EXPLANATORY STATEMENT
Issued by authority of the Assistant Treasurer and Minister for Financial Services
Competition and Consumer Act 2010
Consumer Data Right (Authorised Deposit-Taking Institutions) Amendment Designation 2023
Subsection 56AC(2) of the Competition and Consumer Act 2010 (the Act) provides that the Minister may, by legislative instrument, designate a sector of the Australian economy as subject to the consumer data right (the CDR). The CDR scheme is set out in Part IVD of the Act and the Competition and Consumer (Consumer Data Right) Rules 2020 (the Rules).
Subsection 33(3) of the Acts Interpretation Act 1901 provides that a power to make an instrument includes (inter alia) a power to amend the instrument.
The purpose of the Consumer Data Right (Authorised Deposit-Taking Institutions) Amendment Designation 2023 (the amendment Designation) is to make a minor and technical amendment to clarify the scope of the definition of ‘product’ in the Consumer Data Right Amendment (Authorised Deposit-Taking Institutions) Designation 2019 (the principal Designation). The amendment explicitly extends the definition of ‘product’ to lease products. These products were always intended to be captured. Lease products, including consumer leases and asset finance, fall within the prescribed list of banking products in the Rules. The sector is currently operating consistently with these obligations.
Subsection 56AD(1) of the Act requires the Minister to consider a range of factors, including: the effect of the instrument on the interests of consumers; the efficiency of the relevant market; the privacy of consumer data; the promotion of competition; promoting data-driven innovation; and the public interest. In making the amendment Designation, the Minister has considered all requisite factors.
Subsection 56AD(2) of the Act requires the Minister to be satisfied that the Secretary to the Treasury has arranged for analysis, consultation and a report in relation to the instrument, and to wait at least 60 days after publication of that report, before making a designation instrument.
The Minister has complied with these requirements. The Government released an Open Banking sectoral assessment consultation paper on the amendment on 19 August 2022 and conducted a four-week consultation on the draft amendment Designation. The submissions received did not necessitate any changes to the instrument. The final report on the Instrument was published on 1 November 2022.
Subsection 56AD(3) of the Act requires the Minister to consult the Information Commissioner about the likely effect of making the instrument on the privacy or confidentiality of consumers’ information. The Minister has complied with this requirement, including by considering the Information Commissioner’s report on the draft amendment Designation.
The amendment Designation is a legislative instrument for the purposes of the Legislation Act 2003.
The amendment Designation commenced on the day after it was registered.
Details of the amendment Designation are set out in Attachment A.
A Statement of Compatibility with Human Rights is at Attachment B
The Office of Impact Analysis has been (OIA) has been consulted (ref: OBPR22‑02740) and agreed that amendment Designation is unlikely to have a more than minor regulatory impact, and therefore the preparation of an Impact Analysis is not required.
ATTACHMENT A
Details of the Consumer Data Right (Authorised Deposit‑Taking Institutions) Amendment Designation 2023
Section 1—Name
This section provides that the title of the amendment Designation is the Consumer Data Right (Authorised Deposit‑Taking Institutions) Amendment Designation 2023.
Section 2—Commencement
This section provides that the amendment Designation will commence on the day after it is registered.
Section 3—Authority
This section states that the amendment Designation is made under subsection 56AC(2) of the Act.
Section 4—Schedule
This section provides that each instrument that is specified in a Schedule to this instrument will be amended or repealed as set out in the applicable items in the Schedule, and that any other item in the Schedule to this instrument has effect according to its terms.
Schedule 1 – Amendments
Item [1] – Paragraph 4(2)(a)
Item 1 amends paragraph 4(2)(a) of the principal Designation by inserting new subparagraph (a)(iia), relating to letting goods on hire, including on hire-purchase. The intention is to clarify that the definition of product in subsection 4(2) includes a lease, including a lease of the following kinds:
• a consumer lease;
• an equipment operating lease;
• a finance lease (for either a vehicle or equipment);
• a novated lease (used for car finance when employees salary sacrifice through their employer, with the lessor making the lease arrangement with the employer);
• vehicle fleet leasing;
• asset finance or ‘asset purchase’ (the provider purchases and owns the asset, and the customer buys it from the provider in instalments over an agreed period, with ownership transferring to the customer upon final payment).
It is intended to capture a lease whether or not the lessee has a right or obligation to purchase the goods to which the lease relates.
Currently, ‘product’ is defined in subsection 4(2) of the principal Designation as a good or service that is or has been offered or supplied to a person in connection with:
• taking money on deposit, for example a savings account;
• making advances of money, for example a mortgage or credit card;
• another financial activity prescribed by regulations for the purposes of the definition of a banking business.
