EXPLANATORY STATEMENT
Issued by authority of the Assistant Treasurer and Minister for Financial Services
Competition and Consumer Act 2010
Competition and Consumer (Consumer Data Right) Amendment Rules (No. 1) 2023
Section 56BA of the Competition and Consumer Act 2010 (the Act) provides that the Minister may, by legislative instrument, make consumer data rules for designated sectors in accordance with Division 2 of Part IVD of the Act.
A ‘designated sector’ is a sector of the Australian economy designated, by legislative instrument made under subsection 56AC(2) of the Act (the designation instrument), as subject to the consumer data right (the CDR). The designation instrument for a sector also specifies the data (the CDR data) that is subject to the CDR and the classes of persons who hold the CDR data. Those persons, and other classes of persons covered by section 56AJ of the Act, are ‘data holders’ of CDR data in that sector.
The CDR framework is set out in Part IVD of the Act and the Competition and Consumer (Consumer Data Right) Rules 2020 (the CDR Rules). Under the CDR, individuals and businesses in designated sectors may authorise secure access to certain CDR data that relates to them and is held by data holders. There is also the capacity for individuals and businesses to access this data themselves. In addition, data holders in designated sectors are required or authorised to provide access to publicly available information on specified products that they offer.
The rules that apply generally across all sectors are set out in Parts 1 to 9 and Schedules 1 and 2 of the CDR Rules. Sector-specific rules are set out in further Schedules being progressively added to the CDR Rules.
In addition to the CDR Rules, data standards are developed and maintained by the Data Standards Body and made by the Data Standards Chair in accordance with the CDR Rules. The data standards underpin the technical delivery and consumer experience of the CDR. This includes imposing requirements for data security, language, and format.
The Competition and Consumer (Consumer Data Right) Amendment Rules (No. 1) 2023 (the Amending Rules) support business consumer participation in the CDR and introduce a number of other operational enhancements to the CDR Rules.
On 15 September 2022, the Treasury released an exposure draft of the Amending Rules for consultation. Views expressed by stakeholders during that consultation process have been taken into account in developing the Amending Rules.
The Amending Rules give effect to the Government’s intention to reduce barriers to participation in the CDR, enable services to be more efficiently provided to consumers, and allow consumers to have more choice over who they can consent to share their data with. In particular, the Amending Rules make changes to better facilitate participation by business consumers.
In addition to the key measures set out below, the package makes a number of minor amendments and clarifications.
Allowing business consumers to share their data with more third parties
The Amending Rules enable businesses to consent to accredited data recipients (ADRs) sharing their CDR data with specified persons who are not accredited, like bookkeepers, consultants and other advisers who are not classified as trusted advisers under the current CDR Rules. It also allows disclosures to the wide range of software providers that offer important services to small businesses in Australia.
Before disclosing the business consumer’s CDR data in response to a “business consumer disclosure consent”, ADRs must take reasonable steps to confirm that the consumer is either not an individual or that they have an active ABN. The business consumer must provide the ADR with a business consumer statement that certifies that the consent is given for the purpose of enabling the ADR to provide goods or services to the business consumer in its capacity as a business and not as an individual.
Under the previous CDR Rules, CDR consumers had a narrow range of unaccredited parties to which they could ask ADRs to disclose their CDR data. Stakeholder feedback indicated that the previous CDR Rules did not cover the range of advisers or services typically used by businesses. This amendment provides a more comprehensive solution to support the participation of business consumers (particularly small businesses) and accounting platforms in the CDR.
Extend business consumer use and disclosure consents from 12 months to 7 years
The Amending Rules extend the maximum duration of certain use and disclosure consents given by a CDR business consumer to an ADR from 12 months to 7 years. While 7 years is the maximum duration, it is possible for a shorter consent period to be selected, and it is also possible for the CDR business consumer to withdraw their consent at any time.
Stakeholder feedback indicated that the previous consent durations did not reflect the reality of business requirements, such as record-keeping and the need to maintain operational continuity. In addition, business consumers often have ongoing relationships with a particular ADR, so it is an unnecessary burden to limit these consents to a 12-month duration. Responding to this feedback, the amendments allow these consumers to choose a consent duration that reflects their business needs. These amendments could also help to reduce the risk of an ADR being required to delete all of a business consumer’s CDR data because the consumer inadvertently failed to renew the relevant use consent, an outcome which would be disruptive for the consumer’s business operations.
The business consumer measures are only available to accredited persons. CDR representatives are not able to seek business consumer disclosure consents or consents that have a duration longer than 12 months. Where an ADR offers a business consumer a consent with a duration that is longer than 12 months, they must also offer the consumer the option of selecting a duration of 12 months or less.
Enhancements to CDR representative arrangements and CDR outsourcing arrangements
The Amending Rules make a number of changes around CDR representative arrangements and CDR outsourcing arrangements. To increase accessibility for stakeholders, this has included consolidating key obligations for CDR representatives into Division 4.3A of the CDR Rules.
CDR outsourcing arrangements allow ADRs to engage outsourced service providers (OSPs) to assist them to provide goods and services to CDR consumers. The Amending Rules also clarify and strengthen obligations around CDR representative arrangements and CDR outsourcing arrangements and allow CDR representatives to engage OSPs.
Stakeholder feedback suggested that entities that rely on third parties to help them manage data had difficulty functioning in the CDR due to the prohibition on CDR representatives in engaging OSPs. The Amending Rules remove this prohibition and clarify the circumstances in which OSPs can disclose CDR data.
The amendments also clarify and strengthen the provisions dealing with ADRs’ liability for the actions of their CDR representatives and OSPs, including the actions of any OSPs engaged under further CDR outsourcing arrangements and OSPs engaged by CDR representatives.
Delay reciprocal data sharing obligations for newly accredited entities holding banking data sets
The Amending Rules delay the commencement of reciprocal data sharing obligations for ADRs who hold banking data sets until 12 months after they become an ADR.
The banking sector rules required newly accredited persons to respond to consumer data requests as data holders once they become an ADR, which added to the cost and complexity of accreditation requirements. Delaying these data sharing obligations removes a barrier to participation without removing the longer-term benefits of reciprocity to the CDR.
Exemption from data sharing obligations for small-scale, publicly offered pilot products in the banking sector
The Amending Rules enable data holders in the banking sector to publicly offer small scale pilot products (for up to 1,000 customers and for a 6-month maximum duration) without being subject to data sharing obligations. This addresses possible disincentives under the CDR for data holders to introduce innovative new products. This applies particularly to smaller data holders, which do not have the scale to pilot products internally. If the pilot product exceeds the customer or duration thresholds, the data becomes subject to data sharing obligations.
Details of the Amending Rules are set out in Attachment A.
A Statement of Compatibility with Human Rights is at Attachment B.
Before making consumer data rules, the Minister must comply with the requirements in section 56BP of the Act. First, section 56BP requires the Minister to have regard to certain matters set out in section 56AD. These include the likely effect of making the rules on the interests of consumers, the efficiency of relevant markets and the privacy and confidentiality of consumers’ information, and the likely regulatory impact of allowing the rules to impose requirements. The Minister will consider each of the relevant matters when making the Amending Rules.
