Consumer Data Right | |
---|---|
![]() | |
Parliament of Australia | |
| |
Citation | No. 63 of 2019 |
Territorial extent | Australia |
Enacted by | House of Representatives |
Enacted | 30 Jul 2019 |
Passed by | Senate |
Passed | 1 Aug 2019 |
Assented to | 12 Aug 2019 |
Legislative history | |
First chamber: House of Representatives | |
Bill title | Treasury Laws Amendment (Consumer Data Right) Bill 2019 |
Introduced by | Josh Frydenberg |
First reading | 24 July 2019 |
Second reading | 24 Jul 2019 |
Third reading | 30 July 2019 |
Second chamber: Senate | |
First reading | 31 July 2019 |
Second reading | 31 July 2019 |
Third reading | 1 August 2019 |
Summary | |
Amends the Competition and Consumer Act 2010, Australian Information Commissioner Act 2010 and Privacy Act 1988 to create the Consumer Data Right to provide individuals and businesses with a right to access specified data in relation to them held by businesses. | |
Keywords | |
consumer data | |
Status: In force |
The Consumer Data Right is the name of a legislative, regulatory, and standards framework for consumer data portability in Australia. This framework has been created and introduced by the Australian Government, which is implementing the framework on a sector-by-sector basis. [1]
In May 2017, the Productivity Commission released a report 'Data Availability and Use' [2] that recommended, among other things, a new 'Comprehensive Right' for consumers. [3] [4] This proposed new right would allow consumers to access and correct data about themselves held by product or service providers. [3] It would also allow a consumer to have a machine-readable copy of their consumer data provided either to them or directly to a nominated third party, such as a new service provider. [4]
In November 2017, the Australian Government announced plans to legislate a national 'Consumer Data Right', which would allow customers open access to their banking, energy, phone and internet transactions data. [5] [6] [7]
In 2019, the Australian Parliament passed the 'Treasury Laws Amendment (Consumer Data Right) Bill 2019' to create the Consumer Data Right (CDR); [8] the bill inserted a new part (Part IVD - Consumer Data Right) into the Competition and Consumer Act 2010, [9] and amended the Australian Information Commissioner Act 2010 and Privacy Act 1988. [10]
The CDR legislation [11]
The CDR legislation establishes a framework to enable the CDR to be applied to various sectors of the economy over time. [12]
The CDR legislation gives the Minister (responsible for the CDR) powers to designate a sector for which the CDR will apply. [13] The Minister designates a sector through a legislative instrument. [13] In the instrument, the Minister designates a sector by specifying: [14]
The Minister, in the instrument, may also designate a ‘gateway’, or multiple ‘gateways’ to facilitate the transfer of data between a data holder and accredited data recipient or the consumer; [15] a gateway typically would be an Australian Government entity, or a body within the effective control of the Australian Government or an Australian state or territory government. [16]
The table below summarizes designations made so far:
Sector | Instrument | Date |
---|---|---|
Banking | F2019L01153 | 4 September 2019 |
Energy | F2020L00833 | 26 June 2020 |
Telecommunications | F2022L00068 | 24 January 2022 |
Non-bank lenders | F2022L01522 | 21 November 2022 |
The designation instrument itself does not impose data sharing obligations. [17] The requirement to disclose particular data emanates from the CDR rules, which provide the framework for how the CDR operates in a particular sector. [17]
The CDR rules are a legislative instrument made (by the Minister) under section 56BA of the Competition and Consumer Act 2010. [18] The rules cover all aspects of the CDR framework including: [18]
The rules are applied universally across all sectors of the economy to the extent possible. [17] The rules are being progressively updated as the CDR evolves and expands. [17] The current version of the rules are available from here.
How CDR participants (data holders, accredited data recipients and gateways) comply with the requirements of the CDR rules are set out in a set of technical specifications called 'Consumer Data Standards'.
