EXPLANATORY STATEMENT

Issued by authority of the Minister for Superannuation, Financial Services and the Digital Economy

Competition and Consumer Act 2010

Competition and Consumer (Consumer Data Right) Amendment Rules (No. 2) 2021

Note: A Replacement Explanatory Statement was registered on the Federal Register of Legislation on 30 March 2022. This Explanatory Statement replaces it.

Section 56BA of the Competition and Consumer Act 2010 (the Act) provides that the Minister may, by legislative instrument, make consumer data rules for designated sectors in accordance with Division 2 of Part IVD of the Act.

The Competition and Consumer (Consumer Data Right) Amendment Rules (No. 2) 2021 (the Amending Rules) amends the Competition and Consumer (Consumer Data Right) Rules 2020 (the CDR Rules) to give effect to the Government’s intention to implement the CDR in the energy sector.

The Consumer Data Right (Energy Sector) Designation 2020 (the designation instrument for the energy sector) specifies the energy data holders and data sets to which CDR applies. The designation instrument covers consumer data sets relating to the sale or supply of electricity, including where electricity is bundled with gas. Coverage of data sets about products is broader and includes electricity, gas and dual fuel plans.

The Amending Rules implement CDR in the energy sector by establishing a peer-to-peer data access model for the energy sector and making energy sector specific rules and other minor amendments.

Schedule 1 to the Amending Rules establishes a peer-to-peer data access model for primary and secondary data holders who share responsibility for responding to consumer data requests. This model will initially be used in the energy sector, but may be applied to other sectors as appropriate. The model will be used in the energy sector to require a consumer’s retailer to obtain the requested data that the Australian Energy Market Operator (AEMO) holds from AEMO in response to a request, with the retailer assuming responsibility for disclosing all requested CDR data to the accredited data recipient (ADR).

Schedule 2 to the Amending Rules makes rules that relate specifically to the energy sector including: the eligibility requirements for energy consumers to be able to share CDR data; defining the energy data sets that may be shared; aligning the internal dispute resolution (IDR) requirements for data holders for CDR in energy with existing energy sector IDR requirements under national energy legislation; requirements in relation to external dispute resolution for accredited persons and data holders in the energy sector; and a staged implementation of CDR in the energy sector.

Schedule 3 to the Amending Rules makes minor amendments to remove anomalies and ensure the CDR Rules operate as intended. In particular, Schedule 3 amends the CDR Rules with respect to: the definition of an eligible consumer; ongoing reporting obligations on authorised deposit-taking institutions (ADIs); rules relating to data standards; and to make consequential amendments after the passage of changes to the Act.

Details of the Amending Rules are set out in Attachment A.

A Statement of Compatibility with Human Rights is at Attachment B.

Before making consumer data rules, section 56BP of the Act requires the Minister to have regard to certain matters outlined in section 56AD. These include the effect of the rules on the interests of consumers, the efficiency of relevant markets, the privacy and confidentiality of consumers’ information, and the regulatory impact of the rules. The Minister has considered each of the factors required by the legislation when making the Amending Rules.

Section 56BP requires the Minister to be satisfied that the Secretary of the Department has arranged for consultation as required by the Act and a report before the rules are made. This requirement has been met.

Section 56BP also requires the Minister to wait at least 60 days after the day public consultation begins before making consumer data rules. With public consultation having commenced on 17 August 2021 with publication of draft exposure rules on the Treasury website, this requirement has been met.

An exposure draft of the Amending Rules was released for consultation from 17 August 2021 to 13 September 2021. Submissions were received from 30 respondents. Feedback confirmed broad support for the rollout of CDR in the energy sector and the draft energy rules and confirmed widespread support in the sector for the peer-to-peer model.

The certification of the independent CDR Gateway Model Review, the report Open consumer energy data: applying a Consumer Data Right to the energy sector (HoustonKemp’s report), and additional consultation and supplementary analysis to implement the CDR Rules in the energy sector has undertaken a process and analysis equivalent to a Regulation Impact Statement (RIS). HoustonKemp’s report was referred to as part of the current certification process and was previously certified as part of a separate independent review to designate the energy sector.

The certification relates to the making of rules to implement CDR in the energy sector based on a peer-to-peer data access model. The objective of the certification was to identify the changes to the existing CDR Rules that need to be made so that a peer-to-peer data access model could be implemented in the energy sector while ensuring that any amendments to the CDR Rules are suitable for the specific circumstances of the energy market.

The Office of Best Practice Regulation (OBPR) determined the options analysed in the independent review are sufficiently relevant to the regulatory proposal (OBPR ref 43807). Further information is published on the OBPR website.

The Amending Rules are a legislative instrument for the purposes of the Legislation Act 2003.

The Amending Rules commenced on the day after they were registered on the Federal Register of Legislation.

ATTACHMENT A

Details of the Competition and Consumer (Consumer Data Right) Amendment Rules (No. 2) 2021

Section 1 – Name of the Amending Rules

This section provides that the name of the instrument is the Competition and Consumer (Consumer Data Right) Amendment Rules (No. 2) 2021 (the Amending Rules).

Section 2 – Commencement

The Amending Rules commence the day after they are registered on the Federal Register of Legislation.

Section 3 – Authority

The Amending Rules are made under the Competition and Consumer Act 2010 (the Act).

Section 4 – Schedules

This section provides that each instrument that is specified in the Schedules to this instrument will be amended or repealed as set out in the applicable items in the Schedules, and any other item in the Schedules to this instrument has effect according to its terms.

Schedule 1 – Amendments relating to P2P data access

Background

Schedule 1 to the Amending Rules gives effect to the Government’s decision to establish a peer-to-peer (P2P) data access model for the energy sector. The Amending Rules authorise the disclosure of CDR data directly by a data holder (the secondary data holder) to another data holder that has received a consumer data request (the primary data holder). Previously under the CDR Rules, CDR data could only be disclosed from a data holder to an accredited person or from an accredited data recipient to another accredited data recipient. This data sharing model is intended to be available for use across the economy but may be more particularly suited to certain sectors. The Amending Rules provide for P2P data access involving primary and secondary data holders to be ‘turned on’ for particular sectors if it is appropriate.

A consumer data request may cover data that is collected and held by the secondary data holder (for the energy sector, AEMO) instead of the primary data holder with whom the consumer has a relationship. For this reason, the Amending Rules facilitate access to the data collected and held by the secondary data holder. The primary and secondary data holders will then jointly share responsibility for dealing with consumer data requests that relate to data held by both data holders.