Second, the Minister must, before making consumer data rules, be satisfied that the Secretary of the Department has arranged for consultation and the making of a report in accordance with section 56BQ of the Act. This requirement has been met in relation to the Amending Rules.
Third, the Minister must wait at least 60 days after the day public consultation begins before making consumer data rules. With public consultation having commenced on 15 September 2022 with publication of draft exposure rules on the Treasury website, this requirement has been met.
The exposure draft of the Amending Rules was released for consultation from 15 September 2022 to 14 October 2022. Submissions were received from 32 respondents. Feedback confirmed overall support for the draft enhancements to the CDR Rules.
The Office of Impact Analysis determined that the proposal was unlikely to have a more than minor regulatory impact and the preparation of an impact analysis was not required (OBPR22-01586).
The Amending Rules are a legislative instrument for the purposes of the Legislation Act 2003.
The Amending Rules commenced on the day after they were registered on the Federal Register of Legislation.
In citations of provisions in this explanatory material, unless otherwise specified, references to rules are to the CDR Rules.
ATTACHMENT A
Details of the Competition and Consumer (Consumer Data Right) Amendment Rules (No. 1) 2023
Section 1 – Name
This section provides that the name of the instrument is the Competition and Consumer (Consumer Data Right) Amendment Rules (No. 1) 2023 (the Amending Rules).
Section 2 – Commencement
The Amending Rules commence the day after they are registered on the Federal Register of Legislation.
Section 3 – Authority
The Amending Rules are made under section 56BA of the Competition and Consumer Act 2010 (the Act).
Section 4 – Schedules
This section provides that each instrument that is specified in the Schedules to this instrument will be amended or repealed as set out in the applicable items in the Schedules, and any other item in the Schedules to this instrument has effect according to its terms.
Schedule 1 – Amendments
Business consumers
- While take-up of the CDR to date has primarily been by individual consumers, there is also scope for small businesses to benefit from CDR goods and services. However, stakeholder feedback (including from small business advocates) strongly indicated that the previous CDR Rules did not reflect or support how many small businesses operate in practice. For example, they were concerned that the CDR did not support small businesses sharing their CDR data with many important formal and informal advisers, and placed barriers to the continuity of relationships between the small business and ADRs. The Amending Rules make changes to the CDR Rules to address these concerns and ultimately support participation in the CDR by business consumers. Examples of business consumers who might use the CDR include an incorporated small business or an individual carrying on a business as a sole trader.
Business consumer disclosure consent
2. The Amending Rules enable a CDR business consumer to use a business consumer disclosure consent to consent to an ADR disclosing their CDR data to a person specified in the consent, including non-accredited persons. A business consumer disclosure consent must also include a business consumer statement from the CDR business consumer, certifying that the consent is given for the purpose of enabling the accredited person to provide goods or services to the CDR business consumer in the consumer’s capacity as a business (and not as an individual). [Schedule 1, item 12, subparagraph 1.10A(1)(c)(v), paragraph 1.10A(2)(h) and subrules 1.10A(10) and (11)]
3. In response to feedback received during public consultation, CDR representatives are not able to seek business consumer disclosure consents.
4. When asking a CDR business consumer for a business consumer disclosure consent, an accredited person must invite the consumer to provide a business consumer statement. An accredited person cannot make the giving of a business consumer statement, the giving of a business consumer disclosure consent or the specification of a particular person for the purposes of such a consent a condition for the supply of goods or services requested by a CDR business consumer. It is a civil penalty provision to make this a condition for supply of goods or services requested by the CDR business consumer. [Schedule 1, items 12 and 54, subrule 1.10A(12) and paragraph 4.11(1)(bb)]
5. A CDR consumer is a CDR business consumer in relation to a consumer data request made by an accredited person if the accredited person has taken reasonable steps to confirm that the consumer either has an active ABN or is not an individual. Depending on the circumstances, an example of ‘reasonable steps’ for the purpose of this requirement may be that the accredited person has conducted a search on the Australian Business Register to confirm that the CDR business consumer’s ABN is active. [Schedule 1, items 3 and 12, definition of ‘CDR business consumer’ in subrules 1.7(1) and 1.10A(9))]
6. This new type of disclosure consent recognises that business consumers operate under different circumstances than individual consumers in relation to their data. In particular, many businesses have existing relationships with a range of service providers (including software platforms), which they rely on to run their operations and with whom they need to share their information. In addition, business consumers are generally more likely to have existing data security and sharing procedures in place, as well as systems for managing data disclosed outside the CDR.
7. The Amending Rules provide that an accredited person may not deal with a person in their capacity as a CDR business consumer, and that a disclosure of CDR data in accordance with a business consumer disclosure consent is not a permitted use or disclosure under the CDR Rules, before the earlier of:
• if the Data Standards Chair makes data standards about obtaining and managing business consumer statements, and consumer experience data standards for disclosure under a business consumer disclosure consent before 1 December 2023—the day on which the last of those standards is made; or
• 1 December 2023.
8. It is a civil penalty provision to deal with a person in their capacity as a CDR business consumer before the earlier of those dates. [Schedule 1, items 12, 105, 116 and 117, subrules 1.10A(14) and 7.5A(5), subparagraphs 8.11(1)(a)(iv) and (c)(vi)]
Extended maximum consent duration for business consumers
9. CDR business consumers can also give business consumer statements in relation to certain use and disclosure consents for the purpose of giving a consent with a duration of up to 7 years (the previous maximum duration of consents was 12 months, which remains the maximum duration for all consents given by individual consumers). The fact of giving a business consumer statement in relation to a consent should be included on the CDR business consumer’s dashboard. [Schedule 1, items 12, 18, 61 and 66, paragraphs 1.10A(10)(a), 1.14(3)(eb) and 4.12(1A)(a) and subrule 4.14(2)]
10. The consents that can have a duration of up to 7 years if given by a CDR business consumer, and supported by a business consumer statement, are use consents, trusted adviser disclosure consents, insight disclosure consents and business consumer disclosure consents. [Schedule 1, items 12, 20 and 57, paragraph 1.10A(10)(a), note 1 to subrule 1.14(3) and note 2 to subrule 4.11(1)]
11. The process for amending consents has been updated to clarify that amendments to consents that rely on business consumer statement must be associated with an invitation to give a new business consumer statement and reasonable steps to re-confirm that the CDR business consumer is not an individual or has an active ABN. [Schedule 1, items 63 and 64, subrule 4.12C(1) (example) and subrule 4.12C(4)]
12. The option to agree to an extended duration for certain consents given by CDR business consumers reflects the fact that business consumers have different needs to individual consumers and must, for example, comply with record-keeping obligations in relation to their business. In this context, business consumers can choose a longer consent duration to protect against their CDR data automatically becoming redundant and subject to deletion by the ADR after 12 months (for example, if the associated consent is inadvertently not renewed).
