Contents

Explanatory Statement

Explanatory Statement: Competition and Consumer (Consumer Data Right) Amendment Rules (No.1) 2020

Background

Purpose

Authority for making the Amending Instrument

Statement of compatibility with human rights

Human right implications

Conclusion

Regulatory Impact Analysis

Consultation

Explanatory Notes

Explanatory Statement: Competition and Consumer (Consumer Data Right) Amendment Rules (No.1) 2020

Background

1.                  This Explanatory Statement accompanies the Competition and Consumer (Consumer Data Right) Amendment Rules (No.1) 2020 (Amending Instrument) which amends the Competition and Consumer (Consumer Data Right) Rules 2020 (Rules).
2.                  The Rules were made by the Australian Competition and Consumer Commission (ACCC) on 4 February 2020 and registered on 5 February 2020.
3.                  The Rules are a critical component of the Consumer Data Right (CDR) regime, an economy-wide reform that gives consumers the ability to safely, efficiently and conveniently access specified data held about them by businesses (data holders) and request that data be disclosed to trusted third parties of their choice (accredited data recipients).

Purpose

1.                  The primary purpose of the Amending Instrument is to make minor and machinery amendments to the Rules to clarify the intended operation of particular rules and to ensure appropriate alignment of rules with the technical data standards (Standards) prior to the commencement of consumer data sharing on 1 July 2020.
2.                  The amendments clarify that the accounts in scope from 1 July 2020 are those held by individual account holders. This includes simple small business accounts held by an individual account holder (such as those held by sole traders). Other amendments expressly recognise that a data holder may refuse to seek authorisation or refuse to disclose CDR data in respect of a blocked or suspended account.
3.                  The Rules have also been amended to provide greater flexibility in relation to the methods provided to consumers to enable them to communicate withdrawal of consent or authorisation.

Authority for making the Amending Instrument

1.                  The Amending Instrument was made under section 56BA of the Competition and Consumer Act 2010 (Act) which enables the ACCC to make consumer data rules and includes the power, relying on subsection 33(3) of the Acts Interpretation Act 1901, to amend the rules. 
2.                  The Minister consented to the ACCC making the Amending Instrument in accordance with section 56BR of the Act.
3.                  Before making consumer data rules, Section 56BP of the Act requires the ACCC to have regard to certain matters outlined in Section 56AD. These include the likely effect of the rules on the interests of consumers, the efficiency of relevant markets, the privacy and confidentiality of consumers’ information, and the regulatory impact of the rules. The process for making the Amending Instrument involved consideration of the matters outlined in section 56AD, including through public consultation on draft amendments.                           

Statement of compatibility with human rights

1.              This statement is prepared in accordance with Part 3 of the Human Rights (Parliamentary Scrutiny) Act 2011.
2.              The Amending Instrument is compatible with the human rights and freedoms recognised or declared in the international instruments listed in section 3 of the Human Rights (Parliamentary Scrutiny) Act 2011.

Human right implications 

1.              The amendments relate to the right to protection from unlawful or arbitrary interference with privacy under Article 17 of the International Covenant on Civil and Political Rights (ICCPR).
2.              The Amending Instrument is consistent with the protection afforded by Article 17 of the ICCPR.
3.              Amended Rules 1.7, 1.13(4), 1.17, 4.11(1), 4.14, 4.26, 5.18 and 5.24; amended Clause 2.2 in Schedule 2; and amended Clauses 1.3(2)(b)(iii), 2.1(2), 2.2 and 3.2 of Schedule 3 do not alter the effect of the Rules with respect to Article 17, as they make typographical changes and/or changes to clarify the operation of the rules to ensure they are consistent with the original policy intention of the Rules.
4.              Amended Rules 3.5, 4.7, 4.13, 4.25, 5.30(b) – (c) and Item 4 of Rule 5.17 protect against unlawful or arbitrary interference with privacy. Amended Rules 4.13 and 4.25 are intended to provide support to consumers through more flexible methods for withdrawing consents and authorisations in relation to collection, disclosure and use of consumer data. This supports Article 17 by making it easier for consumers to manage access to their personal information.