The data access model determines who is responsible for the relevant CDR obligations to enable data sharing for consumers. Primary data holders will be subject to the requirements of the Act (including privacy safeguards), CDR Rules and data standards. These include obligations to protect the privacy of consumers’ data, which are subject to civil penalty provisions and comprehensive record keeping and reporting obligations, including at a technical level to monitor performance metrics such as timing of responses to requests as specified in the data standards.

These mechanisms enable a consumer to utilise the CDR ecosystem in a consistent manner to benefit from the sharing of data and provide sufficient oversight for the Australian Competition and Consumer Commission (ACCC) and Office of the Australian Information Commissioner (OAIC) to undertake enforcement activities if necessary.

The P2P model is appropriate for the energy sector because responsibility for CDR data needs to be shared between an energy retailer (who has a direct relationship with the consumer and is the ‘primary data holder’) and AEMO (who has no direct relationship with the consumer and is the ‘secondary data holder’).

In the energy sector, for consumer data requests that relate to both retailer held data sets (customer data, billing data and tailored tariff data) and AEMO held data sets (metering data, National Metering Identifier (NMI) standing data and distributed energy resources (DER) register data), AEMO will be authorised to disclose the relevant data that it holds to the retailer when requested, for subsequent sharing with the ADR.

In summary, the data flow in the P2P model involves:

• the consumer consenting to an ADR obtaining their data;

• the ADR contacting the primary data holder seeking access to the consumer’s data;

• the primary data holder authenticating the ADR using the CDR Register;

• the consumer being redirected to the primary data holder’s authentication and authorisation service to authorise the primary data holder to disclose their data to the ADR;

• the ADR requesting the specific set of data that is covered by the authorisation;

• the primary data holder requesting the relevant data, covered by the authorisation, from the secondary data holder;

• the secondary data holder providing the requested data to the primary data holder; and

• the primary data holder sharing the consumer’s data (from both its holdings and the data obtained from the secondary data holder) with the ADR.

From the point of view of a CDR consumer, the primary data holder is treated as if it were the relevant data holder for all the CDR data relevant to the request. The consumer data requests for the data are made to it; authorisations for disclosure are made to it; it is the entity that discloses or refuses to disclose the requested data; any complaints are made to it; and it keeps the records that the CDR consumer can request.

Applying the P2P model in a sector

The Amending Rules introduce the concepts of ‘shared responsibility data’ (‘SR data’), ‘SR data request’, ‘primary data holder’ and ‘secondary data holder’, and provide that:

• ‘SR data’ will have the meaning set out in a relevant sector Schedule, if P2P data sharing involving primary and secondary data holders is turned on for that sector;

• ‘SR data request’ means a consumer data request for CDR data that is, or includes, SR data of the CDR consumer; and

• ‘primary data holders’ and ‘secondary data holders’ of SR data in a particular designated sector will be specified in the relevant sector Schedule.

[Schedule 1, item 1, rule 1.7]

These definitions will apply to any sector where the P2P data access model involving primary and secondary data holders applies.

Where CDR data for which there is a CDR consumer in a designated sector is held by one data holder, but it is more practical for the consumer to make the request to a different data holder that the consumer has a relationship with, such CDR data may be specified as SR data in the relevant sector Schedule.

Where a sector has primary and secondary data holders, the relevant data holders for SR data will be specified in the relevant sector Schedule.

For example, in the energy sector, Schedule 4 to the CDR Rules specifies that relevant retailers are primary data holders, and specifies AEMO data as SR data. This has the effect of designating AEMO as a secondary data holder for the energy sector. [Schedule 2, item 39, clause 4.3 of Schedule 4 to the CDR Rules]

Interactions between primary data holders and secondary data holders

Where data is specified as SR data in a relevant sector Schedule, Parts 3 and 4 of the CDR Rules are applied with the modifications set out in new Division 1.5. [Schedule 1, item 3, Division 1.5]

A primary data holder is required to provide an online service that enables it to respond to a consumer data request that involves data held by a secondary data holder. [Schedule 1, item 3, rule 1.20(1)]

A secondary data holder is required to provide an online service that is able to receive and respond to requests from primary data holders for CDR data that it holds and conforms with the data standards. When a primary data holder receives a consumer data request, either directly from a consumer or from an accredited person, that involves SR data (an SR data request), the primary data holder is required to request the secondary data holder to disclose the relevant SR data that it holds to the primary data holder, to enable it to disclose all of the requested CDR data in response to the request. Disclosure of the requested SR data by the secondary data holder must be in accordance with the data standards and if the secondary data holder chooses to not disclose the requested SR data, it must notify the primary data holder of its refusal. These obligations are each subject to the maximum default civil penalty. This reflects the critical importance of secure and efficient processing of requests for consumers’ information to the safety and workability of the CDR regime. [Schedule 1, item 3, rules 1.20(2) 1.22(3)-(5) and 1.23(4)-(6 ), rule 9.8]

Rule 4.7 (refusal to disclose) applies as if the primary data holder were the data holder of any SR data covered by the SR data request. The consequence of such a refusal will be that the secondary data holder will not receive a request for SR data from the primary data holder. [Schedule 1, item 3, rule 1.23(9)]

Where a secondary data holder does not disclose SR data requested under Part 3 or Part 4 of the CDR Rules, the primary data holder is relieved of its obligation to disclose the SR data to a consumer or accredited person in response to a valid consumer data request. [Schedule 1, item 3, rules 1.22(7) and 1.23(7)-(8)]

A primary data holder may request relevant information from a secondary data holder in relation to a consumer complaint or dispute with the primary data holder that relates to an SR data request. In response to the request from the primary data holder, the secondary data holder must provide the information to the extent that it is reasonable to do so. [Schedule 1, item 3, rule 1.26]

To give effect to the requirements of interactions between a primary data holder and a secondary data holder in CDR, the Amending Rules require data standards to be made about making and responding to requests by the primary data holder for SR data. [Schedule 1, item 4, rule 8.11(1)(a)(iii)]

Primary data holder’s obligations

The primary data holder has several obligations under the P2P model including:

• providing the consumer dashboard under rule 1.15; [Schedule 1, item 3, rule 1.21]

• only collecting, using or disclosing SR data that it received from secondary data holders for the purpose of securely transmitting the data to an accredited person to fulfil a consumer data request; [Schedule 1, item 3, rule 1.24]

• deleting SR data in accordance with existing requirements, once it has responded to the request; and [Schedule 1, item 3, rule 1.24(2)(b)]

• destroying any unsolicited SR data it received from a secondary data holder as soon as practicable. [Schedule 1, item 3, rule 1.25]

The obligation to delete SR data once the primary data holder has responded to the consumer data request ensures SR data is not held for any longer than is required to respond to such a request and that primary data holders cannot use their role in the P2P model to enrich or expand their own data holdings.