The Consumer Data Standards are specifications for how information technology solutions must be implemented to ensure safe, efficient, convenient and interoperable systems to share data. [19] The data standards are binding if required by CDR rules; [20] however, the standards are not a legislative instrument, in themselves. [21]
The data standards are made by a Data Standards Chair (on the advice of a Data Standard Body). The Data Standards Chair, who is a person appointed by the Minister, makes the data standards in accordance with the sectoral designations and the CDR rules. [21]
The data standards must be published on the internet and be freely available; [20] the current data standards are available from here. To adapt to changing demands for functionality and available technology solutions, the data standards are living documents subject to continual change. [21]
The governance of the CDR framework is shared across:
The Minister, as well as having the power to designate sectors (for which the CDR will apply), has the power to make CDR rules; up until February 2021, the ACCC was the agency responsible for making CDR rules. [22]
The Australian Treasury, in addition to providing the Minister with policy advice regarding the CDR and its future directions, is also responsible for consulting for, and advising the Minister on sector designations, and developing the CDR rules; up until February 2021, these responsibilities were performed by the ACCC. [22]
The ACCC is responsible for regulation of the CDR framework, including compliance and enforcement of the rules and standards. It is also responsible for accreditation of CDR participants (holders, recipients, etc); [23] the ACCC, among other things, maintains a register of accredited CDR participants called the Consumer Data Right Register. [24] The ACCC can also grant exemptions from provisions of the CDR rules (as part of its enforcement responsibilities); it maintains a separate public register for granted exemptions. [25]
The role of the Data Standards Body is currently undertaken by the Australian Treasury; until February 2021, Data61 (CSIRO) performed the role of the Data Standards Body. [22]
The OAIC oversees matters relating to the protection of consumer privacy and confidentiality, and compliance with the CDR Privacy Safeguards. [19] The OAIC can also investigate a consumer complaint about how a CDR participant has handled the consumer's data; the OAIC may refer complaints to relevant external dispute resolution bodies or the ACCC. [26]
The Australian government has been implementing ('rolling out') the CDR on a sector-by-sector basis. The CDR was first implemented in the banking sector, following that sector's designation in September 2019; though, prior to the sector's designation, work on the CDR rules [27] and Consumer Data Standards for banking had already begun, [28] and major banks in Australia had already made selected data for their products publicly available. [29]
The foundational CDR rules commenced in February 2020, [30] and the CDR was formally launched in July 2020, [31] [32] when selected consumer data sharing obligations for four major Australian banks became mandatory. Other banks and bank data have been progressively included in a phased manner over the years since the CDR launch. [33] The majority of Australian banking consumers are now able to share their data through the CDR framework; [34] in the banking industry, this data sharing often goes under the moniker 'Open Banking'. [35]
In November 2021, the Minister amended the CDR rules to expand the CDR to the energy sector. [36] In October 2022, product-data sharing in the energy sector commenced under the CDR framework; in this context, products include electricity, gas and dual fuel plans. [37] In November 2022, [38] consumer-data sharing commenced for customer data held by the Australian Energy Market Operator (gateway), and selected energy retailers; consumer data relate to the sale or supply of electricity, including where electricity is bundled with gas. [37]
In January 2022, the Minister (responsible for the CDR) designated the telecommunications sector as the third CDR sector, following banking and energy. [39] In September 2022, Australian Treasury published draft changes to CDR rules to expand the CDR to the telecommunication sector. [40]
In December 2022, the Minister designated the non-bank lending sector; [41] Australian Treasury also released a design paper on CDR rules and data standards for non-bank lending sector. [42]
In September 2022, the Australian Government released [43] an independent statutory review [44] into the CDR framework, and its implementation over the past few years. [45]
The Review found [46] the CDR framework has been 'broadly effective' in the rollout of the CDR to date. [47] However, the Review heard [48] 'that participants in the CDR are still waiting for the scheme to deliver broad and tangible benefits to consumers, as well as to system participants – including data holders and data recipients'. And the Review noted [48] 'innovative product offerings are only starting to become available, meaning significant consumer benefits are yet to be realised'.
The Review heard [49] that the success of the CDR to date has been difficult to gauge due to the lack of visibility of public success measures for the CDR as a whole. The Review noted the CDR website (at the time of the review) offers some performance metrics and noted [50] that 'significant effort' is underway within CDR agencies to expand these measures, but it argued [50] that these metrics 'could be improved with additional data relevant to the growth of the ecosystem',
The Review heard [51] that many businesses 'have continued to use screen scraping despite the possibility of receiving data through the CDR'. Review submissions cited [51] the 'ease and lower cost' of screen scraping and inconsistent CDR data quality [52] as reasons for the continued use of screen scraping. The Review argued [53] that data quality must improve to provide a viable alternative to screen scraping and recommended [54] that screen scraping be banned in the near future in sectors where the CDR data provides a viable alternative. [55]
The Review noted [56] that whilst direct‐to‐consumer data sharing is a key part of the CDR, the CDR rules do not currently oblige the sharing of data directly to consumers. The Review heard [57] that direct‐to‐consumer data sharing could increase risks (of fraud and to privacy), without significant benefits to consumers. While the Review recognises [58] 'the potential self‐interest inherent in the cohort of data holders and recipients advocating for restricting direct‐to‐consumer data access', it agreed [58] that the framework may require further consideration if direct‐to‐consumer data sharing is to be enabled.