13. It is open to a CDR business consumer not to provide the business consumer statement, and to be treated as an individual consumer (meaning they could only give consents with a maximum duration of 12 months). However, to ensure that CDR business consumers are appropriately informed about their options, the Amending Rules require ADRs offering an extended consent duration (that is, over 12 months) to also allow the CDR business consumer to choose a consent duration of 12 months or less. [Schedule 1, item 61, subrule 4.12(1A)]
14. This reform excludes collection, AP disclosure, direct marketing and de‑identification consents because:
• there is limited utility in extending the duration of a collection consent when the consumer would still need to give an authorisation to the relevant data holder every 12 months;
• AP disclosure consents operate like authorisations, which retain the 12 month maximum duration;
• extending the duration of direct marketing consents does not offer a clear benefit to consumers and could cause them to receive unwanted marketing materials; and
• an extended duration for de-identification consents is not needed for provision of a service and it is important for CDR consumers to regularly consider whether it continues to be appropriate that their CDR data is de-identified.
15. In response to feedback received during public consultation, CDR representatives are not able to seek consents with a duration of more than 12 months.
16. The Amending Rules do not make changes to authorisations, which continue to have a maximum duration of 12 months before they need to be renewed under rule 4.23. [Schedule 1, item 76, note to subrule 4.23(1)]
Outsourced service providers
17. The Amending Rules allow CDR representatives of accredited persons to outsource CDR functions by engaging OSPs where this is allowed under the CDR representative arrangement. As before, CDR representatives are not permitted to enter into another CDR representative arrangement. [Schedule 1, item 12, rule 1.10 and subrule 1.10AA(3)]
18. As a consequential change, the Amending Rules enable ADRs to disclose CDR data to a CDR representative for the purposes of disclosing that data to a direct or indirect OSP of the CDR representative. [Schedule 1, item 104, paragraph 7.5(1)(h)]
19. However, CDR representatives and affiliates are still prevented from conducting collection activities or engaging outsourced service providers to do so. [Schedule 1, item 12, paragraph 1.10AA(1)(b) and note to paragraph 1.10AA(3)(b)]
20. ADRs (and now CDR representatives) may engage multiple OSPs via different CDR outsourcing arrangements. The Amending Rules allow an ADR or CDR representative in multiple CDR outsourcing arrangements to authorise their OSPs to disclose CDR data directly to one another, which is more efficient than requiring the CDR data to be disclosed back to the ADR or CDR representative by one OSP in order to be on-disclosed to the second OSP.
21. The Amending Rules explicitly permit the following disclosures:
• between any OSPs under the same ADR to help the ADR provide goods and services;
• between any OSPs under the same CDR representative to help the CDR representative provide goods and services;
• in circumstances where the disclosure of the data by the OSP chain principal (that is, the ADR or CDR representative who entered into the first CDR outsourcing arrangement) would be permitted under the CDR Rules.
22. To ensure adequate control and oversight by OSP principals and OSP chain principals over OSPs, OSP arrangements must include a range of obligations on OSPs in relation to access to data, deleting data, and providing records of deletion of data on the request of OSP and OSP chain principals.
23. To remove doubt, the Amending Rules amend rule 1.10 to provide that accredited persons or CDR representatives may be the principal (“OSP chain principal”) in one or more CDR outsourcing arrangements, and providers in such arrangements are direct outsourced service providers (“direct OSPs”). A direct OSP may also be the principal in a further CDR outsourcing arrangement, in which case, the provider is an indirect outsourced service provider (“indirect OSP”). [Schedule 1, item 12, subrule 1.10(1)]
24. A CDR outsourcing arrangement is a written contract between a principal and a provider under which:
• the provider can collect data (called “service data”) in accordance with the CDR Rules on behalf of an OSP chain principal that is an accredited person and/or use or disclose the data to provide goods or services to the OSP chain principal (which could be either an accredited person or a CDR representative);
• the provider must not use or disclose service data other than in accordance with a contract with the principal;
• the provider can only disclose service data to the OSP chain principal or another direct or indirect OSP of the OSP chain principal, or where a disclosure by the OSP chain principal would be permitted under the CDR Rules; and
• where the provider is the principal in a further CDR outsourcing arrangement, the provider must ensure the other person in such an arrangement complies with the requirements of the arrangement.
[Schedule 1, item 12, subrules 1.10(3) and (5)]
25. The goods or services provided must be:
• where the principal is the OSP chain principal, for the purpose of enabling the chain principal to provide CDR consumers for the service data with the goods or services for which collection of the data was consented to; or
• otherwise, for the purpose of enabling the principal to provide the goods or services under the CDR outsourcing arrangement in which it is the provider.
[Schedule 1, item 12, subrule 1.10(4)]
26. The CDR Rules already provided that an ADR can disclose CDR data to their OSPs for the purpose of doing the things referred to in paragraphs 7.5(1)(a) to (c). The Amending Rules clarify that an ADR is permitted to disclose CDR data to their direct or indirect OSPs in order to do those things. In addition, an ADR is permitted to disclose CDR data to their direct or indirect OSPs for the purpose of disclosing the CDR consumer’s CDR data in accordance with a current disclosure consent (subject to certain limitations in rule 7.5A). [Schedule 1, item 104, paragraph 7.5(1)(d)]
27. Likewise, the CDR Rules already provided that where an ADR has collected CDR data as a provider in a CDR outsourcing arrangement, disclosing that data to the OSP principal is a permitted use or disclosure. The Amending Rules clarify that where the ADR has collected CDR data on behalf of another accredited person in its capacity as a direct or indirect OSP of that person, using or disclosing the data in accordance with the relevant CDR outsourcing arrangement is a permitted use or disclosure. [Schedule 1, item 104, paragraph 7.5(1)(f)]
28. The Amending Rules add definitions of ‘direct OSP’ and ‘indirect OSP’, and repeal the definition of ‘outsourced service provider’, to reflect the amendments in relation to CDR outsourcing arrangements. [Schedule 1, item 3, definitions of ‘direct OSP’ and ‘indirect OSP’ in subrule 1.7(1)]
29. The Amending Rules also update the terminology in the provision that clarifies that certain references to an accredited person’s actions do not include references to an accredited person doing those things in their capacity as a direct or indirect OSP under a CDR outsourcing arrangement. [Schedule 1, item 9, subrule 1.7(5)]
30. An accredited person’s CDR policy must list all direct and indirect OSPs of the accredited person and those of any CDR representative, whether based in Australia or based overseas, and whether or not any is an accredited person. [Schedule 1, item 96, paragraph 7.2(4)(f)]
31. In addition, if an accredited person, CDR representative, or any direct or indirect OSP is likely to disclose CDR data to a direct or indirect OSP that is based overseas and is not itself an accredited person, the accredited person (or relevant CDR representative principal or accredited OSP chain principal) must specify in its CDR policy (if practicable) the countries in which such OSPs are likely to be based. If such an OSP is an accredited person their CDR policy must contain similar information. [Schedule 1, items 98 and 99, paragraph 7.2(4)(i) and note 1 to subrule 7.2(4)]
32. The Amending Rules make an accredited person liable where a direct or indirect OSP of the accredited person or their CDR representative fails to comply with privacy safeguards 4 (destruction of unsolicited data), 8 (overseas disclosure) and 9 (government related identifiers) as if it were an accredited person. [Schedule 1, items 102 and 105, rules 7.3B and 7.8B]
