EXPLANATORY STATEMENT
Issued by authority of the Minister for Superannuation, Financial Services and the Digital Economy
Competition and Consumer Act 2010
Consumer Data Right (Telecommunications Sector) Designation 2022
The purpose of the Consumer Data Right (Telecommunications Sector) Designation 2022 (the Designation) is to designate the telecommunications sector as subject to the consumer data right.
Subsection 56AC(2) of the Competition and Consumer Act 2010 (the Act) provides that the Minister may, by legislative instrument, designate a sector of the Australian economy to be subject to the consumer data right. The consumer data right is set out in Part IVD of the Act.
The consumer data right provides individuals and businesses with a right to efficiently and conveniently access specified data that relates to them held by businesses, and to authorise secure access to this data by accredited third parties. The consumer data right also requires businesses to provide public access to information on specified products that they offer.
The consumer data right is designed to give customers more control over their information leading, for example, to more choice in where they take their business, or more convenience in managing their telecommunications usage and services.
The sectors of the Australian economy that are covered by the consumer data right and the type of information consumers can request are limited to those specified in designations made by the Minister.
Telecommunications is the third sector of the Australian economy to which the consumer data right will be applied, following the previous designations of the banking and energy sectors.
The Designation sets out, in relation to the telecommunications sector, the classes of information that are subject to the consumer data right regime, the persons who hold this information and will be required or authorised to transfer the information under the regime, and the earliest date that the information being held is subject to the consumer data right.
This information will be CDR data (see section 56AI of the Act). Data holders may be required to disclose CDR data in accordance with the consumer data rules. The rules may also authorise data holders to choose to share this data through the consumer data right.
The classes of information specified by the Designation are customer-provided data, billing and account information, and information about retail telecommunications products.
The Designation does not specify any information as being subject to fees for access or use for the purposes of paragraph 56AC(2)(d) of the Act.
The Government conducted public consultation on a draft of the Designation from 23 November 2021 to 13 December 2021. Nine submissions were received, and stakeholder feedback was considered as part of the development and finalisation of the Designation. In particular:
• the ‘earliest holding day’ has been changed from 1 July 2020 to 1 January 2022, in recognition of concerns about the cost and practicality of sharing past data where it is routinely archived in back-end systems
• information about participation in hardship programs is no longer excluded from the Designation, noting potential use cases identified during consultation
• noting ambiguity in the drafting, exclusions for location information and content of communications have been refined to ensure that these categories of information apply with the intended breadth and are not included in the consumer data right.
Subsection 56AD(1) of the Act obliges the Minister to consider a range of factors when exercising the power to make a designation instrument. These factors include the effect of the instrument on the interests of consumers, the efficiency of the telecommunications markets, the privacy of consumer data, the promotion of competition and the public interest. The Minister has considered each of the factors required by the legislation when making this Designation.
Subsection 56AD(2) of the Act requires the Minister to be satisfied that the Secretary of the Department of the Treasury has arranged for analysis, consultation and a report in relation to the making of the instrument, and to wait at least 60 days after publication of that report. The Minister has complied with these requirements. Treasury released the telecommunications sectoral assessment consultation paper for consultation from 22 July 2021 to 19 August 2021, and published the final report on 23 November 2021.
Subsection 56AD(3) of the Act requires the Minister to consult the Information Commissioner about the likely effect of making the instrument on the privacy or confidentiality of consumers’ information. The Minister has complied with this requirement, including by considering the Information Commissioner’s report on the draft Designation, published on 23 December 2021.
Details of the Designation are set out in Attachment A.
A Statement of Compatibility with Human Rights is at Attachment B.
Treasury has certified the telecommunications sectoral assessment consultation paper and final report as a process and analysis equivalent to a Regulation Impact Statement. These documents can be accessed via the Treasury website.[1] The average annual regulatory costs were estimated at between $9.6 million and $18 million (OBPR ID 21-01080).
The Designation is a legislative instrument for the purposes of the Legislation Act 2003.
The Designation commences on the day after it is registered on the Federal Register of Legislation.
ATTACHMENT A
Details of the Consumer Data Right (Telecommunications Sector) Designation 2022
Section 1 – Name of the Regulations
This section provides that the name of the instrument is the Consumer Data Right (Telecommunications Sector) Designation 2022 (the Designation).
Section 2 – Commencement
The Designation commences on the day after it is registered on the Federal Register of Legislation.
Section 3 – Authority
The Designation is made under subsection 56AC(2) of the Competition and Consumer Act 2010 (the Act).
Section 4 – Definitions
The Designation contains a number of definitions. These include:
Act means the Competition and Consumer Act 2010.