The obligation on primary data holders to destroy unsolicited CDR data as soon as practicable is subject to the maximum default civil penalty, reflecting the critical importance of ensuring the security of consumers’ information. [Schedule 1, item 3 and Schedule 3, item 29, rules 1.25 and 9.8]

A note to an existing provision in the CDR Rules about deletion is revised to reflect that the CDR data deletion process must be followed whenever the CDR Rules require any person to delete CDR data. [Schedule 1, item 2, note to rule 1.18]

Reporting and record keeping

Existing reporting and record keeping obligations in the CDR Rules are expanded to require data holders to keep and maintain records to cover:

• where the data holder is a primary data holder, any SR data requests and related responses from secondary data holders; and

• when the data holder is a secondary data holder, any SR data requests received from primary data holders and their responses to such requests, or where the request was refused, the reasons for the refusal.

[Schedule 1, item 5, rules 9.3(1)(ca)-(cb)]

A secondary data holder must prepare a report for each period that sets out the number of SR data requests received, and of those requests the number of times the data holder refused to disclose the SR data, the reasons for the refusal, and the number of times the data holder has relied on each of those reasons. The report must be in a form approved by the ACCC.

This requirement is a civil penalty provision. The maximum civil penalty that may be imposed for a contravention is $50,000 for an individual and $250,000 for a body corporate. [Schedule 1, item 6, rule 9.4(1A)]

This penalty is commensurate with other record keeping provisions and penalties in the CDR Rules and recognises that record keeping is fundamental to ensuring transparency and compliance in the CDR regime.

Schedule 2 – Amendments relating to the energy sector

Background

The Amending Rules insert Schedule 4 to the CDR Rules containing matters relevant to the energy sector, including:

• a number of definitions that apply only in relation to the energy sector;

• that AEMO data in relation to a CDR consumer is subject to the P2P model;

• modification of Privacy Safeguard 13 relating to correction of CDR data as it applies to AEMO data;

• the circumstances in which CDR consumers are eligible in relation to requests for energy sector CDR data that relates to them;

• the CDR data sets in respect of which consumer data requests may be made; and

• the staged application of the CDR Rules to the energy sector.

The Amending Rules also make amendments outside Schedule 4 that relate to energy.

Meaning of retailer

The definition of retailer in the energy sector designation instrument has been narrowed in Schedule 4 so that it only captures a data holder of energy sector data that retails electricity to connection points in the National Electricity Market. The intention is that data holder obligations only apply to authorised or licensed retailers that operate through the wholesale electricity market, known as the National Electricity Market (NEM), and the on-selling activities of retailers with respect to customers in off-market embedded networks are not captured. [Schedule 2, item 39, clause 1.4 of Schedule 4 to the CDR Rules]

Applying the P2P data sharing model to AEMO data

In the energy sector, SR data is AEMO data in relation to a CDR consumer, the relevant retailer is a primary data holder for the SR data and AEMO is the secondary data holder. [Schedule 2, item 39, clause 4.3 of Schedule 4 to the CDR Rules]

AEMO’s requirements to provide online services are limited to an online service that is able to receive and respond to requests from relevant retailers and conforms with the data standards. If a CDR consumer is eligible to make a consumer data request to a primary data holder for SR data, the consumer cannot also request it from AEMO. AEMO is not authorised to respond to requests from other CDR participants or CDR consumers. [Schedule 1, item 3, rules 1.19 and 1.20(2)]

The effect of specifying AEMO data as SR data is that the relevant retailer takes on the role of primary data holder as set out in Division 1.5 of the CDR Rules in relation to the AEMO data it holds. This means that consumer data requests and authorisations for disclosure of the data are made to the retailer as it is also the entity that discloses or refuses to disclose the requested data. In addition, any complaints relating to consumer data requests are made to the retailer and it keeps the records relating to the data that the CDR consumer can request.

Retailers as primary data holders are required to request any SR data to be used in responding to the request from AEMO, when responding to an SR data request under Part 3 or 4 of the CDR Rules. [Schedule 2, item 39, clause 4.4 of Schedule 4 to the CDR Rules]

Application of the privacy safeguards

The Government intends to amend the Competition and Consumer Regulations 2010:

• to exempt AEMO from obligations under four privacy safeguard provisions that apply to data holders under the Act, including in relation to data correction; and

• in circumstances where AEMO provides CDR data to a retailer, to apply privacy safeguard obligations to the retailer in relation to that data as if the retailer were the data holder.

Subject to the making of these Regulations, in relation to requests for correction of AEMO data, retailers are required to initiate the relevant correction procedures under the National Electricity Rules (NER) for NMI standing data and metering data and, for DER register data, must provide the requester with information about how the requester can contact the appropriate electricity distributor to have the data corrected. [Schedule 2, item 39, clause 6.1 of Schedule 4 to the CDR Rules]

Eligible CDR consumers in the energy sector

The Amending Rules provide for common economy-wide eligibility criteria that consumers must meet to be eligible under the CDR regime generally. In addition, sector Schedules can set out further criteria for the relevant sector. [Schedule 3, item 3, rule 1.10B]

Additional consumer eligibility requirements for the energy sector have also been included. These are that the consumer must be a customer of a retailer and the energy consumed in association with the consumer’s account, including aggregated consumption for multiple sites under an account, is less than 5 GWh over the previous 12 months, or for an account that has been in existence for less than 12 months, the estimated annual consumption is less than 5 GWh. The account that relates to the arrangement must also have one or more connection points or child connection points for which there is a financially responsible market participant in the NEM. [Schedule 2, item 39, clause 2.1 of Schedule 4 to the CDR Rules]

Under the CDR Rules, a person must have account privileges in relation to an account with a data holder to be a secondary user for the account or manage secondary user instructions on the account. For the energy sector, a person has account privileges in relation to an account with a retailer if they are a customer authorised representative of the account holder for the purposes of rule 56A of the National Energy Retail Rules or Chapter 10 of the National Electricity Rules. [Schedule 2, item 39, clause 2.2 of Schedule 4 to the CDR Rules, and Schedule 3, item 2, rule 1.7]

A retailer that receives a consumer data request under rule 1.15 on behalf of a CDR consumer who has online access to the relevant account, must provide the consumer with a consumer dashboard. If the CDR consumer does not have a consumer dashboard, the retailer must offer the consumer a consumer dashboard and provide it if the consumer accepts. [Schedule 2, item 39, clause 2.3 of Schedule 4 to the CDR Rules]

Energy sector CDR data that may be accessed under the CDR Rules

The Amending Rules define energy data sets that are able to be shared with a broad descriptor of the data set and specifying minimum inclusions of key data where appropriate. This approach allows flexibility for further refinement and specification of data sets in the standards.