33. In this vein, any use, disclosure, or collection of service data by the provider in a CDR outsourcing arrangement is taken to have been by the OSP principal under the arrangement under subrules 7.6(2) and (5). The Amending Rules provide that any use or disclosure of service data by a direct or indirect OSP of an ADR or its CDR representative is taken to have been by the ADR, and that any collection of service data by a direct or indirect OSP of an accredited person is taken to have been by the accredited person. In both cases, it is irrelevant whether the use, disclosure or collection is in accordance with the relevant CDR outsourcing arrangement. [Schedule 1, item 104, subrules 7.6(2) and (5)]
34. Consistent with its liabilities under the existing Rules, the ADR is liable under the relevant civil penalty provision if a direct or indirect OSP of either the accredited person or the CDR representative fails to comply with a required provision of the relevant CDR outsourcing arrangements. [Schedule 1, item 25, subrules 1.16(2) and (4)]
35. ADRs must update consumer dashboards with details about the accredited persons and trusted advisers to whom they have disclosed CDR data, and the insights and business consumer disclosure consents under which CDR data has been disclosed. Where the ADR is a CDR representative principal, disclosure by its CDR representative is taken to be disclosure by the CDR representative principal. The Amending Rules clarify that disclosure by a CDR representative in this circumstance includes disclosure by a direct or indirect OSP of the CDR representative. [Schedule 1, items 108 and 109, subrules 7.9(3A) and (5)]
Privacy safeguard 12 — direct and indirect OSPs and CDR representatives
36. ADRs are required to comply with the steps set out in Schedule 2 to the CDR Rules relating to the security of CDR data. The Amending Rules clarify that:
• where the ADR is an OSP chain principal, failure by a direct or indirect OSP to comply with these steps in relation to service data is taken to be a failure by the ADR. Further, an OSP chain principal must keep records of the use and management of CDR data by each direct or indirect OSP, as well as the steps it has taken to ensure the compliance of each direct or indirect OSP with the relevant CDR outsourcing arrangement; and
• where the ADR is a CDR representative principal, failure by the CDR representative or its direct or indirect OSP to comply with these steps in relation to service data is taken to be a failure by the CDR representative principal. Further, a CDR representative principal must keep records of the use and management of CDR data by each direct or indirect OSP if its CDR representatives, as well as the steps it and its CDR representatives have taken to ensure that each CDR representatives’ direct and indirect OSPs have complied with the relevant CDR outsourcing arrangement.
[Schedule 1, items 112, 122 and 125, subrules 7.11(2) and (3), paragraph 9.3(2)(ia) and subparagraphs 9.3(2A)(ka)(ii) and (iii)]
37. ADRs are also required to apply the CDR de-identification process to CDR data that is “redundant data” under subsection 56EO(2) of the Act and that is not deleted in the circumstances set out in subrule 7.12(1). The Amending Rules clarify that:
• the ADR must also direct any of its direct OSPs or CDR representatives that have copies of the redundant data to delete it and notify the ADR when they have done so; and
• if the direct OSP or CDR representative has provided a copy of the redundant data to another person under a CDR outsourcing arrangement, the direct OSP or CDR representative must direct that person to take the same steps in relation to the data.
[Schedule 1, item 113, subrule 7.12(2)]
38. In addition, the Amending Rules provide that where an ADR is a CDR representative principal, a failure by the CDR representative to either de-identify or delete redundant data in accordance with subsection 56EO(2) of the Act (applied as if the CDR representative were an ADR and references in subrule 7.12(1) to Division 4.3 were to Division 4.3A), is taken to be a failure by the CDR representative principal. [Schedule 1, item 113, subrule 7.12(3)]
CDR representative principals and CDR representatives
39. In addition to the amendments described above that allow CDR representatives to engage OSPs, the Amending Rules make changes to the rules about CDR representative principals and CDR representatives for clarity, and to ensure the CDR Rules operate as intended in relation to CDR representative arrangements.
40. The Amending Rules repeal rule 4.3C, which modified Division 4.3 about giving and amending consents as it applied in relation to CDR representatives and CDR representative principals. Instead, the Amending Rules replicate that Division in a new Division, with the previous modifications reflected in the replicated text. The intention is to improve readability and assist CDR representatives and their CDR representative principals to understand their obligations. This includes creating standalone civil penalty obligations for accredited persons that relate to CDR representatives. [Schedule 1, items 43 and 74, rule 4.3C and Division 4.3A]
41. The previous modifications (per repealed rule 4.3C) had the consequence that consumers could only withdraw their consent by notifying CDR representative principals. The replicated Division provides that CDR consumers can withdraw their consent either by notifying the CDR representative principal or the CDR representative. Failing to make available a simple method of communication for the withdrawal of consent, as an alternative to using the CDR representative principal’s consumer dashboard, is a civil penalty provision. This is consistent with other obligations in relation to maintaining dashboards in the existing Rules, and with core CDR principles that the consumer should remain in control of how their data is used and accessed. The existing civil penalty provision that requires a CDR representative principal to give effect to a consent withdrawal as soon as possible, and no later than 2 business days after receiving the withdrawal, has been maintained. [Schedule 1, item 74, rule 4.20J]
42. The data minimisation principle that restricts an accredited person’s collection and use of CDR data to only what is reasonably needed in order to provide the goods or services requested by a CDR consumer, is extended to apply to CDR representatives providing goods or services to CDR consumers. [Schedule 1, item 10, rule 1.8]
43. Consistent with its obligations (and associated civil penalty provisions) under the existing Rules, the accredited person must ensure its CDR representatives comply with the requirements of the CDR representative arrangement and Division 4.3A of the CDR Rules and is liable for any failure by their CDR representatives to do so. [Schedule 1, item 25, rule 1.16A]
44. For a CDR representative, the permitted uses or disclosures are those that would be permitted if the CDR representative were an ADR that had collected the CDR data under a consumer data request except that CDR representatives may not provide services to CDR consumers in their capacity as CDR business consumers. [Schedule 1, item 12, paragraph 1.10AA(4)(d) and note 2 to subrule 1.10AA(4)]
45. CDR representatives must comply with several of the CDR privacy safeguards in holding, using or disclosing service data, as if they were the CDR representative principal. The Amending Rules ensure that CDR representatives must comply in this way with all elements of privacy safeguards 2, 4, 6, 7, 12 and 13, and the data quality elements of privacy safeguard 11 that are capable of applying to ADRs. [Schedule 1, item 12, paragraph 1.10AA(4)(a)]
46. The Amending Rules introduce definitions of ‘CDR representative principal’, ‘CDR representative’, ‘OSP principal’ and ‘OSP chain principal’ and make consequential amendments throughout the CDR Rules so that these terms are used consistently. This resolves ambiguity arising from rule 1.7 defining ‘CDR representative principal’ and ‘CDR representative’ as having the meanings given by rule 1.10AA, while rule 1.10AA previously only defined ‘principal’ and ‘representative’. [Schedule 1, items 3, 4, 12, 87 and 89, subrules 1.7(1), 1.10(1), 1.10AA(1) and 5.14(3) and (5)]
47. The definition of ‘service data’ in relation to CDR representatives is also revised for clarity of expression and consistency with the Act. [Schedule 1, item 12, subrule 1.10AA(5)]
48. The Amending Rules update the definition of ‘current’ to account for the rule about duration of consent being replicated for CDR representatives. [Schedule 1, item 5, definition of ‘current’ in subrule 1.7(1)]
Trial products
49. The Amending Rules address possible disincentives under the CDR for data holders to introduce innovative new products, particularly for smaller data holders, which do not have the scale to pilot products internally.