Associate has the same meaning as in section 318 of the Income Tax Assessment Act 1936. This includes an individual’s relatives such as spouse, children or siblings, or a company’s parents or subsidiaries. This definition of associate is also used in the definition of CDR consumer in section 56AI of the Act. The expression associate is used in the designation so that, where a product is supplied to multiple persons, information about each of those persons and their use of the product is captured by the designation. This may occur where the product has more than one account holder, or where the primary account holder has given access to other persons such as a relative or spouse.
Carriage service has the same meaning as in the Telecommunications Act 1997.
Carrier and carriage service provider both have the same meaning as in the Telecommunications Act 1997. In summary, carriers hold a carrier licence granted under that Act and own network units that deliver carriage services. Carriage service providers include organisations that resell time on a carrier network for phone calls, provide access to the internet and provide phone services over the internet.
Communication has the same meaning as in the Telecommunications Act 1997.
Offer means an offer for a retail supply.
Product means a carriage service, or a good or a service that is offered or supplied in connection with supplying a carriage service.
Supply is defined in subsection 4(1) and section 4C of the Act but is also limited by section 4 of this Designation to mean a retail supply. Paragraph 4C(b) of the Act provides that a reference to the supply of goods or services includes a reference to agreeing to supply goods or services – this is consistent with the intention of this Designation to capture pre-paid mobile services.
The references to ‘retail’ in the Designation have their plain meaning, with the Designation intending to capture the supply of a product to someone for their use, whether an individual or business customer (as opposed to supply for resale).
The Designation is also intended to capture ‘white-labelled’ products. These are products typically created by one entity (a white-labeller) and branded and retailed to consumers by another entity (a brand owner).
The references to ‘entity’ in the Designation have their plain meaning, rather than, for example, their taxation law meaning.
Section 5 – Designation of sector subject to the consumer data right
This section sets out:
• the classes of information that are prescribed and therefore subject to the consumer data right (information set out in sections 6 to 8)
• that carriers and carriage service providers are the data holders for the classes of information that are prescribed
• that the earliest date that the classes of information that are held by a data holder under the Designation can become subject to the consumer data right is 1 January 2022.
Previously obtained information held by data holders on 1 January 2022 may be subject to the consumer data right where of continuing use and relevance (such as an account number that is still current).
A note also confirms that no fees can be charged for information accessed under this Designation.
Specified classes of information
Section 6 – information about retail customers and users
The Designation specifies, as information that is subject to the consumer data right, information provided by a customer or an associate or obtained by the data holder in connection with the carriage service being provided.
The information must have been either provided directly by the person or their associate when acquiring or using a product (for example, the person’s name and address) or otherwise obtained by or on behalf of the carrier or carriage service provider (or the entity that holds information on the carrier or carriage service provider’s behalf).
Section 7 – information about retail supplies
The Designation specifies billing and account information about retail supplies of products as information that is subject to the consumer data right.
Section 7 is intended to cover information that customers typically already have available to them, whether on a bill or general account information (which might be accessible by logging in online or via a mobile application). While some information is described broadly as ‘billing information’, these elements of section 7 apply regardless of whether the information appears on every customer’s bill.
Section 7 limits the scope of billing and account information to the following categories:
• information about accounts in relation to which bills for the supply are sent
• information about bills issued in relation to the supply
• information about arrangements for payments to be made in connection with the supply
• information about payments in connection with the supply
• information about concessions or rebates provided in connection with the supply
• other information about such supplies that is used for the purposes of billing
• how long until a contract relating to a particular product is due to end.
These categories are intended to include the following information typically included on a customer’s bill for a phone or internet service:
• account number
• invoice number
• billing period
• date of issue of the bill
• customer’s mobile number
• previous balance
• current balance (total payable)
• due date
• date of direct debit
• payment details to make a debit, online payment, BPAY details
• summary of customer’s communications (no. of calls and total time, no. of messages, data used)
• details about phone handset payments due
• detailed usage data (date, time, type of call, duration, cost)
• messages summary (type of message (picture or text), number sent, cost)
• data summary (date, type, usage, cost)
• details of previous payments (e.g. receipt number)
• additional fees and charges
• name of plan the customer is on.
The content of communications, location data, mobile tower information, broadband speed information and National Broadband Network connection information are not designated.
Subsections 7(2) and (3) carve out any materially enhanced information otherwise captured by section 7.
The concept of materially enhanced information refers to data which is the result of the application of insight, analysis or transformation of data to significantly enhance its useability and value in comparison to its source material. For the purposes of this test, source material is information to which section 7 applies. This means that while materially enhanced information may have been derived either entirely from information to which section 7 applies, or from a combination of information covered by section 7 and other information, the test only requires the enhanced information to be significantly more valuable than the section 7 inputs.