A product also includes a purchased payment facility that is or has been offered or supplied to a person.
This amendment will put it beyond doubt that the definition of ‘product’ in the principal Designation extends to leases.
ATTACHMENT B
Statement of Compatibility with Human Rights
Prepared in accordance with Part 3 of the Human Rights (Parliamentary Scrutiny) Act 2011
Consumer Data Right (Authorised Deposit-Taking Institutions) Amendment Designation 2023
The Consumer Data Right (Authorised Deposit-Taking Institutions) Amendment Designation 2023 (the Legislative Instrument) is compatible with the human rights and freedoms recognised or declared in the international instruments listed in section 3 of the Human Rights (Parliamentary Scrutiny) Act 2011 (the relevant rights and freedoms).
Overview of the Legislative Instrument
The consumer data right scheme (the CDR scheme) is set out in Part IVD of the Competition and Consumer Act 2010 (the Act) and the Competition and Consumer (Consumer Data Right) Rules 2020 (the Rules). The CDR scheme provides individuals and businesses with a right to authorise accredited third parties to securely access data relating to them. There is also the capacity for individuals and businesses to access this data themselves. In addition, the CDR scheme requires businesses in designated sectors to provide information on specified products that they offer.
The CDR scheme is designed to maximise consumer choice, enhance individuals’ control over their own information and facilitate management of their finances and product services.
The Consumer Data (Authorised Deposit-Taking Institutions) Designation 2019 (the principal Designation) designates the banking sector as subject to the CDR scheme. The Legislative Instrument makes a minor and technical amendment to the principal Designation to clarify the scope of the definition of product. The amendment will ensure that the definition of ‘product’ in the principal Designation extends to leases.
Human rights implications
The principal Designation, and by extension the Legislative Instrument, engage the right to protection from arbitrary or unlawful interference with privacy under Article 17 of the International Covenant on Civil and Political Rights (the ICCPR). The principal Designation creates the potential for a person to directly access personal information about themselves, or to direct another person or entity to disclose personal information about themselves to a third person or entity.
In order for an interference with the right to privacy to be permissible, the interference must be authorised by law, be for a reason consistent with the ICCPR and be reasonable in the particular circumstances. The UN Human Rights Committee has interpreted the requirement of ‘reasonableness’ in terms of proportionality and necessity: any interference with privacy must be proportional to the end sought and necessary in the relevant circumstances.
Under the CDR scheme, the disclosure of personal information is generally only permitted with the express consent of the individual concerned. The exception to this, set out in the Rules, relates to situations where seeking express consent from another account holder in relation to a joint account could cause physical, psychological or financial harm or abuse to a person.
The Act protects against arbitrary interference with privacy by establishing a set of CDR-specific privacy safeguards, modelled on the existing Australian Privacy Principles but with additional obligations. The CDR-specific privacy safeguards are the following:
• restrictions on the use, collection and disclosure of information received through the Rules, including information derived from that information (in general, the consumer’s express consent is required);
• requirements to have in place privacy policies that are easily accessible and clearly set out a complaints handling process;
• obligations on data holders and accredited data recipients to correct information;
• obligations on data holders and accredited data recipients to notify the consumer when information is disclosed;
• requirements to destroy information that is purportedly shared under the Rules but has been disclosed in error;
• strong powers for regulators, including the Office of the Australian Information Commissioner (OAIC);
• restrictions on direct marketing;
• remedies for breaches, including through external dispute resolution arrangements.
The OAIC advises on and enforces privacy protections and provides complaint handling for breaches of the privacy safeguards. Consumers have a range of avenues to seek remedies for breaches of their privacy or confidentiality including access to internal and external dispute resolution and direct rights of action.
The Act also creates an accreditation process that provides protection against arbitrary or unlawful interference with privacy. Only trusted and accredited third parties may access data from data holders at the customer’s direction. The ACCC is responsible for accrediting entities. The accreditation requirements, set out in the Rules, address matters such as:
• having systems, resources and procedures in place to enable an entity to comply with its CDR obligations, including in relation to the security of information; and
• having internal dispute resolution procedures in place and being a member of a recognised external dispute resolution body.
Conclusion
The Legislative Instrument is compatible with the relevant rights and freedoms. It is a component of the CDR scheme, which contains robust safeguards against arbitrary interference with privacy. To the extent that the CDR scheme limits the relevant rights and freedoms, those limitations are reasonable, proportionate and necessary.