Revised Consumer Data Right rules expand consent and give business partners access
Australia's Consumer Data Right (CDR), officially launched on July 1 with the first tranche, an open banking-like regime, requires financial services providers to share a customers' data when requested by the customer.
From November 1, new data became available for sharing, including account types such as home loans, investment loans, personal loans, and mortgage offset accounts, as well as joint accounts. New datasets also included direct debits, account payees, and scheduled payments.
Next on the list will be data sharing for business customers, which is set to commence next year.
Read more: Australia's Consumer Data Right: Here's everything you need to know
After countless parliamentary probes, submissions, industry testimony, and consultations, the rules wrapping the CDR were finalised by the Australian Competition and Consumer Commission (ACCC) and came into effect on 6 February 2020.
This week, amendments to the rules were published.
The rules as amended allow accredited data recipients (ADRs) to offer to their CDR consumers the ability to amend an existing consent. This includes the ability to add or remove uses, data types, accounts or data holders, or to amend the duration of the consent. It also provides for separate consent types, including consents for collection, use, disclosure, direct marketing, and research. This means that consumers can give more than one type of consent, and can independently withdraw or amend each type of consent.
The amended rules also permit accredited persons, with the consumer's consent, to collect CDR data from, and disclose CDR data to, other accredited persons who are also providing goods or services to the consumer.
ADRs were also previously restricted from using CDR data for purposes beyond what was reasonably needed to provide the requested goods or services. The changes now authorise an ADR that seeks to collect and use CDR data for providing a good or service to the consumer, to also seek the consumer's consent to de-identify some or all of the data to be used for general research purposes.
The amendments also broaden the scope of consumers who may share CDR data.
Prior to these amendments, sharing of CDR data was limited to account holders that were individuals, including sole traders, over the age of 18, from accounts held singly or jointly with one other individual.
The amended rules additionally enable CDR data to be shared by non-individuals, in the context of business partnerships, and by secondary users.
"This significant package of amendments is designed to encourage participation in the Consumer Data Right by expanding its benefits to more businesses, including companies and partnerships," ACCC Commissioner Sarah Court said.
"The new rules lay the foundation for the continued expansion of the Consumer Data Right in 2021, following the successful start of consumer data sharing in 2020.
"The rules will encourage increased participation in the Consumer Data Right, and new service offerings for consumers, while also ensuring that strong consumer protections continue to apply."
Further amendments include record-keeping requirement clarifications, types of general information provided to consumers, and further powers for the Accreditation Registrar.
RELATED COVERAGE
- New rules opening up Consumer Data Right accreditation tiers due by the end of 2020
- Australia's Consumer Data Right now updated to include intermediaries
- ANZ asks for third party Consumer Data Right access
- NAB asks to not be disadvantaged in opening CDR up to new players
- The Consumer Data Right from Westpac's perspective
- Sweeping change: Fintech committee offers 'quick wins' fix to Australian ecosystem