This article was written by Roslyn Hinchliffe.
The legal framework is now in place for the start of the Consumer Data Right (CDR) in the banking sector. The timeframes for responding to requests for consumer data have been mandated, starting from 1 July this year for the four major Australian banks. Non-major banks have an opportunity to respond to a consultation about their start dates for CDR. The clock is ticking for businesses connected with the banking sector to consider what new products and services could be made available to coincide with the launch of this new competitive landscape.
The Competition and Consumer (Consumer Data Right) Rules 2020 (finalised CDR Rules) has now been approved by the Australian Treasurer and has come into effect. This follows the release by the Australian Competition and Consumer Commission (ACCC) of draft Rules in March and September last year.
The CDR creates a new data economy in Australia. It is designed to give customers more access to, and control over, their information, leading to more choice in their banking and more convenience in managing their money, and resulting in more confidence in the use of their data and their access to the value of this important asset. Banking is the first sector of the Australian economy to which this right is to be applied and Open Banking is the way that this is to happen. Other sectors of the economy are to follow (and energy and telecommunications are expected to be next). Open Banking needs to work together with them to form a single broader data framework. For more background on the CDR journey to date in Australia, please refer to our earlier alerts such as this, this and this.
The finalised CDR Rules are a key part of the regulatory structure for CDR in Australia. The legal framework for the CDR is established in Part IVD of the Competition and Consumer Act 2010. This framework was passed into law in August last year and sets out the legal foundations for and overarching objectives of the CDR. The law provides for the Australian Treasurer to designate sectors of the Australian economy that are to be subject to the CDR (and the banking sector is designated under the Consumer Data Right (Authorised Deposit-Taking Institutions) Designation 2019). The law also provides for Rules to be made (setting out the requirements and outcomes of the CDR) and Standards to be set (setting out the technical method of data transfer and related elements under the CDR).
The finalised CDR Rules contain a set of refinements to the draft version of rules that were released in lock-down mode in September. It will be important for participants in CDR to ensure they are across the relevant detail. However, the most significant aspect of the finalised CDR Rules is that they mandate the timetable for the participation of Australian banks in the CDR.
When does CDR commence?
Since the legal framework was established last year, testing of various aspects of the CDR ecosystem has been conducted and is continuing in the lead up to the launch of CDR. A selection of entities proposing to obtain accreditation to offer a range of innovative services have been participating in the pre-launch testing program. The four major Australian banks have been voluntarily sharing generic product information – for example, terms and conditions, interest rates, fees and charges, and eligibility criteria in a standardised format.
Now, the CDR is to formally commence under the finalised CDR Rules. From 1 July, the four major Australian banks will be obliged to respond to a request by an authorised third party on behalf of a consumer (and only on the consumer’s request) to disclose data about the consumer, their various accounts and transactions on such accounts to that third party. The finalised CDR Rules require other Australian banks to respond to requests regarding accounts from 1 February 2021. The staggered start dates for the Australian banks reflect an incremental scale-up approach by reference to the size of the bank as well as by product and data types. The timeline set out below reflects the latest dates in the finalised CDR Rules on which the regime will apply to Australian banks.
The timeline is subject to change in respect of the non-major Australian banks. The ACCC is currently consulting on the start dates that apply for non-major Australian banks. The ACCC seeks feedback on the feasibility of a revised start date of 1 July 2021 for all products. More on this consultation can be found here.
As noted in this Alert, King & Wood Mallesons partner Scott Farrell has been appointed by the Australian Government to lead an inquiry into the future direction of the CDR. This Alert is not connected with that role.