The Review, which was released after the 2022 Opus cyber hacks, stated [59] that it generally did not hear many concerns from stakeholders about the cyber security settings of the CDR. [45] Nonetheless, the Review recommended [60] that the Government should consider undertaking a whole of ecosystem cyber security assessment. [61]
The Australian Government is proposing to extend the CDR legislation to enable a consumer (through an accredited third party) to initiate an action with a (designated) business. [62] The types of 'actions' could include: [63]
In December 2022, the Australian Government introduced into parliament legislation that would extend the functionality of the Consumer Data Right (CDR) to "enable Australian consumers and small business to safely and conveniently instruct accredited third parties to initiate CDR‑powered actions with their consent and on their behalf." [64]
The Australian Competition and Consumer Commission (ACCC) is the chief competition regulator of the Government of Australia, located within the Department of the Treasury. It was established in 1995 with the amalgamation of the Australian Trade Practices Commission and the Prices Surveillance Authority to administer the Trade Practices Act 1974, which was renamed the Competition and Consumer Act 2010 on 1 January 2011. The ACCC's mandate is to protect consumer rights and business rights and obligations, to perform industry regulation and price monitoring, and to prevent illegal anti-competitive behaviour.
The Australian Prudential Regulation Authority (APRA) is a statutory authority of the Australian Government and the prudential regulator of the Australian financial services industry. APRA was established on 1 July 1998 in response to the recommendations of the Wallis Inquiry. APRA's authority and scope is determined pursuant to the Australian Prudential Regulation Authority Act, 1998 (Cth).
The Treasurerof Australia, also known as the FederalTreasurer or more simply the Treasurer, is the minister of state of the Commonwealth of Australia charged with overseeing government revenue collection, federal expenditure and economic policy as the head of the Department of the Treasury. The current treasurer is Jim Chalmers, who was selected by Prime Minister Anthony Albanese in May 2022 following the 2022 Australian federal election.
Banking in Australia is dominated by four major banks: Commonwealth Bank, Westpac, Australia & New Zealand Banking Group and National Australia Bank. There are several smaller banks with a presence throughout the country which includes Bendigo and Adelaide Bank, Suncorp Bank, and a large number of other financial institutions, such as credit unions, building societies and mutual banks, which provide limited banking-type services and are described as authorised deposit-taking institutions (ADIs). Many large foreign banks have a presence, but few have a retail banking presence. The central bank is the Reserve Bank of Australia (RBA). The Australian government’s Financial Claims Scheme guarantees deposits up to $250,000 per account-holder per ADI in the event of the ADI failing.
In general, compliance means conforming to a rule, such as a specification, policy, standard or law. Compliance has traditionally been explained by reference to deterrence theory, according to which punishing a behavior will decrease the violations both by the wrongdoer and by others. This view has been supported by economic theory, which has framed punishment in terms of costs and has explained compliance in terms of a cost-benefit equilibrium. However, psychological research on motivation provides an alternative view: granting rewards or imposing fines for a certain behavior is a form of extrinsic motivation that weakens intrinsic motivation and ultimately undermines compliance.
The Competition and Consumer Act 2010 (CCA) is an Act of the Parliament of Australia. Prior to 1 January 2011, it was known as the Trade Practices Act 1974 (TPA). The Act is the legislative vehicle for competition law in Australia, and seeks to promote competition, fair trading as well as providing protection for consumers. It is administered by the Australian Competition & Consumer Commission (ACCC) and also gives some rights for private action. Schedule 2 of the CCA sets out the Australian Consumer Law (ACL). The Federal Court of Australia has the jurisdiction to determine private and public complaints made in regard to contraventions of the Act.