For the energy sector, the Amending Rules provide details of the information included in the terms ‘customer data’, ‘account data’, ‘billing data’, ‘metering data’, NMI standing data’, ‘DER register data’, ‘tailored tariff data’ and ‘product specific data’. [Schedule 2, item 39, clause 1.3 of Schedule 4 to the CDR Rules]

‘Calculated metering data’ (as defined in the National Electricity Rules) is not designated CDR data and is therefore not included in ‘metering data’.

The meaning of ‘required product data’, ‘voluntary product data’, ‘required consumer data’ and ‘voluntary consumer data’ in the energy sector is also set out. [Schedule 2, item 39, Part 3 of Schedule 4 to the CDR Rules]

Required product data means CDR data for which there are no CDR consumers that:

• falls within a class of information specified in section 9 or section 10 of the designation instrument for the energy sector;

• is about certain characteristics of the product (such as the product’s eligibility criteria, price, terms and conditions, availability or performance);

• is product specific data; and

• is held by the Australian Energy Regulator (AER) or the Victorian agency for the purpose of operating websites that provide such information to the public.

[Schedule 2, item 39, clause 3.1(1) of Schedule 4 to the CDR Rules]

Voluntary product data means CDR data that is not required product data but is energy sector data and product specific data in relation to a plan offered by or on behalf of the data holder. [Schedule 2, item 39, clause 3.1(2) of Schedule 4 to the CDR Rules]

Required consumer data means CDR data for which there are one or more CDR consumers, and that:

• is energy sector data;

• is, in relation to the consumer, customer data, account data, billing data, AEMO data or tailored tariff data;

• relates to a time at which an account holder for the account was associated with the premises to which the request relates; and

• is held in a digital form.

[Schedule 2, item 39, clause 3.2(2) of Schedule 4 to the CDR Rules]

The data must relate to an account held by the CDR consumer in their name alone, or to a joint account or partnership account, and in the case of account data, billing data or tailored tariff data, the account must be open. [Schedule 2, item 39, clauses 3.2(1)-(2) of Schedule 4 to the CDR Rules]

Voluntary consumer data means CDR data for which there are one or more CDR consumers that is energy sector data, relates to a time at which an account holder for the account was associated with the premises to which the request relates and is not required consumer data. [Schedule 2, item 39, clause 3.2(3) of Schedule 4 to the CDR Rules]

Some data is explicitly excluded from the CDR regime under the CDR Rules.

For the purposes of the energy sector, data is neither required or voluntary consumer data unless:

• it is account data, billing data, tailored tariff data or AEMO data, in relation to an account that is held by a single person or a partnership or joint account, and in the case of partnership and joint accounts, all account holders are at least 18; or

• in relation to a consumer data request, it is ‘customer data’ (personally identifying information) for the person who made the request (as opposed to another account holder or secondary user), or is AEMO data in relation to premises covered by the relevant arrangement at the time to which the data relates.

[Schedule 2, item 39, clause 3.2(4) of Schedule 4 to the CDR Rules]

Energy sector data is also not required or voluntary consumer data if it relates to a data holder that is not a retailer or AEMO. [Schedule 2, item 39, clause 3.2(5) of Schedule 4 to the CDR Rules]

The effect of this is that if an accredited person becomes a data holder of energy sector CDR data because of section 56AJ(3) of the Act, they will not need to respond to a consumer data request for that data. Normally, under section 56AJ(3) a person who has CDR data disclosed to them other than from the operation of the CDR Rules is a data holder of that data if they are an accredited data recipient of other CDR data, and would consequently be required to respond to a consumer data request for that data. In the energy sector it is not expected that a person who becomes an accredited person would meet the requirements of section 56AJ(3) unless they are already a retailer.

CDR data on an open account will not be required consumer data if the data relates to a transaction or event from more than 2 years prior. The effect of this exception is that any such data would be ‘voluntary consumer data’. Requiring up to two years of CDR data to be shared facilitates energy use cases such as comparison and switching and is in line with consumers’ current ability to obtain metering and billing data from their retailer under national energy regulation. [Schedule 2, item 39, clause 3.2(6) of Schedule 4 to the CDR Rules]

In addition, CDR data for accounts that are closed at a particular time will not be required consumer data unless it is AEMO metering data, billing data held by retailers, or it relates to a transaction or event that happened no more than 2 years before the request was made. [Schedule 2, item 39, clause 3.2(7) of Schedule 4 to the CDR Rules]

CDR data sharing for billing data relating to a closed account may arise where a CDR consumer has multiple energy accounts with a retailer, has been with the retailer for a continuous period and where each of the accounts relates to one connection point and the consumer has closed at least one such an of these accounts but still has at least one other active account with the retailer. The CDR Rules do not require a retailer data holder to share CDR data that relates to a closed account if the CDR consumer is not an eligible consumer in relation to the data holder.

Staged application of the CDR Rules to the energy sector

The CDR Rules will apply to different groups of data holders in the energy sector at different stages.

Data holders will have different CDR obligations at different times, depending on the complexity of the consumer data request they may receive. If a consumer data request is a request made on behalf of a large customer, secondary user or relates to a joint or partnership account, this will be a complex request. Data holders will not have to begin to comply with the CDR Rules in respect of complex requests at the same time as they must comply with non-complex requests. [Schedule 2, item 39, clause 8.1 of Schedule 4 to the CDR Rules]

The AER must comply with Part 2 of the CDR Rules (dealing with product data requests) on and from 1 October 2022. [Schedule 2, item 39, clause 8.4(2) of Schedule 4 to the CDR Rules]

The following energy retailers must comply with Part 4 of the CDR Rules, which deals with consumer data requests made by accredited persons, in respect of non-complex requests, from 15 November 2022:

• The following members of the AGL Energy Group:

– AGL Sales (Queensland Electricity) Pty Limited;

– AGL South Australian Pty Ltd; and

– AGL Sales Pty Limited.

• The following members of the Origin Energy Group:

– Origin Energy Electricity Limited; and

– any other subsidiary of Origin Energy Limited authorised or licensed to sell electricity in the National Electricity Market.

• The following members of the Energy Australia Group:

– EnergyAustralia Pty Ltd; and

– EnergyAustralia Yallourn Pty Ltd.

[Schedule 2, item 39, clauses 8.2 and 8.6(2) of Schedule 4 to the CDR Rules]

These same retailers must comply with Part 4 of the CDR Rules in respect of complex requests from 15 May 2023. [Schedule 2, item 39, clauses 8.2 and 8.6(4) of Schedule 4 to the CDR Rules]

AEMO must comply with Part 4 from 15 November 2022. [Schedule 2, item 39, clause 8.6(3) of Schedule 4 to the CDR Rules]

If a retailer meets a threshold of 10,000 small customers or more on the day the Amending Rules commence, that retailer will be defined as a larger retailer for the purposes of the CDR Rules.