Conclusion

1.              The Amending Instrument is compatible with human rights and freedoms.

Regulatory Impact Analysis

1.              The Office of Best Practice Regulation advised that a Regulation Impact Statement was not required (OBPR reference ID 24996). 

Consultation

1.              The ACCC consulted on the draft amendments between 24 April 2020 and 8 May 2020.
2.              Before the Amending Instrument was made, the ACCC was satisfied that consultation was undertaken to the extent appropriate and reasonably practicable in accordance with section 17 of the Legislation Act 2003.
   

Explanatory Notes

Item 1: Amendment to Rule 1.7 (note 1, list of terms defined in the Act)

1.              Item 1 inserts the terms ‘Australian Consumer Law’ and ‘Commission’ into note 1 to rule 1.7, which provides a list of terms defined in the Act. This note makes clear that expressions used in the Rules have the same meaning as defined in the Act

Item 2: Amendment to Rule 1.7(1) (note 1 to definition of CDR complaint data)

1.              Item 2 removes note 1 to the definition of CDR complaint data in rule 1.7. Complaints resolved within 5 business days are typically not recorded under existing internal dispute resolution processes and where that is the case, the ACCC considers there is no requirement for these types of complaints to be recorded or reported under the Rules, although CDR participants may choose to do so. 

Item 3: Amendment to Rule 1.7(1) (note 2 to the definition of CDR complaint data)

1.              Item 3 is a consequential amendment following item 2. It replaces the remaining note, ‘Note 2’, with ‘Note’.

Item 4: Amendment to Rule 1.13(4)

1.              Item 4 corrects a typographical error in rule 1.13(4) by replacing the term ‘an accredited person’ with the term ‘data holder’

Items 5–6: Amendments to Rules 3.5(1)(a), 4.7(1) and 4.7(2)

1.              Items 5–6 expand the circumstances in which a data holder may refuse to ask for authorisation in respect of, or disclose CDR data from, an account that is ‘blocked or suspended’. The amendment recognises that in some circumstances it may not be appropriate for data from a blocked or suspended accounts to be made available for sharing under the CDR.
2.              A refusal to ask for authorisation in respect of a blocked or suspended account does not amount to an instance where CDR data has not been disclosed in reliance on an exemption from the obligation to disclose CDR data, for the purposes of the record keeping and reporting rules.

Item 7: Amendment to Rule 4.7(3) (heading)

1.              Item 7 amends rule 4.7(3) by removing a redundant heading.

Item 8: Amendment to rule 4.11(1) (note 2)

1.              Item 8 amends rule 4.11(1) by substituting a reference to rules 7.12 and 7.13 in place of an incorrect reference to rules 7.11 and 7.12.

Items 9 and 14: Amendments to Rules 4.13(1)(a) and (b); and 4.25(1)(a) and (b)

1.              The purpose of the amendments in items 9 and 14 is to provide greater flexibility in the alternative methods offered to CDR consumers to withdraw consent and authorisation. These requirements will apply in addition to the existing requirement to make a withdrawal functionality available to consumers via the consumer dashboard.
2.              An accredited person will need to offer a CDR consumer an alternative method of communication (to the dashboard) for withdrawing consent that is simple to use. A corresponding requirement will apply to data holders to offer CDR consumers the ability to withdraw authorisation using a simple alternative method of communication (other than via the data holder’s dashboard).
3.              The previous rules required the alternative method to be in writing, which will remain an option to offer to CDR consumers. However, these amendments allow greater flexibility in the withdrawal methods that accredited persons and data holders can offer to better reflect methods of communication and customer authentication already made available by accredited persons and data holders to their customers.

Items 10–13 and 15–18: Amendments to Rules 4.13(2)(a), 4.14(1)(a), 4.14(1)(a)(ii), 4.14(1)(b), 4.25(2)(a), 4.26(1)(a), 4.26(1)(a)(ii), 4,26(1)(b)

1.              Items 10–13 and 15–18 are consequential to the amendments to items 9 and 14 and are necessary to provide accurate cross-references in the Rules.