The intention is that information whose value has been largely generated by the actions of the data holder will be carved out by the ‘materially enhanced’ test.
Examples of materially enhanced data include:
• any material analysis of a customer’s credit worthiness
• any material analysis of a customer’s preferences or propensity to take up a product
Examples of non-materially enhanced data include:
• totals for usage of a telecommunications product (for example, monthly or quarterly)
• a calculated account balance
• a calculated fee to be charged
While materially enhanced information is excluded from the class of information to which section 7 applies, such information may nonetheless be CDR data due to paragraph 56AI(1)(b) of the Act, which captures information that is wholly or partly derived from information that falls within a class of information specified in this Designation. This means that:
• the consumer data right applies to materially enhanced information, and
• while data holders are not required to disclose materially enhanced information under the consumer data right, customers can still authorise data holders to disclose this information through the consumer data right, where this is authorised under the consumer data rules and a data holder chooses to make it available.
Subsection 9(2) also provides for information that is not materially enhanced. Information is not materially enhanced where it was derived in order to meet a regulatory requirement. Additionally, information that has been materially enhanced and would be excluded from section 9 but otherwise fits within the definitions of section 6 or 8 is not excluded from either of those sections by virtue of being materially enhanced information.
An example of this could be where insight or analysis was derived about a customer’s use of an existing carriage service and the provider offered a modified service to the customer (under paragraph 8(3)(b)). Even though the modified product was made through the use of materially enhanced section 7 data, it would still form designated data under section 8.
Section 8 – information about products
The Designation specifies information about products that are or have been offered or supplied by carriage service providers or carriers as subject to the consumer data right.
Section 8 is written to broadly include information that identifies or describes products, and the terms and conditions of those products. The list is non-exhaustive and written to cover – amongst other things – information that would generally be included in a Critical Information Summary (as required of carriage service providers under the Telecommunications Consumer Protections Code) or a Key Fact Sheet (as required for NBN products by the Telecommunications (NBN Consumer Information) Industry Standard 2018).
Subsection 8(3) includes offers or supplies that are offered to particular persons or entities, or classes of persons or entities. This ensures that where bespoke or custom services are offered, this information is still captured under the consumer data right. This may be relevant where, for example, a customer is using a legacy product that is no longer being offered to the general public, or where a customer has negotiated a price specific to them.
Paragraph 8(2)(f) specifies information about bundling arrangements. Data holders will only be required to share data in relation to telecommunications products that are specified in consumer data rules. The designation of information about bundling arrangements is not intended to facilitate data sharing in relation to other products that are bundled with the telecommunications products specified in the rules, beyond the fact of their inclusion in a bundle. Only descriptive information about the other product sufficient to enable its identification in the bundle would be intended to be shared.
Paragraph 8(2)(g) specifies information about services that are available for customers who require additional assistance, such as customers with disability or customers facing hardship. During public consultation, stakeholders raised potential use cases for sharing of assistance programs to assist customers with specific needs. As such a former hardship exclusion has been removed from the designation instrument, and consequently, hardship services and their use may in different circumstances be covered by paragraph 8(2)(c), paragraph 8(2)(g) or paragraph 8(3)(b).
An example of a service that may be available for customers who require additional assistance (under paragraph 8(2)(g)) is priority assistance. Priority assistance is regulated by Part 6 of Schedule 2 to the Telecommunications Act 1997, the Priority Assistance for Life Threatening Medical Conditions industry code and the Telecommunications (Carrier Licence Conditions – Telstra Corporation Limited) Declaration 2019.
Expiry dates relating to pre-paid mobile services are an example of product data intended to be captured by section 8.
Section 9 – Exclusions
Subsection 9(1) excludes location data from the Designation. This exclusion extends beyond a telecommunications customer to any third parties receiving communications from the customer. ‘Mobile’ in this context refers to use of a product other than in a fixed location, rather than necessarily referring to mobile phone services.
This provision is intended to exclude information often shown on customers’ bills that shows, for example, the suburb where they made or received a mobile call. An exclusion is not appropriate for the location where the customer made a landline call, their address already being captured as customer data under section 6.
Subsection 9(2) excludes information that would reveal the contents or substance of a communication. The provision carves back in necessary information related to supplies of a product, to ensure that, for example, billing information sent to a customer is not excluded by virtue of constituting the contents of a communication.