If a retailer does not meet the threshold on commencement, but meets the threshold of 10,000 small customers or more at all times during a financial year beginning after the Amending Rules commence, that retailer will also become a larger retailer 12 months after the end of that financial year.

Larger retailers must comply with Part 4 of the CDR Rules, in respect of non-complex requests, on and from 1 November 2023. If the retailer does not meet the threshold on commencement of the Amending Rules or on 1 November 2023, it must comply with Part 4 from the date that it becomes a larger retailer. [Schedule 2, item 39, clauses 8.3 and 8.6(5) of Schedule 4 to the CDR Rules]

Larger retailers must comply with Part 4 in respect of complex requests on and from 1 May 2024. Similarly, if the retailer does not meet the threshold by 1 May 2024, it must comply with Part 4 from the day it becomes a larger retailer. [Schedule 2, item 39, clause 8.6(6) of Schedule 4 to the CDR Rules]

Once a retailer becomes a larger retailer for the purposes of the CDR Rules, it remains one thereafter, regardless of whether its number of small customers drops below 10,000.

Example:

XYZ Ltd is an electricity retailer with 9,999 small customers on 1 November 2023. One week later, on 8 November 2023, it has 10,000 small customers. If XYZ Ltd maintains its 10,000 small customers for the entire 2024-25 financial year, it will become a larger retailer and have data holder obligations in respect of non-complex and complex requests under Part 4 of the CDR Rules from 1 July 2026.

Retailers below the threshold of 10,000 small customers are considered small retailers under the CDR Rules. Small retailers will not have obligations as data holders under the CDR Rules, unless:

• they become accredited persons; or

• they wish to participate in the CDR system as data holders voluntarily.

If a small retailer becomes an accredited person, that small retailer will have data holder obligations under Part 4 of the CDR Rules in respect of non-complex requests:

• from 15 November 2023 (if the retailer is accredited before or on 15 November 2022); or

• 12 months after the day they become accredited.

[Schedule 2, item 39, clause 8.6(7) of Schedule 4 to the CDR Rules]

Similarly, a small retailer who is an accredited person will have data holder obligations under Part 4 in respect of complex requests:

• from 15 May 2024 (if the retailer is accredited before or on 15 November 2022); or

• 18 months after the day they become accredited.

[Schedule 2, item 39, clause 8.6(8) of Schedule 4 to the CDR Rules]

If a small retailer is not required to participate in the CDR, but wishes to participate in the CDR as a data holder, it may notify the ACCC that it wishes to participate voluntarily on and from a specified date of the retailer’s choosing. However, this date must be no earlier than 15 November 2022 (in respect of non-complex requests) or 15 May 2023 (in respect of complex requests). [Schedule 2, item 39, clause 8.6(9)-(10) of Schedule 4 to the CDR Rules]

Once a small retailer elects to participate voluntarily in the CDR, it will continue to have obligations as a data holder under Part 4 of the CDR Rules on and from the date of its choice. There is no mechanism to opt-out of participation once the retailer has opted-in. [Schedule 2, item 39, clause 8.6(10) of Schedule 4 to the CDR Rules]

Subject to the Minister declaring the Victorian Department of Energy, Land, Water and Planning (DELWP) to be a participating entity under section 56AS of the Act, DELWP will participate as a data holder of product data only, at a date specified in the declaration. [Schedule 2, item 39, clauses 8.1 and 8.4(3) of Schedule 4 to the CDR Rules]

Consistent with the banking sector, the Amending Rules also enable other retailers (who are not the three initial retailers), if they are ready to share CDR data early, to come into the regime voluntarily at an appropriate time after 15 November 2022. If a retailer chooses to be a part of CDR, they must comply with all relevant CDR obligations. [Schedule 2, item 39, clause 8.7 of Schedule 4 to the CDR Rules]

Part 3 of the CDR Rules will not apply to CDR participants in the energy sector. [Schedule 2, item 39, clause 8.5 of Schedule 4 to the CDR Rules]

Dispute resolution processes in the energy sector

Requirements for accredited persons and retailer data holders in the energy sector in relation to their internal and external dispute resolution processes are set out. [Schedule 2, item 39, Part 5 of Schedule 4 to the CDR Rules]

Internal dispute resolution processes must:

• for accredited persons, comply with the Australian Securities and Investments Commission’s Regulatory Guide 271 (RG 271) dealing with specified matters such as commitment and culture, the enabling of complaints, resourcing, responsiveness, objectivity and fairness, policy and procedures, data collection, analysis and internal reporting and continuous improvement; and

• for retailer data holders, satisfy the applicable requirements under the National Energy Retail Law or Energy Retail Code (Victoria).

[Schedule 2, item 39, clause 5.1 of Schedule 4 to the CDR Rules]

In accordance with section 56BG of the Act, which provides that the CDR Rules may apply, adopt or incorporate by reference any matter contained in any other instrument or writing as in force or existing at a particular time or from time to time, RG 271 is incorporated as existing from time to time. The location for accessing the most up to date version of RG 271 is provided in the note to the new clause 5.1 of Schedule 4 to the CDR Rules.

Where a retailer becomes an accredited person, the retailer will be able to continue to comply with the internal dispute resolution requirements under the National Energy Retail Law or the Energy Retail Code (Victoria). These retailers will not need to comply with RG 271 if the requirements under the National Energy Retail Law or Energy Retail Code (Victoria) are satisfied. [Schedule 2, item 39, clause 5.1(2) of Schedule 4 to the CDR Rules]

For external dispute resolution, retailer data holders must be members of each relevant State or Territory energy and water ombudsman that has been recognised as an external dispute resolution scheme for section 56DA of the Act and accredited persons must be members of the Australian Financial Complaints Authority (AFCA). Where a retailer is also an accredited person, and does not use energy sector CDR data it collects to provide services outside of the energy sector, those retailers must be members of the relevant energy and water ombudsman in relation to CDR consumer complaints. Where the jurisdiction does not have an energy and water ombudsman (for example, the Australian Capital Territory), the retailer must take the necessary steps to participate in dispute resolution processes appropriate for CDR consumer complaints provided by that jurisdiction. [Schedule 2, item 39, clause 5.2 of Schedule 4 to the CDR Rules]

Where a retailer is also an accredited person and uses non-energy sector CDR data to provide services outside of the energy sector, those retailers must also be members of AFCA.

