Rebooting the system – the Government announces its plans for the Consumer Data Right

Commonly, a data recipient will require multiple consents (eg, a collection consent, a use consent and a disclosure consent) to be able to provide a good or service to its customer that leverages CDR data.

The CDR Rules currently prohibit a data recipient from bundling those consents.

The proposed amendments will remove this restriction, meaning that data recipients will be able to streamline the consent giving process, where it is ‘reasonably needed’ for the provision of the requested good or service.  However, the ability to combine multiple CDR consents into a single action does not apply to direct marketing and de-identification consents, which must be requested separately.

Given that disclosure consents will be able to be combined with collection and use consents, the Treasury is also proposing to extend the data minimisation principle to the disclosure of CDR data (previously, the data minimisation principle only applied to the use and collection of CDR data).

What does this mean?

While the current prohibition on bundling is intended to enable consumers to review each specific collection, use or disclosure of CDR data before giving consent to the data recipient, this has become a point of friction in the consent process.  The ability to bundle consents would enable data recipients to develop a more streamlined process for onboarding customers and enhance the consumer experience by reducing the number of steps needed to be taken by the consumer before they can acquire a product.

The CDR Rules currently prohibit a data recipient from pre-selecting options when requesting a consent from a customer.  This has meant that data recipients are unable to propose a ‘default’ choice.

While the original intention was to enable consumers to have the ultimate say in how their CDR data will be collected, used and disclosed, it has led to criticism that the consent process is overly complex and unwieldy.

The Treasury has proposed to allow data recipients to pre-select options for:

• the dataset(s) that will be collected or disclosed;
• the specific uses for the data that has been collected;
• the duration of the consent; and
• the persons to whom CDR data may be disclosed,

provided they are ‘reasonably needed’ for the service to function.

If a data recipient has pre-selected options for a CDR consumer, they must give an explanation of why the pre-selected option is reasonably needed to provide the relevant goods or services.

Pre-selection will not be allowed for direct marketing and de-identification consents, given the consequences for the consumer’s CDR data (ie, being used for targeted advertising or being brought outside the scope of the CDR regime entirely).

The Treasury will also remove references in the CDR Rules to allowing the CDR consumer to ‘actively select’ options for their consent.  This reflects current industry practice, given that most entities prefer to ‘clearly indicate’ the various elements of the consent, rather than giving CDR consumers the ability to actively select their preferred options.

What does this mean?

The ability to pre-select options is another measure to streamline the consent process and reduce the cognitive load on consumers.  Data recipients will be able to put forward the options that they consider to be the most optimal for their products (having regard to the purpose of the product and the consumer experience) while allowing consumers to make changes should they wish to.

Under the proposed amendments, data recipients will no longer have to provide information on:

• how a consent can be withdrawn;
• what the consequences of withdrawing a consent are; and
• the data recipient’s proposed treatment of redundant data,

at the time they are asking for a consent from a customer.

However, data recipients would need to provide more detailed information about any CDR outsourcing or sponsorship arrangements that are relevant to the collection, use or disclosure of the customer’s CDR data.  This information broadly aligns with the information that a CDR representative must give to a customer about the CDR representative’s principal.

If the data recipient is seeking a direct marketing consent, they must also provide information about how the CDR data may be used or disclosed for the direct marketing activities.

What does this mean?

Research has shown that consumers consider the specific details of how to withdraw consent, and the consequences of withdrawal, are less critical at the time they are being asked to give consent (given they have already decided to give the consent(s) being requested).  Again, the intention of these amendments is to lower the barriers to adoption and reduce ‘information overload’ for consumers at the onboarding stage.

In addition to the above changes relating to the initial consent request process, the proposed amendments also:

• clarify that the periodic notification that must be sent to customers for each active consent can cover all active consents (so as to avoid a separate notification being sent for each active consent); and
• provide that a data recipient must delete redundant CDR data by default unless the CDR consumer has given a de-identification consent.

The detailed requirements for the periodic notification and the CDR receipt are also proposed to be moved from the CDR Rules to the data standards.  This would allow those requirements to be updated more regularly in response to consumer, behavioural or technological changes.

