Australia’s data portability rights: An update on what’s happening on the Consumer Data Right after meagre cost / benefit outcomes come to light

September 20, 2024

Key points

• In 2023 the Australian Federal Government paused the implementation of one of its key reforms aimed to increase competition in the financial services, energy and telecommunications sectors. The Consumer Data Right (CDR) was paused for the superannuation, insurance and telecommunications sectors in order to focus on maturing the CDR to the initial sectors targeted, being the banking and energy sectors.
• The Australian federal Treasury commissioned an independent report into compliance costs associated with the CDR, which was released on 9 August 2024. The report concluded that compliance costs incurred by sector participants to implement the CDR significantly exceeded original estimates.
• As a result, the Australian Assistant Treasurer, Stephen Jones, decided that the CDR would be "reset". A consultation process occurred which ended on 9 September 2024 and which related to proposed changes to the CDR.
• The proposed changes intend to simplify the customer consent process and encourage operational enhancements - with the aim being to reduce the barriers to participation in the CDR.
• The Treasury will now consider the submissions made in respect of the consultation and the fate of the proposed changes.

Background

Consumer data portability rights are catching on. See, for example, the developments reported on about the Consumer and Product Data Bill moving to open banking in New Zealand, Canada's year of rights to data portability and the European efforts to create a single market for data.

Australia has its own - the Consumer Data Right (CDR) - which allows consumers to safely share the data that businesses hold about them.

Part IVD of the federal Competition and Consumer Act 2010 (Cth) establishes the Consumer Data Right and provides the Australian Competition and Consumer Commission (ACCC) with functions and powers for the Consumer Data Right and regulatory oversight over rules which detail how the Consumer Data Right works and is implemented.

The aim of the Australian CDR regime is to help consumers compare products and services to find offers that best match their needs. When CDR laws were first passed in Australia, the banking and energy sectors were the first to be regulated by them - with the laws requiring consumer data to be readily and easily available for the consumer to share from one service provider to another. The aim, in giving consumers the power to share their data, was to encourage innovation in new products and services.

Thus, Australia embarked on an era of open banking and open energy - with open telecommunications and open insurance expected to follow.

Live sharing of consumer data began with the banking sector on 1 July 2020. All Australian banks are required to participate in the Consumer Data Right.

Consumer data sharing in the energy sector began on 15 November 2022. Energy retailers that operate through the National Electricity Market (NEM) and have more than 10,000 customers are required to participate in the Consumer Data Right.

What happened? 2022 Review

On 29 September 2022, the Assistant Treasurer, the Hon Stephen Jones MP, released a report which was the product of the independent Statutory Review of the Consumer Data Right by Ms Elizabeth Kelly PSM (Review Report). The Review Report recommended a greater focus on CDR system maturity, functionality and data quality.

2023 pause to CDR rollout to certain sectors

Consequently, the Federal Government announced in its Statement in Response to the Review Report in June 2023 that it would pause the implementation of the CDR across certain sectors, being:

• superannuation;
• insurance; and
• telecommunications sectors,

"to allow time for the CDR to mature across the banking and energy sectors and to implement lessons learned to date".

The Federal Government said it would make a "strategic assessment" towards the end of 2024 to "inform future expansions and the implementation of action initiation" - that is, allowing an action to be performed on your consented-behalf - sometimes described as "write access".

While it is unclear what this will entail, it is unlikely that the CDR will be expanded into the superannuation, insurance and telecommunications sectors within the timeframe originally anticipated.

The proposed CDR launch for non-bank lenders and Buy Now Pay Later products was pushed back until 2025 or 2026.

This pause on the CDR has not affected the energy sector, in which the CDR was gradually rolled out from 2022 onwards for energy retailers.

2024 Richards Report and "reset" of CDR

In 2023, the Australian Treasury commissioned an independent review into compliance costs associated with implementing the CDR framework from Heidi Richards, former Australian Prudential Regulation Authority (APRA) senior executive, and the resulting report was released in December 2023 (Richards Report).The Australian Federal Government's response to the Richards Report was released on 9 August 2024 and noted that the costs of the CDR have far exceeded original regulatory estimates, and that they may be contributing to slow adoption of CDR-enabled products and services in Australia.