Item 19: Amendment to Rule 5.17(1) (table item 3, column headed “If:”)

1.              Item 19 amends rule 5.17(1) to correct a typographical error by removing a repeated word.

Item 20: Amendment to Rule 5.17(1) (table item 4, column headed “If:”, subparagraph (b)(i))

1.              Item 20 amends rule 5.17(1) to insert the phrase ‘or the associated database’ in item 4 of rule 5.17. Item 4 of rule 5.17 allows the Data Recipient Accreditor to suspend or revoke accreditation where it reasonably believes that doing so is necessary to protect the security, integrity and stability of the Register of Accredited Persons. The amendment clarifies that this power extends to the database which is associated with the Register, and is consistent with existing references throughout the Rules to the Register.

Item 21: Amendment to Rule 5.18(1)

1.              Item 21 corrects a typographical error by replacing the term ‘registration’ with ‘accreditation’.

Item 22: Amendment to Rule 5.24, note 3 (first occurring)

1.              Item 22 corrects a reference by replacing an incorrect reference to ‘Note 3’ with a reference to ‘Note 2’.

Item 23–24: Amendment to Rules 5.30(b) and 5.30(c)

1.              Under the Act, the Accreditation Registrar (currently the ACCC) has the function of establishing and maintaining the Register (subsection 56CE(1) and section 56CL). The Registrar also has the functions conferred by rule 5.30 which include ‘maintaining the security, stability and integrity of the Register and associated database, including undertaking or facilitating any testing for that purpose’. Item 23 makes a minor amendment to insert ‘by CDR participants’ after ‘facilitating any testing’ in rule 5.30(b), and item 24 adds an example after rule 5.30(c) that illustrates where the Accreditation Registrar might make a request concerning testing.
2.              The minor amendments made by items 23–24 are intended to clarify that the function of the Registrar in relation to the security, integrity and stability of the Register covers facilitating testing of the Register itself and CDR participants who will access information contained in the Register in sending and responding to consumer data requests in accordance with the Standards, and the power to make requests under rule 5.30(c) covers requests concerning testing.

Item 25: Amendment to Clause 2.2 of Schedule 2 (table item 3, row relating to “Information asset lifecycle (as it relates to CDR data)”, column headed “Description of minimum controls”)

1.              Item 25 corrects a typographical error by replacing a reference to ‘ADR’ with ‘accredited data recipient’.

Item 26: Amendment to Clause 1.3 of Schedule 3 (table item 2, column 2, subparagraph (b)(iii))

1.              Item 26 replaces the phrase ‘the opening and closing balances for the account, including a current balance and available funds’ with the term ‘account balances’. This amendment ensures better alignment between the Rules and Standards.

Item 27: Amendment to Clause 2.1(2) of Schedule 3

1.              Item 27 amends the meaning of ‘eligible’ to clarify that a CDR consumer is eligible with respect to a particular data holder if the consumer is an individual (18 years or older) who is the account holder of at least one account with the data holder that is open and set up in such a way that it can be accessed online. This includes individually held retail accounts as well as some small business accounts (for example, accounts held by sole traders). For ADIs that operate separate retail and more specialised business digital banking channels (through internet banking and/or mobile apps), the accounts currently in scope under the Rules are typically accounts that are made available and accessed by customers through an ADI’s primary retail digital channel.  In these situations, the ACCC considers that it will be appropriate for an ADI to meet its obligations under the Rules by leveraging its primary retail digital channel. The ACCC intends to amend the Rules in the future to accommodate CDR data sharing by corporate customers and for complex accounts. At that time, the ACCC would expect ADIs to accommodate the digital channels used by all groups of eligible consumers.
2.              Item 27 also clarifies that the eligibility of an individual account holder to authorise CDR data sharing is not affected by the existence of any other signatories or secondary card holders on the account.

Items 28–35: Amendments to Clause 3.2 of Schedule 3 (Clauses 3.2(1)(b)(ii), 3.2(1)(b)(ii)(B), 3.2(1)(b)(iv), 3.2(3)(a)(i)(A), 3.2(3)(a)(iii), 3.2(3)(a)(v), 3.2(3) (note))

1.              Items 28–35 are amendments consequential to the amendment in item 27. They ensure accuracy of cross-referencing and references to term.