50. The Amending Rules achieve this by introducing a new defined term, ‘trial product’, which, in relation to a particular designated sector, has the meaning set out in the relevant sector Schedule. The purpose of this change is to allow data holders to test the viability and scalability of their offerings without being subject to CDR data sharing obligations. Trial product is currently only defined in Schedule 3 for the purposes of the banking sector, as a phase 1 product, a phase 2 product or a phase 3 product that:
• is offered with the description “pilot” or “trial”;
• specifies a period of no more than 6 months;
• will be offered to no more than 1,000 customers; and
• is offered with a statement that it may be terminated before the end of the trial period in which case CDR data in relation to the product may not be available.
51. Data holders will not be required to respond to consumer or product data requests in relation to a phase 1, 2 or 3 product while it is a trial product. [Schedule 1, items 3 and 144, definition of “trial product” in subrule 1.7(1) and subclause 1.5(1) of Schedule 3 to the CDR Rules]
52. A product ceases to be a trial product if it continues to be offered after the end of the 6-month trial period or is supplied to more than 1,000 customers. [Schedule 1, item 144, subclause 1.5(2) of Schedule 3 to the CDR Rules]
53. The Amending Rules provide that Part 3 of Schedule 3 to the CDR Rules (about accessing CDR data in the banking sector) does not apply in relation to a product while it is a trial product. [Schedule 1, items 147 and 154, clause 3.1A and subclause 6.4(2) of Schedule 3 to the CDR Rules]
Notifications of expired consents and authorisations
54. The Amending Rules relocate the existing requirement (and associated civil penalty provision) on accredited persons to notify data holders or ADRs when a consumer withdraws a collection consent, while extending this requirement to apply where a collection consent expires for any other reason. [Schedule 1, items 65 and 70, rules 4.13 and 4.18AA]
55. Similarly, the Amending Rules relocate the existing requirement (and civil penalty provision) on data holders to notify accredited persons when a consumer withdraws an authorisation to disclose particular data, while extending this to apply where an authorisation expires for any other reason. [Schedule 1, items 77 and 79, rules 4.25 and 4.26A]
56. Rule 4.18B (notification if a collection consent or AP disclosure consent expires), is amended to provide that where a consumer data request made by an accredited person to an ADR on behalf of a CDR representative has not been completely resolved and the ADR has an AP disclosure consent relating to the relevant CDR data:
• if the collection consent expires under the CDR Rules, the accredited person must notify the ADR; and
• if the AP disclosure consent expires under the CDR Rules, the ADR must notify the accredited person.
57. In each case, the consent expires when the ADR or accredited person receives the respective notification. [Schedule 1, item 72, rule 4.18B]
Displaying authorisation amendments on dashboard
58. The Amending Rules require, from 1 July 2024, data holders to include details about amendments to authorisations on a consumer’s dashboard. This accords with the existing obligation in rule 1.14 for accredited persons to include details about amendments to consents on a consumer’s dashboard. [Schedule 1, items 22 and 23, paragraph 1.15(3)(h) and subrule 1.15(3A)]
Refusal to disclose required consumer data
59. A data holder may now refuse to ask for an authorisation to disclose relevant CDR data (or an amendment to such an authorisation) or to disclose requested data if another provision of the CDR Rules would not permit disclosure of the relevant CDR data. [Schedule 1, item 47, paragraph 4.7(1)(e)]
Data standards that must be made
60. The Amending Rules adjust the scope of data standards that must be made, to ensure that the process for managing consents, authorisations and requests can be the subject of data standards. The Amending Rules require data standards to be made about the processes for obtaining and managing business consumer statements, and about the disclosure of CDR data under a consent for which a business consumer statement is given. [Schedule 1, items 115 and 116, subparagraphs 8.11(1)(a)(iv) and (c)(vi)]
61. In addition, the data standards about obtaining trusted adviser disclosure consents and business consumer disclosure consents must also include provisions about ensuring the CDR consumer is made aware that their data will leave the CDR system when it is disclosed. Data standards must also be made about how an accredited person or CDR representative can meet the requirement to explain a CDR insight in accordance with the CDR Rules. [Schedule 1, items 117 and 118, paragraph 8.11(1A)(a) and subrule 8.11(1B)]
Record keeping and reporting
62. The Amending Rules clarify the requirements for data holders and ADRs (including in the capacity of CDR representative principals) to keep records of CDR consumer complaints, in addition to CDR complaint data. The Amending Rules also clarify that CDR consumers are able to request copies of CDR consumer complaints they have made, as well as statistical or other data relating to CDR complaints kept by the data holder or ADR. [Schedule 1, items 119, 120, 123, 134 and 135, paragraphs 9.3(1)(fa), (2)(da) and (2A)(ga), subrule 9.5(1) and paragraphs 9.5(2)(a) and (b)]
63. Recordkeeping requirements under rule 9.3(2) are amended to:
• require ADRs to keep and maintain records that record and explain the number of business consumer statements received; disclosures of CDR data under business consumer disclosure consents and the persons to whom CDR data was disclosed; and any steps taken to confirm that a CDR consumer is a CDR business consumer; and
• clarify the requirements for keeping records about any outsourcing and sponsorship arrangements to which the ADR is a party, including the use and management of CDR data by the other party to an outsourcing or sponsorship arrangement, and any steps taken by the ADR to ensure an OSP complies with the relevant outsourcing arrangement.
[Schedule 1, items 121 and 122, paragraphs 9.3(2)(ee) to (eg), (i) and (ia)]
64. Recordkeeping requirements for ADRs that are CDR representative principals are clarified in relation to records that need to be kept about:
• disclosures by their CDR representatives under the CDR Rules to accredited persons and trusted advisers and under insight disclosure consents, and the persons the disclosures were made to;
• any steps taken to confirm that a trusted adviser is a member of a class of trusted advisers; and
• any CDR outsourcing arrangement to which the CDR representative, or a direct or indirect OSP of the CDR representative, is a party, the use and management of CDR data under the arrangement; and steps taken to ensure that each direct or indirect OSP of the CDR representative complies with the arrangement.