The Richards Report was released on the same day that Australia's Assistant Treasurer, the Hon. Stephen Jones MP, addressed the Committee for Economic Development of Australia, announcing a "reset" of the CDR.

As part of the reset, draft amendments to the CDR were released with a formal consultation process announced, entitled as the "consent and operational enhancement amendments consultation". The consultation period concluded on 9 September 2024.

2024 amendment proposals

The draft amendments to the CDR focus on the following objectives:

• Simplify the consumer consent process while maintaining consumer protections - for instance, reducing the amount of information a data recipient is required to provide to a consumer at the time of consent; and
• Encourage operational enhancements to reduce the barriers to participation in the CDR - for instance, requiring data holders to provide a simple and straightforward way to appoint a nominated representative.

The Treasury will now consider the submissions made in respect of the consultation and Mr Jones will now decide whether to make any of the proposed changes. The timeframe for this is unclear.

Other recent developments on the CDR

In addition to the proposed CDR reset discussed above, there have been a number of other recent developments in relation to the CDR:

• Following a consultation process in October 2023 established by the Australian Treasury to obtain feedback on "screen scraping" or "digital data capture" (i.e. the capture of displayed data for various uses), the Treasury is now considering a formal ban on "screen scraping" in the banking sector. Screen scraping had previously been considered an alternative to the CDR.
• The Treasury Laws Amendment (Consumer Data Right) Bill 2022 (Cth) was passed on 15 August 2024. The Bill sets out a framework to enable "action initiation" reforms in respect of the CDR, which would allow CDR consumers to direct accredited persons to act on their behalf in respect of the CDR. However, the operative elements of the "action initiation" reforms are still awaiting a consultation process from the Treasury. Action initiation is sometimes described as "write access" - it essentially means that a consumer can instruct a third party (an accredited organisation) who is authorised by the consumer to initiate actions on their behalf - such as to add to, change or manage the consumer's data. This is more power than granted to accredited entities currently - where a consumer can only consent to an accredited entity being given read only access to their data. Clearly for this new power to work, consumers should be able to grant and revoke their consents freely. The aim of action initiation is to facilitate switching suppliers by a customer looking for a better deal.
• The Digital ID Act 2024 (Cth) and the Digital ID (Transitional and Consequential Provisions) Act 2024 (Cth) are expected to commence by 1 December 2024. As noted by us previously, the new Digital ID laws are intended to provide robust privacy safeguards to protect individuals' personal information.
  
  In a letter dated 7 August 2024 from Assistant Treasurer, the Hon. Stephen Jones MP to the Data Standards Chair, Andrew Stevens (the head of the Data Standards Body established by the Federal Government to deliver open standards to support the CDR), Mr Jones reiterated the Australian Government's expectations that the Data Standards Chair would, as part of the reset of the CDR, ensure consistency with the Digital ID framework. It appears the intent is to ensure that the CDR standards are ultimately aligned and interoperable with the Digital ID standards (also the responsibility of the Data Standards Body).
• In August 2023 the Treasury and the Data Standards Body conducted a review of the CDR Rules in relation to the concept of "consent" under the CDR. The review suggested a "principles-based" prohibition of "dark patterns" (design of user interfaces intended to confuse or manipulate users into taking certain actions). While the proposed prohibition does not appear to be going ahead, it is likely that reforms in this area will be closely intertwined with reforms on "dark patterns" under the Privacy Act.

Next steps

A focus on the costs and benefits of consumer data portability rights will be welcomed by many sectors - who will be mindful of the need to ensure the CDR regime is able to deliver the benefits for consumers.

The financial services, energy and telecommunications sectors will need to keep a watching brief on developments - especially in light of the Australia's government's broader digital infrastructure agenda.

Please contact Robyn Chatwood, Matthew Hennessy, Michael Park, Antonia Hudson, Jamie Griffin or your usual technology or competition law contact within Dentons if you would like to keep up to date or discuss these developments.