The Accreditation Registrar must maintain a database in association with the Register of Accredited Persons that includes such information as the Registrar considers necessary to enable processing of requests in accordance with the CDR Rules and data standards. [Schedule 2, item 35, rule 5.25(1)]

Information relating to AEMO in its capacity as a data holder is excluded from appearing on the database, because of AEMO’s unique role in the CDR system where it does not interact directly with the Register for the purposes of data sharing and therefore, it is not necessary for the Registrar to keep the kinds of information set out in rule 5.25 on the Register in relation to AEMO. [Schedule 2, item 39, clause 9.4 of Schedule 4 to the CDR Rules]

Miscellaneous other amendments to the CDR Rules for the energy sector

• A simplified outline and definitions clause is included for new Schedule 4 to the CDR Rules. [Schedule 2, item 39, clauses 1.1 and 1.2 of Schedule 4 to the CDR Rules]

• Product data derives from retailers, who are required by the National Energy Retail Law and the Electricity Industry Act 2000 (Vic) to provide it to the AER or the Victorian agency. Those agencies therefore become data holders for product data in the energy sector. This does not affect the operation of rule 2.3 with respect to the banking sector. [Schedule 2, item 39, note 2 to clause 3.1(1) of Schedule 4 to the CDR Rules]

• Where the CDR Rules require an energy sector agency (the AER or the Victorian agency) to act in relation to a product data request, either agency may request the other agency to act on its behalf. [Schedule 2, item 39, clause 4.1 of Schedule 4 to the CDR Rules]

• A data holder of energy sector data, other than the AER or the Victorian agency, is not required to provide a product data request service. However, if it chooses to provide an online service that can be used to make such requests, it must comply with rule 1.12. [Schedule 2, item 39, clause 8.4 of Schedule 4 to the CDR Rules]

• Civil penalty provisions under the CDR Rules, including those set out in rule 9.8, do not apply to AEMO or the energy sector agencies. [Schedule 2, item 39, clause 4.5 of Schedule 4 to the CDR Rules]

• The reporting requirements under rule 9.4(1) are modified in relation to the AER and the Victorian agency. [Schedule 2, item 39, clause 7.1 of Schedule 4 to the CDR Rules]

• For the purposes of rule 1.7, the following laws are specified as being laws relevant to the management of CDR data in relation to the energy sector:

(a) the National Electricity Law;

(b) the National Energy Retail Law; and

[Schedule 2, item 39, clause 9.1 of Schedule 4 to the CDR Rules]

• Conditions are set out for a retailer that has collected CDR data in accordance with a consumer data request under Part 4 of the CDR Rules to be a data holder (rather than an accredited data recipient) of that CDR data. [Schedule 2, item 39, clause 9.2 of Schedule 4 to the CDR Rules]

• For the purposes of rule 5.4(1)(c), the AER and the Essential Services Commission of Victoria are specified as additional authorities the Data Recipient Accreditor may consult with in relation to decisions about accreditation under Part 5 of the CDR Rules. [Schedule 2, items 30 and 39, rule 5.4(1)(c) and clause 9.3 of Schedule 4 to the CDR Rules]

• The Amending Rules amend the table in existing rule 5.17 to ensure the grounds for revocation, suspension or surrender of accreditation are not expressed in sector‑specific terms, with sector Schedules to instead set out specific conditions as appropriate. The additional grounds for revocation, suspension or surrender of accreditation in the energy sector for the purposes of table item 5 in rule 5.17 are:

– that the accredited person was, at the time of the accreditation, a retailer; and

– the accredited person’s authorisation or licence to sell electricity in the National Electricity Market has been suspended or revoked.

[Schedule 2, items 34 and 39, table item 5 in rule 5.17(1) and clause 9.5 of Schedule 4 to the CDR Rules]

• The Amending Rules also make a series of consequential amendments outside new Schedule 4 to the CDR Rules to:

– update definitions, and outline and overview provisions; [Schedule 2, items 1 to 14 and 19, rules 1.4, 1.6, 1.7 and 2.1]

– indicate where rules are modified or supplemented by a sector Schedule to the CDR Rules; and [Schedule 2, items 15, 17, 18, 21, 22, 24 to 29, 31 to 34 and 36 to 38, rules 1.15(1), 5.5(b), table item 5 in rule 5.17(1), and notes to rules 1.12(1), 1.15(1), 2.4(2), 2.4(3), 3.4(2), 3.4(3), 4.5(2), 4.5(3), 4.6(3), 4.6(4), 5.12(1), 6.1, 6.2 and 7.15]

– adjust terminology and expression. [Schedule 2, items 16, 20 and 23, rule 1.13(1)(e)(ii), 2.3(1) and note to rule 3.3(1)]

Schedule 3 – Miscellaneous amendments

Schedule 3 makes miscellaneous and technical amendments to ensure the CDR Rules operate as intended. In particular, Schedule 3 amends the CDR Rules with respect to the definition of an eligible consumer, secondary user provisions, ongoing reporting obligations on ADIs, rules relating to data standards, and to make consequential amendments after the passage of changes to the Act.

Eligibility requirements for CDR consumers

The Amending Rules provide for common economy-wide eligibility criteria that consumers must meet to be eligible under the CDR regime generally. In addition, sector Schedules can set further criteria for the relevant sector. [Schedule 3, items 1 and 3, rules 1.7 and 1.10B]

The Amending Rules move common elements of CDR consumer eligibility from the banking sector Schedule into the main body of the CDR Rules.

These common eligibility criteria are consistent with the current operation of eligibility for the banking sector and do not affect its operation.

The economy-wide elements of eligibility are that a CDR consumer must:

• be an individual who is 18 years or older, or a non-individual; and

• be an account holder or secondary user for an account that is held with a data holder and that is open, and that has the characteristics (if any) specified in the sector Schedule.

[Schedule 3, item 3, rule 1.10B]

The consumer eligibility requirements for the banking sector have been amended to provide that for a CDR consumer to be eligible, the consumer must be able to access the relevant account online, which in the case of a partnership, requires that the partnership account has been set up to be accessible online. [Schedule 3, item 32, clause 2.1 of Schedule 3 to the CDR Rules]

In order to meet the requirements regarding provision of consumer dashboards under rule 1.15, data holders in the banking sector that receive a consumer data request from an accredited person on behalf of an eligible CDR consumer must provide the consumer with a consumer dashboard. [Schedule 3, item 33, clause 2.3 of Schedule 3 to the CDR Rules]

Notes to provisions about consumers’ eligibility requirements have been amended to take into account the move to rules of general application and specific eligibility requirements contained in sector Schedules. [Schedule 3, items 6, 11 and 13, rules 3.3, 4.5 and 4.7B]

Ongoing reporting obligations on ADIs

The Amending Rules clarify that ongoing reporting obligations of accredited persons do not apply to unrestricted authorised deposit-taking institutions (ADIs). [Schedule 3, items 29 and 30, clause 2.1(1A) of Schedule 1 to the CDR Rules]

Unrestricted ADIs are eligible for streamlined accreditation. The accreditation process is streamlined for these ADIs in the sense that they do not need to provide an independent assurance report to establish information security capability at the application stage. ADIs do not need to provide this evidence because they are already required to meet the Australian Prudential Regulation Authority’s (APRA) CPS 234 information security standard.