[Schedule 1, items 124 and 125, paragraphs 9.3(2A)(ha) to (hd) and (ka)]
65. Reporting requirements for ADRs under rule 9.4(2) have been extended to include the number of consents in relation to which a business consumer statement was given, including the number of times the ADR disclosed CDR data under a business consumer disclosure consent, and the number of such consents or amended consents that had a duration of more than 12 months. [Schedule 1, item 130, subparagraph 9.4(2)(viiia)]
66. Existing reporting requirements for ADRs that are CDR representative principals in relation to their CDR representatives, are extended to include:
• the number of consumer data requests that the CDR representative received from an accredited person on behalf of a CDR consumer;
• the number of times the CDR representative disclosed consumer data to an accredited person in response to such a consumer data request;
• the number of consents the CDR representative received from CDR consumers during the reporting period to disclose CDR data to trusted advisers;
• for each class of trusted advisers—the number of trusted advisers to whom CDR data was disclosed by the CDR representative; and
• the number of insight disclosure consents the CDR representative received from CDR consumers during the reporting period.
[Schedule 1, item 132, paragraph 9.4(2A)(e)]
67. CDR consumers are able to request copies of records relating to new recordkeeping requirements for ADRs and CDR representative principals, including in relation to consumer data requests received and disclosure of data. [Schedule 1, item 135, subrule 9.5(2)]
68. New reporting requirements for ADRs and CDR representative principals are not required for a reporting period before 1 January 2024. The first report containing the new matters set out above is due 30 days from the end of the 1 January 2024 to 30 June 2024 reporting period. [Schedule 1, item 133, subrule 9.4(6)]
69. The civil penalty provisions currently applicable to the recordkeeping and reporting obligations for ADRs and CDR representative principals apply to the new requirements described above.
Reciprocity for non-ADIs
70. Previously, banking sector reciprocal data holder obligations began to apply to non-ADI entities when the entity became an ADR. The Amending Rules provide that these reciprocal obligations do not apply until 12 months after the non-ADI entity has become a CDR data holder as a result of the operation of subsection 56AJ(3) of the Act (that is, until 12 months after they become an ADR). [Schedule 1, item 153, table item 5 in clause 6.2 of Schedule 3 to the CDR Rules]
71. This will alleviate some of the cost and complexity of regulatory compliance that smaller entities face in building both data holder and ADR capabilities at the same time. It also aligns with the compliance window currently allowed in the energy sector where data holder obligations do not start to apply to small retailers until 12 months after they become accredited (see clause 8.6 of Schedule 4 to the CDR Rules).
Energy sector rule amendments
72. The Amending Rules correct a reference in clause 2.2 of Schedule 4 to the CDR Rules so that it refers to Chapter 7 of the National Electricity Rules, which is the substantive chapter about metering. [Schedule 1, item 164, paragraph 2.2(2)(b) of Schedule 4 to the CDR Rules]
73. The Amending Rules clarify the effect of clause 5.2 of Schedule 4 to the CDR Rules on complaints arising outside the energy sector, and requirements for external dispute resolution (EDR) scheme membership by energy retailers that are also accredited persons dealing with both energy sector and non-energy sector CDR data. The intention is that:
• accredited persons should be members of the Australian Financial Complaints Authority Limited (AFCA);
• retailer data holders must be members of the relevant energy and water ombudsman (or equivalent dispute resolution process) (EWO);
• where a retailer data holder also is, or later becomes, an accredited person:
- it does not also need to become a member of AFCA provided it only uses energy sector CDR data to provide goods or services in the energy sector and does not use non-energy sector CDR data to provide goods or services outside the energy sector;
- otherwise, it will need to be a member of both AFCA and the relevant EWO.
[Schedule 1, item 171, clause 5.2 of Schedule 4 to the CDR Rules]
74. The definition of ‘large customer’ in Part 8 of Schedule 4 to the CDR Rules is corrected to refer to a customer in Victoria that is not a relevant customer for the purposes of the Electricity Industry Act 2000 (Vic). [Schedule 1, item 172, definition of ‘large customer’ in clause 8.1 of Schedule 4 to the CDR Rules]
75. The Amending Rules remove a barrier to sharing data for testing and proving use cases prior to the tranche 1 application date for the energy sector of 15 November 2022. This brings energy into line with the approach taken for banking. [Schedule 1, item 175, subclause 8.7(1) of Schedule 4 to the CDR Rules]
76. The Amending Rules also make a number of minor amendments to correct typographical errors and cross references in Schedule 4 to the CDR Rules. [Schedule 1, items 161 to 163, 165 to 170, 174, 176 and 177, clauses 1.3, 2.1, 3.1, 3.2, 4.1, Part 5 (note to heading), 5.1, 8.3 and 9.2 of Schedule 4 to the CDR Rules]
Clarifications and corrections
77. For clarity, the Amending Rules include a definition of ABN that applies generally across the CDR Rules. [Schedule 1, items 3, 143 and 160, definition of ‘ABN’ in subrule 1.7(1) and clauses 1.3 of Schedules 3 and 4 to the CDR Rules]
78. Rule 1.7 is also updated to include certain defined terms already being used in the CDR Rules but that were not included in the general definitions provision. [Schedule 1, item 3, definitions of ‘permitted use or disclosure’ and ‘relates to direct marketing’ in subrule 1.7(1)]
79. The Amending Rules also correct a typographical error in the definition of ‘secondary user’. [Schedule 1, item 8, definition of ‘secondary user’ in subrule 1.7(1)]
80. To reflect the fact that because CDR data is only held electronically, not in hard copy meaning it is not practically possible to “return” it, the provisions in the CDR Rules that referred to CDR data being returned have been removed. [Schedule 1, items 12 and 113, subrules 1.10(2) and 7.12(2)]
81. The Amending Rules clarify that rule 1.10C about trusted advisers applies to CDR representatives, as well as accredited persons. [Schedule 1, item 13, subrules 1.10C(1), (3) and (4)]
