant human rights and freedoms, they are proportional to the ends sought and reasonable and necessary in the circumstances.