The amendments to the ongoing reporting requirements merely clarify that unrestricted ADIs do not need to meet the ongoing reporting requirements as they will continue to meet CPS 234 and be supervised by APRA.

Secondary users and nominated representatives

The secondary user rules are amended to clarify that to be a secondary user, a person must be an individual aged 18 or older who has account privileges in relation to the relevant account, and that the account holder that gave the secondary user instruction must also be an individual aged 18 or older. [Schedule 3, item 2, rule 1.7]

The nominated representative mechanism in the CDR Rules designed to enable non-individuals (e.g. businesses) to make nominations about who can share their CDR data, have also been clarified to require nominated representatives to also be individuals aged 18 or older. [Schedule 3, items 4 and 5, rule 1.13]

Rules relating to Data Standards Advisory Committees

The rules relating to establishing a Data Standards Advisory Committee are amended to provide that a Data Standards Advisory Committee must be established in relation to each designated sector. A Data Standards Advisory Committee may, however, be appointed to cover more than one designated sector. [Schedule 3, items 18 to 27, rules 8.1 to 8.7]

Consequential amendments to the rules relating to privacy safeguards

Schedule 3 amends the rules relating to privacy safeguards to align the CDR Rules with the privacy safeguard provisions in the Act.

The Act was amended by the Treasury Laws Amendment (2020 Measures No. 6) Act 2020 to ensure that some privacy safeguard provisions applied to accredited persons before they received any CDR data.

The Amending Rules ensure that:

• an accredited person must comply with the obligation to have a CDR policy before it receives any CDR data; [Schedule 3, item 14, rule 7.2]

• under the CDR Rules, the exceptions to the privacy safeguard obligation to give a consumer the option to be dealt with anonymously or pseudonymously applies to an accredited person before it receives any CDR data as well as when it is an accredited data recipient; [Schedule 3, item 15, rule 7.3(1)(a)]

Dispute resolution processes in the banking sector

The rules about internal dispute resolution processes for CDR participants in the banking sector have been updated to require that such processes comply with the Australian Securities and Investments Commission’s Regulatory Guide 271 (RG 271) dealing with specified matters such as commitment and culture, the enabling of complaints, resourcing, responsiveness, objectivity and fairness, policy and procedures, data collection, analysis and internal reporting and continuous improvement. [Schedule 3, item 38, clause 5.1 of Schedule 3 to the CDR Rules]

In accordance with section 56BG of the Act, which provides that the CDR Rules may apply, adopt or incorporate by reference any matter contained in any other instrument or writing as in force or existing at a particular time, or from time to time, RG 271 is incorporated as existing from time to time. The details for accessing the most up to date versions are provided in the note to the new clause 5.1 of Schedule 3 to the CDR Rules.

Miscellaneous other amendments

Minor amendments to clarify terminology in the banking sector have been made, including in provisions dealing with consumer data, product data and accreditation . [Schedule 3, items 31, 34 to 37 and 39, clauses 1.2, 3.1 and 3.2 and table item 2 in clause 6.2 of Schedule 3 to the CDR Rules]

The Amending Rules ensure that a data holder may refuse to invite a CDR consumer to amend an authorisation if the data holder considers this to be necessary to prevent physical or financial harm or abuse, or for certain other reasons set out in existing rule 4.7. [Schedule 3, item 12, rule 4.7(1)]

The Amending Rules amend the table in existing rule 5.17 to ensure the grounds for revocation, suspension or surrender of accreditation are not expressed in sector‑specific terms, with sector Schedules to instead set out specific conditions as appropriate. The additional grounds for revocation, suspension or surrender of accreditation in the banking sector for the purposes of table item 5 in rule 5.17 are:

• that the accredited person was, at the time of the accreditation, an ADI; and

• the accredited person’s authorisation or licence to sell electricity in the National Electricity Market has been suspended or revoked.

[Schedule 2, item 34, table item 5 in rule 5.17(1), and Schedule 3, item 40, clause 7.5 of Schedule 3 to the CDR Rules]

The Amending Rules correct a number of drafting errors identified in previous amendments to the CDR Rules. [Schedule 3, items 7-10 and 17, rules 4.3C(1)(g)-(i) and 7.5(1)(h)]

Under section 56BL of the Act, the rules may specify that certain provisions of the rules are civil penalty provisions (within the meaning of the Regulatory Powers (Standard Provisions) Act 2014). Amendments are made to Rule 9.8 to include the new civil penalty provisions set out above in this explanatory statement. [Schedule 3, item 28, rule 9.8]

Civil penalties

The default maximum civil penalty for a breach of CDR Rules is $500,000 for an individual. For a body corporate, the maximum is the greatest of:

• $10 million;

• if the court can determine the value of the benefit obtained and that is reasonably attributable to the act or omission – three times the value of that benefit; and

• if the court cannot determine the value of that benefit – 10% of annual turnover during the period of 12 months ending at the end of the month in which the act or omission occurred.

The Act provides that where a civil penalty does apply to a breach of the CDR Rules, the CDR Rules may specify a lower penalty amount than the default maximum. If the CDR Rules do not specify an amount, then the maximum civil penalty is as per the amount worked out under paragraph 76(1A)(b) of the Act.

This explanatory statement indicates where the Amending Rules introduce a civil penalty provision and the rationale for each penalty. It also indicates where a maximum penalty is set below the default maximum penalty.

The Amending Rules introduce civil penalties for record keeping and reporting obligations in relation to the new rules for secondary data holders dealing with SR data requests. The Amending Rules specify that these maximum civil penalties ($50,000 for an individual and $250,000 for a body corporate) are set below the default maximum civil penalty.