82. Subrule 1.10C(4) prohibits a supply of goods or services by an accredited person or CDR representative to a consumer being made conditional on the consumer nominating a trusted adviser or giving a TA disclosure consent. However, where the sole purpose of a consumer’s contract with an accredited person or CDR representative is to collect data from a data holder to be disclosed to a trusted adviser, the contract is essentially dependent on the consumer nominating a trusted adviser and providing a TA disclosure consent for the data to be disclosed to the nominated trusted adviser. To avoid doubt, the Amending Rules clarify that the prohibition on conditional supply does not apply to this scenario. [Schedule 1, item 14, subrule 1.10C(5)]
83. An accredited person or CDR representative must not make the giving of an insight disclosure consent or the nomination of a particular specified person in respect of an insight disclosure consent a condition for providing the service to the CDR consumer. If the accredited person does make either a condition, the accredited person contravenes a civil penalty provision. If a CDR representative makes either a condition, the CDR representative principal contravenes a civil penalty provision. This restriction does not apply if the only service requested to the CDR consumer is for CDR data to be collected from a data holder and CDR insights disclosed in accordance with the insight disclosure consent. [Schedule 1, item 12, subrules 1.10A(4) and (6)]
84. A cross reference has been corrected in note 2 to subrule 1.15(5) about an account holder indicating they no longer approve disclosure in response to requests made by a secondary user. [Schedule 1, item 24, note 2 to subrule 1.15(5)]
85. The Amending Rules correct an omission by referring to a ‘CDR representative arrangement’, in the rule about obligations relating to such arrangements. [Schedule 1, item 25, subrule 1.16A(3)]
86. Rule 4.3B that applies rule 4.7B to CDR representatives is amended to correctly refer to “CDR representative” rather than “CDR participant”, and to refer to the new Division about CDR representatives. [Schedule 1, item 42, subrule 4.3B(2)]
87. Rule 4.6A prevents a disclosure being made in relation to an account without the account holder’s approval. Paragraph (b) had allowed for sector-specific provisions to prevent disclosure. The Amending Rules broaden this to allow any provision of the CDR Rules to prevent disclosure, whether in a sector Schedule or not. This follows the creation of Part 4A in 2021, which contains rules about joint accounts that apply across all sectors. A note under rule 4.6A is updated to refer to provisions in that Part which set out circumstances where joint account CDR data must not be disclosed. [Schedule 1, items 45 and 46, paragraph 4.6A(b) and note 2 to rule 4.6A]
88. The headings to Division 4.3 and rule 4.8 about the purpose of the Division are amended to clarify that Division 4.3 only applies to giving and amending consents for accredited persons. These amendments follow the creation of new Division 4.3A that deals with giving and amending consents for CDR representatives. [Schedule 1, items 50 and 51, headings to Division 4.3 and rule 4.8]
89. The Amending Rules amend the rule about accredited persons’ processes for seeking consent, to refer to consumers giving ‘or’ amending a consent. This clarifies that consumers may be asked to give a consent or amend a consent, but not both at the same time. [Schedule 1, item 52, subrule 4.10(1)]
90. The requirement that an accredited person’s processes for asking CDR consumers to give or amend consents be in accordance with consumer experience data standards has been corrected to require they be in accordance with data standards that are relevant to the consent processes. [Schedule 1, item 53, subparagraph 4.10(1)(a)(i)]
91. Under the previous CDR Rules, when asking a CDR consumer to give a consent, accredited persons and CDR representatives needed to clearly indicate data for which they intend to pass on a fee for disclosure charged by a data holder, and allow the consumer to indicate whether they consent to the collection or disclosure of that data. This is amended to refer to data for which an accredited person, as well as a data holder, charges a fee that will be passed on. [Schedule 1, items 55 and 74, paragraphs 4.11(1)(d) and 4.20E(1)(e)]
92. The Amending Rules make the following minor amendments to rule 4.14:
• correcting cross-references to the relevant Division for amending consents for accredited persons;
• repealing a note made redundant by the prior repeal of clause 7.2(3)(a) of Schedule 3 to the CDR Rules;
• deleting reference to repealed paragraph 4.25(2)(b) following reorganisation of notification provisions;
• adding a note referring to the requirements for notification when a collection consent or AP disclosure consent expires.
[Schedule 1, item 66, rule 4.14]
93. Under rule 4.16, CDR consumers that give consents relating to particular CDR data, may elect that such data be deleted when it becomes redundant data. This rule is amended to clarify that this election can be made by the consumer when giving the consent or at any time before it expires. However, this rule does not apply where the accredited person has a general policy of deleting redundant data and informed the consumer when seeking the consent that their data will be deleted when it becomes redundant. [Schedule 1, item 67, subrules 4.16(1) and (3)]
94. Notes have been added to subrules 4.16(1) and 4.20M(1) to clarify that CDR data might become redundant for the purposes of deletion or de-identification even before a consent expires. For example, if the data was necessary to the provision of the service in the first year of a 7 year consent, but ceased to be necessary thereafter, redundant data treatments need to be applied after year one. [Schedule 1, items 67 and 74, note 2 to subrules 4.16(1) and 4.20M(1)]
95. Accredited persons must notify data holders and ADRs when a collection consent has been amended. The Amending Rules clarify that this requirement applies when an accredited person makes a consumer data request based on a collection consent given under Division 4.3, the request has not been completely resolved, and the CDR consumer amends the consent. [Schedule 1, item 72, subrule 4.18C(1)]
96. A cross reference in the simplified outline of Part 7 (about the privacy safeguards) is corrected to refer to Part IVD of the Act. [Schedule 1, item 94, rule 7.1]
97. The Amending Rules remove two duplicate paragraphs in rule 7.2, while correcting a typographical error and making various other corrections to numbering and cross-references. [Schedule 1, items 95 to 97 and 100, paragraphs 7.2(4)(aa)-(ab), 7.2(4)(e)-(f), subparagraph 7.2(4)(h)(ii) and subrule 7.2(5)]
98. The duplicate paragraphs arose because of a sequencing error. The Competition and Consumer (Consumer Data Right) Amendment Rules (No. 2) 2021, made in November 2021, replaced the whole of rule 7.2 with the intended final drafting. However, an amendment to rule 7.2 made by an older instrument – the Competition and Consumer (Consumer Data Right) Amendment Rules (No. 1) 2021 – did not commence until February 2022.