The Cabcharge account payment system was established in 1976 to provide taxi passengers a way to pay for taxi fares by non-cash means. The payment system is owned and operated by A2B Australia, part of ComfortDelGro. In the UK and Singapore, Cabcharge is operated by other subsidiaries of ComfortDelGro.
The Transport Legislation Review is a policy and legislation review project conducted by the Department of Transport in the State of Victoria, Australia between 2004 and late 2010. The aim of the project was review of transport policy and laws and generation of new policy and legislation as a platform for better transport across the State.
The Australian Consumer Law (ACL), being Schedule 2 to the Competition and Consumer Act 2010, is uniform legislation for consumer protection, applying as a law of the Commonwealth of Australia and is incorporated into the law of each of Australia's states and territories. The law commenced on 1 January 2011, replacing 20 different consumer laws across the Commonwealth and the states and territories, although certain other Acts continue to be in force.
Financial regulation in Australia is extensive and detailed.
Rodney Graham Sims is an Australian economist and former public servant. Sims served as chair of the Australian Competition & Consumer Commission (ACCC), Australia's competition regulator, from 1 August 2011 to 20 March 2022.
The Treasury of New South Wales, branded NSW Treasury, a department of the New South Wales Government, is responsible for state financial management policy and reporting, and providing advice to the government on economic conditions and issues in New South Wales, Australia. NSW Treasury was established in April 1824 and is the oldest continuing government agency in Australia.
In financial services, open banking allows for financial data to be shared between banks and third-party service providers through the use of application programming interfaces (APIs). Traditionally, banks have kept customer financial data within their own closed systems. Open banking allows customers to share their financial information securely and electronically with other banks or other authorized financial organizations such as payment providers, lenders and insurance companies.
The Consumer Council is an independent statutory authority in Hong Kong, established in 1974 and formalised in April 1977 under the Consumer Council Ordinance. Its role is to enhance consumer welfare and empower consumers to protect themselves. Over the course of the past four decades the expansion in the council's duties and services on consumer protection, such as the publishing of the CHOICE Magazine in 1976, the recent launch of online price-watching tools, and conducting studies on different aspects of the consumer market, have coincided with the socio-economic development of Hong Kong. Apart from being a consumer advisor, it has assumed the role as a key stakeholder in making of consumer-related policies.
In Australia, it is a mandatory requirement for registered healthcare practitioners to hold appropriate medical indemnity insurance coverage for healthcare practices in Australia. Medical indemnity is a form of professional indemnity coverage defined by Australian legislation – the Medical Indemnity Act 2003 and is a type of general insurance. In the United Kingdom, this type of professional indemnity for healthcare practitioners is generally referred to as ‘professional indemnity’ and in the United States, medical negligence insurance. In Australia, the term medical indemnity can be used to refer to all healthcare indemnity, not just that provided for medical doctors. However, there are only six Australian Health Practitioner Regulation Authority (AHPRA) listed insurers that provide medical indemnity insurance cover to medical practitioners. Australian medical practitioner medical indemnity providers include:
The Telecommunications (Interception and Access) Amendment (Data Retention) Act 2015(Cth) is an Act of the Parliament of Australia that amends the Telecommunications (Interception and Access) Act 1979 (original Act) and the Telecommunications Act 1997 to introduce a statutory obligation for Australian telecommunication service providers (TSPs) to retain, for a period of two years, particular types of telecommunications data (metadata) and introduces certain reforms to the regimes applying to the access of stored communications and telecommunications data under the original Act.
Regional Australia Bank is a member owned bank with roots in regional New South Wales and head office located in Armidale, Australia.
This article contains a list of primary and secondary legislation enacted by the Parliament of the United Kingdom, the Scottish Parliament, the Senedd and the Northern Ireland Assembly in connection with the COVID-19 pandemic.
The National Competition Council (NCC) is a research and advisory body, legislated by Part IIA of the Competition and Consumer Act 2010.
Open Finance is the concept and practice of sharing financial data securely with third-party service providers through Application Programming Interfaces (APIs). It builds upon open banking principles, aiming to broaden access to financial data beyond traditional banking products and services. This initiative emphasises consumer control over financial data, allowing secure sharing to obtain personalized services, better deals, and innovative financial solutions.
{{cite journal}}
: Cite journal requires |journal=
(help)