Rules 9.3 and 9.4 set out obligations on data holders and accredited data recipients to keep and maintain records of a range of specified matters relating to disclosure of CDR consumers’ data. As CDR regulators, the OAIC and ACCC may require data holders and accredited data recipients to provide copies of these records, as needed in the performance of their statutory functions. CDR consumers may also require data holders and accredited data recipients to provide them with copies of certain kinds of records required to be kept by rule 9.3. Compliance with these record keeping requirements is critical to support effective enforcement of the CDR obligations by the ACCC and OAIC, and to enable consumers to obtain records to assist them in using the dispute resolution processes available under the CDR regime to resolve disputes with CDR participants. These obligations reflect the importance of the availability and accuracy of records to enable the effective operation of the CDR regulatory framework and the maximum penalties in relation to these obligations reflect the importance of compliance and are therefore appropriate and proportionate.

ATTACHMENT B

Statement of Compatibility with Human Rights

Prepared in accordance with Part 3 of the Human Rights (Parliamentary Scrutiny) Act 2011

Competition and Consumer (Consumer Data Right) Amendment Rules (No. 2) 2021

This Legislative Instrument is compatible with the human rights and freedoms recognised or declared in the international instruments listed in section 3 of the Human Rights (Parliamentary Scrutiny) Act 2011.

Overview of the Legislative Instrument

The purpose of the Competition and Consumer (Consumer Data Right) Amendment Rules (No. 2) 2021 (the Amending Rules) is to amend the Competition and Consumer (Consumer Data Right) Rules 2020 (the CDR Rules) to implement the Consumer Data Right in the energy sector by:

• establishing a peer-to-peer (P2P) data access model for primary and secondary data holders who share responsibility for responding to consumer data requests;

• applying that P2P data access model to energy sector data;

• making rules that relate specifically to the energy sector; and

• making minor and technical amendments to remove anomalies and ensure the CDR Rules operate as intended.

Schedule 2 to the Amending Rules makes rules that relate specifically to the energy sector including: the eligibility requirements for energy consumers to be able to share CDR data; defining the energy data sets that may be shared; aligning the internal dispute resolution (IDR) requirements for data holders for CDR in energy with existing energy sector IDR requirements under national energy legislation; and a staged implementation of CDR in the energy sector.

Schedule 3 to the Amending Rules makes minor amendments to remove anomalies and ensure the CDR Rules operate as intended. In particular, Schedule 3 amends the CDR Rules with respect to: the definition of an eligible consumer; external dispute resolution requirements for the energy sector; ongoing reporting obligations on authorised deposit-taking institutions (ADIs); rules relating to data standards; and to make consequential amendments after the passage of changes to the Act.

Human rights implications

P2P data access

The Amending Rules engage Article 17 because they authorise the disclosure of CDR data directly from one data holder (the secondary data holder or AEMO for the energy sector) to another data holder (the primary data holder, or the retailer for the energy sector).

In order for an interference with the right to privacy to be permissible, the interference must be authorised by law, be for a reason consistent with the ICCPR and be reasonable in the particular circumstances. The UN Human Rights Committee has interpreted the requirement of ‘reasonableness’ to imply that any interference with privacy must be proportional to the end sought and be necessary in the circumstances of any given case.

As elsewhere in the CDR Rules, the ability for primary and secondary data holders to share sensitive personal data is limited to a specific purpose.

A secondary data holder in the P2P model is only authorised to disclose relevant CDR data to a primary data holder for the purpose of responding to a valid secondary responsibility data request made by or on behalf of a CDR consumer.

A primary data holder has a number of important obligations under the CDR Rules when dealing with a consumer’s secondary responsibility CDR data. These include:

• providing the consumer dashboard under rule 1.15;

• only collecting, using, or disclosing SR data that it received from secondary data holders for the purpose of securely transmitting the data to an accredited person to fulfil a consumer data request;

• deleting SR data in accordance with existing requirements, once it has responded to the request; and

• destroying and unsolicited SR data it received from a secondary data holder as soon as practicable.

Importantly, the requirement to destroy unsolicited SR data from a secondary data holder ensures SR data is not held for any longer than is required to respond to such a request. This prevents primary data holders from using their role in the P2P model to expand their own data holdings.

The obligation on primary data holders to destroy unsolicited secondary responsibility data as soon as practicable is subject to a civil penalty, reflecting the critical importance of ensuring the security of consumers’ sensitive information.

The P2P model is necessary for the proper functioning of the CDR, and appropriate for the energy sector because responsibility for energy sector CDR data needs to be shared between an energy retailer (who has a direct relationship with the consumer) and AEMO (who has no direct relationship with the consumer). This enables CDR consumers in the energy sector to engage meaningfully in the relevant energy markets using a complete suite of their personal data held by both their retailer and AEMO.

As such, these amendments are consistent with Article 17 of the ICCPR, as they are proportional to the ends sought and necessary in the circumstances.

Energy sector amendments

The Amending Rules engage the right to protection from unlawful or arbitrary interference with privacy under Article 17 of the International Covenant on Civil and Political Rights (ICCPR) because they enable, in the context of the energy sector, a person to directly access or to direct another person or entity to transfer personal information about themselves to another person or entity.

Under the existing CDR rules, data holders can disclose consumer data to accredited data recipients, where the consumer to whom the data pertains has provided consent for their data to be transferred. The privacy of the consumer is protected by several Privacy Safeguards and other obligations that require data holders and accredited data recipients to ensure the protection of the consumers for whom they hold data.

The energy sector amendments provide for new data holders – being energy retailers and AEMO – to disclose consumer data to accredited data recipients using the existing mechanisms in the CDR Rules. To the extent that privacy safeguards and civil penalties apply to accredited data recipients in the CDR, they will also apply to accredited data recipients when they deal with energy sector CDR data.

As such, these amendments are consistent with Article 17 of the ICCPR, as they are proportional to the ends sought and necessary in the circumstances. Civil penalties

Like the existing CDR rules, the Amending Rules introduce civil penalty obligations. These civil penalty provisions potentially invoke Articles 14 and 15 of the ICCPR. Although the Articles cover criminal process rights, in international human rights law, where a civil penalty is imposed, it must be determined whether it nevertheless amounts to a ‘criminal’ penalty. As with the existing civil penalties, the new civil penalty provisions should not be considered ‘criminal’ for this purpose. While they are intended to deter non-compliance with CDR obligations, none of the provisions carry a penalty of imprisonment for non-payment of a penalty.

Conclusion

The Amending Rules are compatible with human rights as to the extent that they do engage the relevant human rights and freedoms, they are proportional to the ends sought and reasonable and necessary in the circumstances.

Legislation content

EXPLANATORY STATEMENT

Issued by authority of the Minister for Superannuation, Financial Services and the Digital Economy

Statement of Compatibility with Human Rights

Competition and Consumer (Consumer Data Right) Amendment Rules (No. 2) 2021

Overview of the Legislative Instrument

Human rights implications

Conclusion

Interactions

Authorises

All Versions