5 critical things for the Consumer Data Right in 2023

We expect 2023 to be the CDR’s most significant year since its inception, with the hotly anticipated introduction of ‘write access’ functionality for the CDR and its rollout to key new sectors.

In this article, we have summarised our top 5 highlights for the year ahead.

1. Action initiation

Currently, the CDR only has ‘read access’ functionality for consumers to consent to their CDR data being shared with third parties. The Treasury Laws Amendment (Consumer Data Right) Bill 2022 (Action Initiation Bill), which is being considered by the Senate Economics Legislation Committee, will introduce the framework for adding ‘write access’ functionality (known as action initiation) to the CDR. Action initiation will complement the existing read access functionality of the CDR by allowing consumers to authorise actions to be initiated on their behalf, such as payments, moving funds to accounts with higher interest or lower fees, opening or closing accounts, switching providers or updating details across multiple accounts.

If the Action Initiation Bill is passed, it will be a critical pivot for the CDR regime and present significant new opportunities for participants. However, the passage of the legislation would only be the first step in the process of ‘turning on’ action initiation – each ‘action’ would still need to be declared by the Treasury, and the Competition and Consumer (Consumer Data Right) Rules 2020 (Rules) and data standards would also need to be updated. Participants in the CDR regime will also need to consider the technology and process changes required to implement action initiation effectively.

2. Open Finance

Open Finance will lead to a substantial increase in engagement with the CDR regime and the emergence of compelling use cases. Open Finance is a cluster of sectors that includes non-bank lending, general insurance, superannuation and merchant acquiring sectors. It is a logical extension of, and also complementary to, Open Banking, which is already live. It is not difficult to imagine how products and services may leverage datasets from these sectors to support consumers to manage their finances.

The first cab off the rank for Open Finance was non-bank lending. The Assistant Treasurer formally designated non-bank lending as a sector subject to the CDR on 21 November 2022, making it the fourth sector of the Australian economy to which the CDR will apply. This extends the CDR’s data holder obligations to corporations who are not authorised deposit-taking institutions but who provide finance as part of their business activities.

3. Telecommunications Rules

Telecommunications is the next sector in which the CDR will be rolled out after the energy sector. This year, the Rules to implement the CDR in the telecommunications sector (Telecommunications Rules) may be made, specifying how the CDR will be implemented in the sector.

After the designation of the telecommunications sector in January 2022, the Treasury published an exposure draft of an instrument to introduce the Telecommunications Rules in September 2022, providing a useful reference point for how the CDR will be implemented in the sector. The key points from the exposure draft are as follows:

• Only carriage service providers (CSPs) who provide public mobile telecommunications services and fixed internet services are required to share CDR data.
• Telstra, Optus and TPG will be the first CSPs to share CDR data, consistent with the banking and energy sectors, where the largest players were required to share CDR data first. The CDR regime will subsequently be extended to cover large CSPs with over 30,000 carriage services in operation per financial year.
• Data sharing obligations would only apply to information held on or after 1 January 2022.

The Treasury has not yet provided any timing for the commencement of data sharing and we will likely need to wait until the final Telecommunications Rules are made to see the phasing of these obligations.

4. Enhancements to the CDR regime

The CDR is an evolving regime and will be refined and improved over time. When publishing the exposure draft of the Telecommunications Rules, the Treasury also proposed the following enhancements:

• A new data sharing model that would allow business consumers to share CDR data with certain types of third parties outside of the CDR ecosystem, such as bookkeepers, consultants and other advisers and software providers.
• The extension of the maximum duration of data use consents given by consumers to the service providers referred to above, as well as trusted advisers and recipients of CDR insights, from 12 months to 7 years.
• In a win for banking innovation, an exemption for data holders in the banking sector from data sharing obligations for trials or pilots that run for up to 6 months with no more than 1,000 live customers.
• Revisions to the provisions of the Rules relating to CDR representative arrangements and CDR outsourcing arrangements.
• A grace period so that the reciprocal data holder obligations do not apply to accredited persons in the banking sector until 12 months after becoming accredited. A similar 12-month grace period is proposed to apply to small CSPs in the telecommunications sector who become accredited.

5. More active regulators

Recent enforcement action and public commentary demonstrate a marked shift from education to enforcement.

The ACCC and the OAIC, as dual regulators for the CDR, have historically taken an educational and monitoring approach to regulating the CDR regime, in view of the novelty and complexity of the regime. However, in late 2021, they communicated to CDR participants that they would shift to an enforcement phase and would be more likely to take enforcement action over administrative outcomes, where appropriate. Indeed, in 2022, the ACCC issued 5 infringement notices to 2 data holders in the banking sector.[1]

Given this shift to an enforcement phase, it is critical for participants in the CDR regime, and those soon to join it, to understand their obligations under the regime and to carefully monitor compliance on an ongoing basis.

Full steam ahead

The CDR regime has been expanding into new sectors and new functionalities and enhancements are being developed. The current agenda for 2023 suggests that this will not slow down, demonstrating the importance of an innovative, productive, integrated and competitive data ecosystem in the Government’s strategy for Australia’s emerging digital economy.

Adapted from KWM’s “Consumer Data Right in 2023”, published February 2023 by Cheng Lim, Max Allan, Daryl Cox, Jonathan Beh and Wesley Yu.