The CDR Rules require data holders to provide a service that can be used by customers who are not individuals (eg, bodies corporate or partnerships) to nominate an individual to give, amend and manage authorisations to disclose CDR data (a nominated representative) or to revoke or withdraw such a nomination.

Stakeholder feedback was given that some data holders have implemented unwieldy and cumbersome processes for nominating representatives (eg, processes that are paper-based or require the completion of multiple forms).

The proposed amendments now require that the nominated representative service must be:

• simple and straightforward to use; and
• prominently displayed and readily accessible to the customer.

Where a customer (who is not an individual) has already authorised a person to manage their account with a particular data holder online, then the nominated representative service must also be online.

To give data holders time to update their systems, these new requirements for nominated representatives will only come into force 12 months after the commencement of the proposed amendments to the CDR Rules.

What does this mean?

While the Government has identified accounting services to small businesses as a high-priority use case for the CDR, stakeholder feedback has been that data holders have made it difficult for businesses to access their own data.  The new nominated representative service requirements could reduce the barriers to adoption for businesses (most of whom would interact with the CDR through a nominated representative) and encourage a move to the CDR as the data-sharing platform of choice.

Under the current CDR Rules, an ADI who is accredited as a data recipient may request that a customer allow it to hold any collected CDR data as a data holder, rather than an accredited data recipient (ADR).  This would reduce the additional obligations imposed on the ADI as an ADR such as those arising under the CDR-specific privacy safeguards.  However, this request could only be made if the customer has already acquired a product from the ADI.

The proposed amendments expand the situations in which an ADI can request to hold collected CDR data as a data holder.  In particular:

• an ADI would be able to notify the customer, before the collection of CDR data in accordance with a collection consent, that it would hold the CDR data as a data holder rather than an ADR; and
• the notification could be given if the ADI is supplying a product to the customer, or if the customer has applied or is applying to acquire a product from the ADI.

This operational enhancement would allow ADIs to streamline the process for holding collected CDR data as data holders (by front-loading all consent requests at the time the ADI is seeking to collect the CDR data) and also clarify that this mechanism can apply before an ADI has started supplying a product to a customer.

The Treasury has, however, indicated that the new operational enhancements are not intended to apply where a consumer has contacted a bank to make preliminary inquiries, such as to compare existing product offerings or to seek quotes in relation to those products.

What does this mean?

One of the major pain points identified by industry is that data collected through the CDR regime is required to be treated differently from other data held by the data recipient, leading to increased costs and inefficiencies and limiting the usefulness of the CDR data that has been collected.  The ability for ADIs to hold collected CDR data as a data holder rather than as an ADR is intended to acknowledge that ADIs are already required to have stringent security measures in place for data they hold.

The existing ‘ADR-to-data holder’ mechanism in the CDR Rules requires ADIs to have first collected the CDR data, and thus have complied with the full range of functional and compliance requirements of the CDR regime, before requesting to hold the CDR data as a data holder.  This was not a practical approach.  The proposed amendments are intended to close this gap and enable ADIs to rely on this mechanism at the point at which it would be most useful (ie, when the customer is seeking to acquire a new product, rather than when the customer has already acquired a product from the ADI and the ADI is holding 2 separate sets of data – one for the CDR data that has been collected and one for the data that has been generated from the customer’s use of the product).

A CDR representative arrangement allows an unaccredited service provider (called a CDR representative) to engage an accredited person with unrestricted accreditation (called the CDR representative principal) to collect CDR data on its behalf, while the CDR representative maintains the customer relationship.  The CDR Rules require that the CDR representative arrangement must include certain obligations on the CDR representative, such as (by way of example):

• a requirement to comply with any rules in the CDR Rules that are expressed as applying to a CDR representative;
• a prohibition on entering into another CDR representative arrangement; and
• an obligation to comply with certain privacy safeguards as if it were the CDR representative principal,

(Required Provisions).

