Current state of play for the Consumer Data Right

4 minute read 14.07.2019 Genevieve Magro, Susan Kantor

The proposed legislative framework for the new CDR, which was to come into effect through the Treasury Laws Amendment (Consumer Data Right) Bill 2019 (Bill) has lapsed in Parliament. In this article, we provide an update on the status of the CDR regime.

Key takeouts

The legislation introducing the Australian Consumer Data Right (CDR) lapsed when Parliament was prorogued in April. However, it is expected that a new bill will be re-introduced into Parliament in the coming months.

The Draft CDR Rules that the Australian Competition and Consumer Commission (ACCC) released (which are based on the lapsed bill) provided that product reference data (PRD) was due to be made available by the 'big four' banks from 1 July 2019. Despite the fact that the CDR laws have not passed yet, banks have commenced voluntarily publishing PRD.

Although the CDR legislation and Rules have not yet been enacted, clients in the banking sector should continue to prepare for compliance with the CDR regime.

Our earlier article, A new right - the Consumer Data Right and framework unpacked, sets out the background to the CDR law and the various components of the proposed CDR regime. Although the regime was due to commence on 1 July 2019, this has not yet occurred. In this article we provide an update on the status of the legislation, CDR Rules and technical standards.

Status update: CDR legislation

Following our May update on the CDR, Consumer Data Right – ACCC releases a consultation draft of CDR Rules, in which we discussed the Bill's lapsing when parliament was prorogued in April, the Bill has not yet been reintroduced into parliament.

Given recent comments made by the Treasurer, the Honorable Josh Frydenberg, on ABC's 7.30 program, we expect that the bill will be reintroduced in the coming months. Mr Frydenberg stated:

"I'm going to be busy now legislating the consumer data right which enables Australians to share their data to get better deals on their energy or on their telephone bills or with their banking services."

At this stage, it is not known whether the new bill or final form of the legislation will include any amendments to take account of the additional comments made by the Labor Senators in the report issued by the Senate Standing Committee on Economics on the Bill.

The remaining elements of the CDR regime (referred to below) are dependent on the CDR legislation being enacted and the form of that legislation.

Status update: CDR Rules

The Draft CDR Rules that the ACCC previously released set out the timetable for the phased implementation of the CDR in the banking sector. The first phase (the publication of PRD) and accreditation of Authorised Data Recipients (ADRs) was due to commence on 1 July 2019. However, given the delay in the introduction of the legislation (and subsequent delay of the CDR Rules), that date has now passed without the CDR Rules taking effect.

Despite the fact that the CDR regime has not yet been enacted, according to the ACCC, it has welcomed the voluntary publication of PRD by ANZ, CBA and Westpac since 1 July 2019.

Although it is still uncertain whether the timetable for the implementation of the CDR in the banking sector will remain as set out in the Draft CDR Rules, banks are working towards being ready to comply for the first set of consumer data product by 1 February 2020.

The ACCC will also perform the role of the CDR Registrar, and announced on 11 June 2019 that it will use source code sharing service GitHub to host its consultation on the technical design of the CDR Register and Register Discovery API. The CDR Register will contain details of accredited data recipients and data holders.

Status update: CDR technical standards

Data61 has been working with the ACCC and the Office of the Australian Information Commissioner to develop draft technical standards to design application program interfaces (APIs) to allow consumers to access and share data with accredited parties under a CDR regime.

On 31 May 2019, Data61 released a third working draft of the technical standards. We expect a final version of the technical standards will follow the (re)introduction of the CDR legislation in Parliament.

Data61 announced it will continue to work with the banks, fintech community, consumer groups and the ACCC over the next few months to review and assess the consistency of data available through the API links that are now live for PRD, and adjust the standards as necessary to ensure there is easy and consistent access to PRD. Data61 will also continue to work with the CDR community, ACCC and Treasury to assist meeting the current planned live launch of CDR (scheduled for February, 2020) through ongoing testing of the technical standards.

Implications of the CDR for the banking industry

While the Draft Legislation has lapsed in Parliament, we expect it will be re-introduced as a new bill within the coming months.

With the information that is known to date, affected organisations should continue to operate on the assumption that the Draft Legislation and Draft Rules will be finalised using a similar implementation timetable, and should take steps to ensure they are ready to comply with the CDR regime.

Next steps

For further information and assistance in understanding the application of the CDR regime, or if you would like assistance in ensuring your organisation's compliance, please contact us.