CDR rules updated to expand remit

The Australian Competition and Consumer Commission (ACCC) has amended the Consumer Data Right (CDR) Rules, with consent from the Treasurer, to expand the types of consumers who can use it.

While the rules were initially made in February 2020, they have now been updated to expand their functionality, as per the recommendations of the 2018 Open Banking Review.

Among the main changes to the CDR rules is the ability for more business customers to utilise CDR and share their data with accredited data recipients when shopping around for better services.

The new rules, which commenced yesterday (23 December), also include provisions to improve the consumer experience and provide greater flexibility for participants’ business models.

Previously, the CDR was predominantly focused on consumers (as the name suggests), but following consultation with industry in September and October – including that with banks, credit card providers, fintechs, industry bodies, and consumer and privacy advocates – this has been expanded to enable more business customers to use it.

Prior to these amendments, sharing of CDR data was limited to account-holders that were individuals (including sole traders) aged 18 or over, from accounts held singly or jointly with one other individual.

Under the amended rules, CDR data can be shared by non-individuals, in the context of business partnerships, and by secondary users. This includes incorporated entities and business partnerships.

Major banks will therefore enable these customers to share their data with accredited data recipients from 1 November 2021.

The amended rules also allow accredited data recipients (ADRs) to offer to their CDR consumers the ability to amend an existing consent. This includes the ability to add or remove uses, data types, accounts or data holders, or to amend the duration of the consent. 

It also provides the ability for consumers to give more than one type of consent (for example, separate consents for data collection, use, disclosure, direct marketing and research), which the consumer can independently provide, withdraw or amend.

Further, the new rules will mean that should a consumer withdraw consent for the data holder (e.g. their bank) to disclose their data, the associated consent given to an AFR to collect that data will expire.

At this point, the accredited person must inform the consumer that they may also withdraw their use consent, and they may make the election to delete redundant data in respect of CDR data that has already been collected. However, the expiry of the collection consent does not automatically result in expiry of the use consent relating to any CDR data that has already been collected.

The ACCC stated that the new rules do not include rules for tiers of accreditation, the disclosure of ‘insights’ derived from CDR data to any non-accredited person, or the sharing of data with trusted advisers. According to the commission, further consideration will be given to those issues in light of the submissions provided by stakeholders during consultation.

Speaking of the changes, ACCC commissioner Sarah Court said: “This significant package of amendments is designed to encourage participation in the Consumer Data Right by expanding its benefits to more businesses, including companies and partnerships.

“The new rules lay the foundation for the continued expansion of the Consumer Data Right in 2021, following the successful start of consumer data sharing in 2020,” Ms Court said.

“The rules will encourage increased participation in the Consumer Data Right, and new service offerings for consumers, while also ensuring that strong consumer protections continue to apply.”

While the open banking regime expanded into mortgage data on 1 November 2020, a recent update from the ACCC shows that the four major banks are behind schedule in providing a number of deliverables to consumers. For example, none of the big four banks is yet able to show closed accounts to consumers under CDR, with the majority expecting to rectify this in February 2021.

Other delays include the inclusion of account details while CDR consumers banking through CBA will be unable to share direct debit data for home loan and personal loan repayments under the scheme until July next year.

ACCC to hand over CDR rule making to Treasury

As well as releasing the new rules, the ACCC has now confirmed that, from 28 February 2021, the rule-making function for the CDR will move to the federal Treasurer.

“The ACCC is working closely with the Treasury on these rules as part of the transfer of the CDR rule-making function moving from the ACCC to Treasury and the Minister,” it said.

The new version of the Consumer Data Right rules can be found on the Federal Register of Legislation website.

[Related: Open banking ‘a pivotal event’ for mortgage industry: NextGen.Net]