99. A cross reference has been corrected in subrule 7.3A(2) about destruction of unsolicited data by CDR representatives. [Schedule 1, item 101, subrule 7.3A(2)]
100. The Amending Rules clarify that where CDR data is collected by a sponsor on behalf of an affiliate, the sponsor is not required to provide the consumer dashboard. Instead, the affiliate, being an accredited person that makes the consumer data request through the sponsor, is required to provide the dashboard under subrule 1.14(1). [Schedule 1, item 103, subrule 7.4(2)]
101. The Amending Rules amend the specifications in rule 9.4 of what an ADR that is a CDR principal must include in its reporting, to correctly refer to the notification CDR principals give the Data Recipient Accreditor of termination of CDR representative arrangements. This corrects a reference to an ‘application to be a CDR representative’, which is not a type of application in the CDR regime. [Schedule 1, item 131, subparagraph 9.4(2A)(b)(i)]
102. The list of civil penalty provisions in rule 9.8 has been updated to reflect changes to these provisions made by the Amending Rules and to convert the existing list of civil penalty provisions into a table format. [Schedule 1, item 137, rule 9.8]
103. The commencement table set out in clause 6.6 of Schedule 3 is modified by regulation 28RB of the Competition and Consumer Regulations 2010 (added by the Competition and Consumer Amendment (Consumer Data Right Measures No. 1) Regulations 2022) so that the commencement table is to be read as if replaced by a new table set out in that regulation. The effect of the replacement table is to delay the start of Part 4 obligations for non-major ADIs from 1 July 2022 to 1 October 2022. The Amending Rules amend clause 6.6 by adding a note explaining this. [Schedule 1, items 155-157, clause 6.6 of Schedule 3 to the CDR Rules]
104. The remaining items in the Amending Rules make a series of minor and technical amendments to cross-references and typographical errors across the CDR Rules. [Schedule 1, items 1, 2, 6, 11, 15, 16, 17, 19, 21, 26, 27, 28-41, 44-46, 48, 49, 53, 55, 56, 58-60, 62, 68-69, 71, 73, 75, 78, 80-86, 88, 90-94, 97, 106, 107, 111, 114, 120, 122, 123, 126-129, 131, 136, 138-142, 145 and 148-152, rules 1.6, 1.7(1) definition of “meet the internal dispute resolution requirements”, 1.9, 1.10D(1)(a), note 3 to 1.13(1), 1.14(2A) and note 2 to 1.14(3), note to subrule 1.17(5), Division 1.5, note to heading, 1.22, 1.23, 4.1, 4.2, 4.3, 4.3A, 4.3B, 4.4, 4.6A(b), 4.7A, 4.7B(2)(note), 4.10(1)(a)(i) 4.11, 4.12(1), 4.12B(5), 4.18(1), 4.18A (heading), 4.20(1), 4.22A(1), 4.26(1)(d), 5.1B, 5.2, 5.4, 5.12, 5.14(4)(e), 5.23(4), 5.27, 6.1, 6.2, 7.1, 7.4(4)(h)(iii), 7.9(1), 7.10A(2), 7.16(2), 9.3(2)(da) and (i), 9.3(2A)(ga), (l) and note, 9.4(2)(f)(i) and (2A)(b), and 9.7(2), clause 2.1 of Schedule 1 to the CDR Rules, clauses 1.1 and 2.1 of Schedule 2 to the CDR Rules and clauses 1.3, 2.1, 3.2, Part 5 heading, 5.1, 5.2, 6.6(1) and 7.2(1) of Schedule 3 to the CDR Rules]
ATTACHMENT B
Statement of Compatibility with Human Rights
Prepared in accordance with Part 3 of the Human Rights (Parliamentary Scrutiny) Act 2011
Competition and Consumer (Consumer Data Right) Amendment Rules (No. 1) 2023
This Legislative Instrument is compatible with the human rights and freedoms recognised or declared in the international instruments listed in section 3 of the Human Rights (Parliamentary Scrutiny) Act 2011.
Overview of the Legislative Instrument
The purpose of the Competition and Consumer (Consumer Data Right) Amendment Rules (No. 1) 2023 (the Amending Rules) is to support business consumer participation in the CDR and introduce a number of other operational enhancements to the CDR Rules.
Human rights implications
The Amending Rules engage the right to protection from unlawful or arbitrary interference under Article 17 of the International Covenant on Civil and Political Rights (ICCPR) because they make amendments that impact on the disclosure of consumers’ CDR data.
The right in Article 17 may be subject to permissible limitations, where these limitations are authorised by law and are not arbitrary. In order for an interference with the right to privacy to be permissible, the interference must be authorised by law, be for a reason consistent with the ICCPR and be reasonable in the particular circumstances. The UN Human Rights Committee has interpreted the requirement of ‘reasonableness’ to imply that any interference with privacy must be proportional to the end sought and be necessary in the circumstances of any given case.
CDR business consumers
The creation of a “business consumer disclosure consent”, allowing businesses to consent to their CDR data being shared with specified persons who are not accredited, engages Article 17.
However, the Amending Rules contain the following provisions that ensure the protection of consumers’ personal information is not infringed by the introduction of the new business consumer disclosure consent:
• business consumer disclosure consents may only be sought by accredited persons, after the accredited person has confirmed that the consumer from whom the consent is sought, either is not an individual, or has an Australian Business Number;
• the business consumer has provided a statement certifying that their consent is given only for the purpose of enabling the accredited person to provide the consumer with goods or services in the consumer’s capacity as a business and not as an individual;
• the consent specifies the person to whom the accredited person is authorised to disclose the consumer’s CDR data.
The Amending Rules also allow CDR business consumers to agree to a duration of up to 7 years for use consents relating to goods or services they have requested, and for trusted adviser disclosure consents, insight disclosure consents or business consumer disclosure consents. However, such an extended duration will only be possible for CDR business consumers and only with their clear agreement. The current rules about dealing with redundant data will continue to apply in relation to consents with an extended duration, meaning that, for example, even if a CDR business consumer gave a use consent with a 7 year duration, if, after 4 years, the relevant CDR data is no longer needed to provide the services for which the consent was given, the data would be redundant at that point and subject to the deletion or de-identification election the consumer made when giving the consent.
Consumers will continue to have the ability to withdraw or amend their consent at any time.
In addition, collection consents cannot have an extended duration, meaning any collection of CDR data must be done within 12 months, in accordance with current requirements under the CDR Rules.
As a result, the addition of the ability for certain consents to have a duration longer than the current 12 months, will not have an unreasonable, adverse effect on the right to privacy in Article 17.
CDR representatives and OSPs
Article 17 is also engaged by the changes the Amending Rules make to the requirements for CDR representative arrangements and CDR outsourcing arrangements by allowing CDR representatives to engage outsourced service providers (OSPs) and setting out circumstances in which OSPs can disclose CDR data. However, because accredited persons continue to be liable in relation to the handling of CDR data by their CDR representatives and OSPs, there are no adverse impacts on the privacy protection of CDR consumers resulting from the changes.
Rather, privacy protection is enhanced through the clarification the Amending Rules make to the required terms CDR representative and OSP arrangements must contain, including that they must comply with certain privacy safeguards, and to the liability provisions that apply to accredited persons and their CDR representatives and OSPs.
Banking sector trial products
The Amending Rules also engage Article 17 by exempting trial products in the banking sector from the requirements under the CDR Rules. However, the following additional requirements ensure that consumers’ privacy protection will not be adversely affected:
• the number of customers that may be supplied with a trial product is limited to 1,000 people;
• when offering the product, the period of time for which it will operate as a trial product must be stated (the trial period), ending no more than 6 months after the initial offering;
• when offering the product, it must be fully disclosed that it is a ‘pilot’ or a ‘trial’, that the product may be terminated before the end of the trial period, and in this event, any CDR data collected in relation to the trial product may not be available.
This ensures that before consumers agree to participate in a trial product in the banking sector, they will be well-informed of the nature of the product and how it differs from products that are covered by the CDR.
Civil penalty provisions
The Amending Rules introduce several civil penalty obligations. These civil penalty provisions potentially invoke Articles 14 and 15 of the ICCPR. Although the Articles cover criminal process rights, in international human rights law, where a civil penalty is imposed, it must be determined whether it nevertheless amounts to a ‘criminal’ penalty. As with the existing civil penalties in the current CDR Rules, the new civil penalty provisions should not be considered ‘criminal’ for this purpose. While they are intended to deter non-compliance with CDR obligations, they are not directed at the general public, but at a class of businesses that should be reasonably aware of their obligations under the CDR. In addition, none of the provisions carry a penalty of imprisonment for non-payment of a penalty.
Conclusion
The Amending Rules are compatible with human rights as to the extent that they do engage the relevant human rights and freedoms, they are proportional to the ends sought and reasonable and necessary in the circumstances.