ATTACHMENT B
Statement of Compatibility with Human Rights
Prepared in accordance with Part 3 of the Human Rights (Parliamentary Scrutiny) Act 2011
Consumer Data Right (Telecommunications Sector) Designation 2022
This Legislative Instrument is compatible with the human rights and freedoms recognised or declared in the international instruments listed in section 3 of the Human Rights (Parliamentary Scrutiny) Act 2011.
Overview of the Legislative Instrument
The Treasury Laws Amendment (Consumer Data Right) Act 2019 amended the Competition and Consumer Act 2010 to establish a consumer data right.
The consumer data right provides individuals and businesses with a right to efficiently and conveniently access specified data that relates to them held by businesses, and to authorise secure access to this data by accredited third parties. The consumer data right also requires businesses to provide public access to information on specified products that they offer.
The consumer data right is designed to give customers more control over their information leading, for example to more choice in where they take their business, or more convenience in managing their telecommunication services.
Subsection 56AC(2) of the Act provides that the Minister may designate a sector of the Australian economy as being subject to the consumer data right by making a legislative instrument.
The sectors of the Australian economy that are covered by the consumer data right and the type of information consumers can request are limited to those specified in designations that will be made by the Minister.
Telecommunications is the third sector of the Australian economy to which the consumer data right will be applied.
The Designation sets out the classes of information that are subject to the consumer data right regime, the persons who hold this information and will be required or authorised to transfer the information under the regime, and the earliest date that the information being held is subject to the consumer data right.
Human rights implications
The Designation engages the right to protection from arbitrary or unlawful interference with privacy under Article 17 of the International Covenant on Civil and Political Rights (ICCPR) because it enables, in the context of the telecommunication sector, a person to directly access or to direct another person or entity to transfer personal information about themselves to another person or entity.
In order for an interference with the right to privacy to be permissible, the interference must be authorised by law, be for a reason consistent with the ICCPR and be reasonable in the particular circumstances. The UN Human Rights Committee has interpreted the requirement of ‘reasonableness’ to imply that any interference with privacy must be proportional to the end sought and be necessary in the circumstances of any given case.
The consumer data right is a right for consumers to authorise data sharing and use. The consumer data right will provide individuals and businesses with a right to access data relating to them; and to authorise secure access to their data by persons who have been approved to receive the data, known as ‘accredited data recipients’.
Underpinning the consumer data right is a requirement that the disclosure between entities of personal information is generally only permitted with the express consent of the individual to whom the information relates. The consumer data right does not generally allow businesses who hold or receive data relating to a customer to transfer or use the data without the customer’s consent.
It is intended that the consumer data right in the telecommunication sector, by giving consumers improved access to data, will support better comparison services by taking into account Australians’ actual circumstances and promoting more convenient switching between carriage service providers and their products.
The Competition and Consumer Act 2010 protects against arbitrary interference with privacy by establishing a set of consumer data right specific privacy safeguards, modelled off the existing Australian Privacy Principles (APPs) but with additional obligations. The privacy safeguards included in the consumer data right are:
• restrictions on the use, collection and disclosure of information received through the consumer data rules, including information derived from this information, generally in circumstances where the consumer has given express consent;
• requirements to have privacy policies in place which are easily accessible and clearly explain the complaints handling process;
• obligations on data holders and accredited data recipients to correct information;
• obligations on data holders and accredited data recipients to notify the consumer when information is disclosed;
• requirements to destroy information that is purported to have been shared under the consumer data rules but has been disclosed in error;
• strong powers for regulators, including the Office of the Australian Information Commissioner (OAIC);
• restrictions on direct marketing; and
• remedies for breaches, including through external dispute resolution arrangements.
The Competition and Consumer Act 2010 also established an accreditation process that provides protection against arbitrary or unlawful interference with privacy. Only trusted and accredited third parties are able to access data from data holders at the customer’s direction. The requirements that need to be met in the telecommunications sector will be set out in the consumer data rules, and will address matters such as:
• having systems, resources and procedures in place which enable the entity to comply with their consumer data right obligations including the security of information; and
• having internal dispute resolution procedures in place and being a member of a recognised external dispute resolution body.
Compared to the banking and energy sectors, the telecommunication sector presents an additional privacy risk concerning information about the content of communications or the location from which communications are made or received. Consequentially, the designation instrument has been drafted to specifically limit the amount of data that can be captured by the consumer data right and to specifically exclude both location and content of communications.
These limitations are consistent with the prohibition on arbitrary interference with privacy as they are directed at legitimate objectives and are reasonable and proportionate to those objectives.
Conclusion
This Legislative Instrument is compatible with human rights because to the extent that it may limit human rights, those limitations are reasonable, necessary and proportionate.
[1] https://treasury.gov.au/publication/p2021-225262