The proposed amendments clarify that CDR representative principals will be liable for a failure by their CDR representatives to comply with a Required Provision, even if the Required Provision has not actually been included in the CDR representative agreement.  This change is more in the nature of a clean-up, to close a loophole whereby a CDR representative principal would not be liable for a breach of a Required Provision unless that Required Provision was included in the CDR representative agreement.

CDR representative principals would also need to ensure that their CDR representatives comply with any consumer experience data standards that are expressed as applying to an ADR, as if the CDR representative were an ADR.  This is in addition to the current obligation on CDR representative principals to ensure that their CDR representatives comply with any rules in the CDR Rules that are expressed as applying to CDR representatives.

To give CDR representatives and CDR representative principals time to make the required adjustments to their CDR representative agreements and practices, these new requirements will only come into force 6 months after the commencement of the proposed amendments to the CDR Rules.

What does this mean?

The proposed amendments mean that CDR representative principals would need to ensure that their arrangements with CDR representatives are updated to include the new obligation on CDR representatives to comply with the consumer experience data standards that are expressed as applying to an ADR.  As part of this process, CDR representative principals are likely to require that their CDR representative arrangements are compliant with the requirements of the CDR Rules, including that they contain all of the Required Provisions (including those mentioned above).

The CDR contemplates that there may be people other than the account holder who use an account (eg, an additional cardholder on a credit or debit card account) who may wish to share CDR data from that account.  These persons are known as ‘secondary users’.

The proposed amendments provide that a data holder will no longer need to provide an online service that allows an account holder to ‘block’ the sharing of CDR data after a data sharing request has been made (although the account holder will still be able to instruct a data holder to cease treating a person as a secondary user for the account at any time).

What does this mean?

Stakeholder feedback indicated that the data sharing requirements for secondary users are unnecessarily difficult to implement and may not fully capture the complexities of data sharing structures.  The proposed amendments are intended to streamline the functionality that data holders need to provide to account holders who have nominated a secondary user, while also ensuring that account holders continue to be protected by being able to revoke the nomination of a secondary user at any time.

Under the Competition and Consumer (Consumer Data Right) Amendment Rules (No. 1) 2023 that commenced on 22 July 2023, products offered by data holders in the banking sector as a ‘pilot’ or ‘trial’ and that satisfy certain requirements are excluded from the CDR data sharing requirements while they are trial products.

The Treasury is now proposing to expand the exception to the energy sector.  In order to take advantage of this exception, data holders must ensure that a trial product:

• ends no more than 12 months after the initial offering;
• is supplied to no more than 1,000 customers; and
• is offered with a statement that the plan may be terminated before the end of the trial period and that, if it is, the CDR data in relation to the plan may not be available.

As with the exception for trial products in the banking sector, once a trial energy product ceases to meet those criteria (eg, because the plan continues to be supplied or offered after the end of the 12-month trial period or the product is supplied to more than 1,000 customers), the data holder must share CDR data relating to the trial product and otherwise comply with the requirements imposed on it under the CDR regime in relation to the product (including for CDR data generated during the trial).

What does this mean?

The extension of the exception for trial products to energy provides energy retailers with a degree of flexibility to innovate by testing new products before a larger rollout, without having to share product or consumer data about those products.  This may be a useful option as data holders who want to test a product before proceeding with it, such as through trials with employees or a small pool of customers.

However, data holders who wish to benefit from this exception should be diligent about adhering to the parameters for trial products.  Failure to do so may require the data holder to disclose CDR data from the trial.

The proposed amendments also:

• expand the definition of a ‘complex request’ to include consumer data requests made on behalf of a CDR consumer who has a nominated representative;
• introduce a 6-month grace period for a data holder who becomes a ‘larger retailer’ (ie it has 10,000 or more small customers at all times during a financial year) to comply with consumer data sharing obligations; and 
• provide that the grace period from compliance with the consumer data sharing obligations for a person who is both a small retailer and an accredited person, starts on the later of the date that the person became a small retailer and the date that the person became an accredited person (currently the CDR Rules provide that the grace period starts when the person became an accredited person).