Consumer Data Rights Bill Passes Federal Parliament

Monday 5 August 2019 @ 10.40 a.m. | Corporate & Regulatory | Legal Research

The Treasury Laws Amendment (Consumer Data Right) Bill 2019 (Cth) (the “Bill”) is currently awaiting assent.  The Bill passed the House of Representatives on 30 July 2019 and passed the Senate on 1 August 2019. The Bill was introduced into the House of Representatives by the Treasurer, the Hon Josh Frydenberg and proposes to amend the following Commonwealth legislation:

  • the Competition and Consumer Act 2010;
  • the Australian Information Commissioner Act 2010; and 
  • the Privacy Act 1988.

The Bill implements the National Consumer Data Right measure announced in the Federal 2018-19 Budget.  An earlier version of the Bill was introduced in the previous session of Parliament, but lapsed on the dissolution of Parliament before the election.

Background to the Current Bill

The Explanatory Memorandum to the current Bill indicates the purpose of the Bill is to:

“… provide individuals and businesses with a right to efficiently and conveniently access specified data in relation to them held by businesses and to authorise secure access to this data by trusted and accredited third parties … [it] will also require businesses to provide public access to information on specified products they have on offer.”

Technology news website ZDNet reports that the Bill will:

“… allow individuals to ‘own’ their data by granting them open access to their banking, energy, phone, and internet transactions, in addition to gaining the right to control who can have it and who can use it.”

The Bill's Explanatory Memorandum also states:

“The Government has committed to applying the CDR [Consumer Data Right ] to the banking, energy and telecommunications sectors, and eventually across the economy. The CDR relating to banking data is commonly referred to as ‘Open Banking’.”

Open Banking will be the first sector of the CDR to be introduced, and is expected to begin in February 2020.

Previous Reviews on Data Portability

The Explanatory Memorandum notes that a number of reviews have recommended data portability rights in specific sectors. Some of the reviews were:

  • the Financial System Inquiry 2015;
  • the Review of the Four Major Banks 2016;
  • the Productivity Commission’s report on Competition in the Australian Financial System 2018;
  • the Australian Small Business and Family Enterprise Ombudsman’s report Affordable Capital for SME Growth; and
  • the ACCC’s Electricity Supply and Prices Inquiry 2018.

Outline of the Proposed Amendments

The Bill indicates that proposed amendments contained in Schedule 1, Part 1 will make substantive amendments to the Competition and Consumer Act 2010 (Cth) – mainly by inserting a new “Part IVD—Consumer data right”.

Amendments contained in Schedule 1, Part 2 make miscellaneous amendments to the Australian Information Commissioner Act 2010 and Privacy Act 1988 as well as further amendments to the Competition and Consumer Act 2010.

Government Reaction to the Bill

Commenting on the Bill in his speech, the Minister said:

“… This important reform will provide individuals and businesses with a right to access data relating to them; and to authorise secure access to their data by accredited data recipients. It will also enable data about products on offer to be available in machine readable form. The consumer data right is a right for consumers to authorise data sharing and use. Consumers will determine which data is shared under the right, on what terms and with whom.”

Speaking to ZDNet the Minister said progress to the February [2020] launch is "well advanced":

"The ACCC will issue the 'lock-down' version of the Rules governing the system by the end of August [2019]; and the interim Data Standards Body has, in the last week, issued the implementation draft of the technical standards … High levels of privacy protection and information security will be a core feature of the system. It is not a right for businesses to share consumer's data without their consent."

Public Comment and Reaction to the Bill

The ZDNet article also indicates that three of the Big Four banks have already made access available to generic product data for credit and debit cards, deposit accounts, and transaction accounts via an Application Programming Interface (API).

Danny Gilligan, the CEO of Data Republic is a supporter of the idea of giving consumers more control over their data and enabling data-sharing to happen more freely. He told ZDNet:

"The simplest way to view the CDR is consumers are utilising scraping technologies today to move their data where they want within services. A CDR is really a regulated security and consent framework around what's already happening today. It's the same outcome, written in stone, with a much better consideration of security and consent."

The Australian Privacy Foundation (the “APF”) made a submission on 1 March 2019 to the Senate Standing Committee on Economics, who were considering the first version of the Bill. The APF said in their submission:

“… we consider the framework as it currently stands unnecessarily exposes people to harm because the fundamental privacy safeguards are not in place and risks have been severely underestimated by the Government...
These issues [privacy safeguards] can be rectified by ensuring that an external rigorous and independent Privacy Impact Assessment is performed with the implementation of the recommendations from this assessment.”

Another ZDNet article on the previous Bill also quotes the APF as saying “protections inside the CDR are not strong enough to stop the practice of consumers being forced to sign consent forms”. The article also said that in the social media age, consumers are used to doing this, and may unknowingly hand their data over to additional parties.

The CDR will be regulated by the Australian Competition and Consumer Commission (“ACCC”) and the Office of the Australian Information Commissioner (“OAIC”), with a new Data Standards Body developing standards for transfer and security.

TimeBase is an independent, privately owned Australian legal publisher specialising in the online delivery of accurate, comprehensive and innovative legislation research tools including LawOne and unique Point-in-Time Products. Nothing on this website should be construed as legal advice and does not substitute for the advice of competent legal counsel.

Sources:

Related Articles: