On 5 October 2021, 'Version 3' of the Consumer Data Rules (CDR) was registered under the Competition and Consumer (Consumer Data Right) Amendment (2021 Measures No. 1) Rules 2021 (Cth). These amendments aim to increase the accessibility of the CDR by providing additional pathways to participation, as well as expanding consumer rights and ease of data sharing under the scheme.
Prior to this, a major barrier to the uptake of the CDR has been the rigorous and costly accreditation process required. This has been particularly evident in the relatively slow rollout of Open Banking, with a number of ADIs having to defer their CDR obligations and only 20 entities listed as Accredited Data Recipients (ADRs) to date.
However, in light of these new rules, it is likely we will soon see an accelerated uptake of the CDR as it continues to be rolled out economy wide.
Key amendments and their effects
Sponsored accreditation model (from 1 February 2022)
Under Version 3 of the CDR rules, accreditation will be made easier via the concept of ADR 'sponsorship'. This will allow existing and unrestricted ADRs to 'sponsor' parties to participate in the scheme. A sponsored party can now become accredited without having to meet rigorous security requirements, such as providing an independent information security assurance report, provided they arrange for their sponsor to assist them in meeting these obligations.
Under this mechanism, the sponsored party will receive CDR data via their sponsor rather than obtaining CDR data directly from data holders.
This will lower the barrier to entry by easing the burden and cost of meeting rigorous security requirements and will provide an alternative avenue for participation in the scheme. It will be particularly useful for smaller entities such as fintechs.
The ability to engage in sponsorship arrangements may also allow for partnerships between organisations such as fintechs and more heavily resourced unrestricted ADRs to thrive.
CDR representative arrangement (commenced 19 October 2021)
This alternate arrangement will enable unaccredited parties to access and use CDR data by acting as a 'CDR representative' of an ADR. The CDR representative may then offer CDR services on behalf of the ADR or themselves, without requiring full accreditation. This representative regime is very similar to the Corporate Authorised Representative arrangement for Australian Financial Services License holders.
The principal ADR will remain responsible and liable for the representative's use and management of CDR data. So it will be important for them to carefully select representatives and ensure appropriate contractual arrangements are made.
This may involve imposing certain conditions on the use of CDR data by the representative to minimise liability risks and safeguard the rights of the principal ADR.
As these arrangements begin in practice it will also be important to address questions such as whether there will be a register of representatives, whether CDR representatives will have to clearly state that they are operating as a representative of an ADR in their documents or terms and what consequences will stem from potential misuse of CDR data.
Outsourced service providers (commenced 19 October 2021)
Existing ADRs may also engage outsourced service providers (OSPs) to collect CDR data directly from a data holder on its behalf, despite the OSP not being accredited itself. As with CDR representatives, liability remains with the principal ADR.
This will reduce the cost of building and operating APIs to connect ADRs and data holders by enabling this functionality to be more easily outsourced.
Trusted advisors / insights (by 1 February 2022)
In addition to improving accessibility for data recipients, under Version 3 of the Rules, additional changes have been made to expand the ability of consumers to share their CDR data.
Firstly, consumers will soon be able to consent to and nominate trusted advisors such as accountants, lawyers and financial advisors, to access CDR data on their behalf.
Secondly, consumers may consent to an ADR disclosing 'CDR insights' about their data in specific circumstances, such as for the purpose of verifying their identity or bank account balance before a transaction takes place.
Standards for CDR insight disclosures will be made by the Data Standards Chair after consultation with industry stakeholders.
Single consent model for joint accounts (from July 2022)
Finally, data sharing for joint account users will also be made easier. A single joint account holder will soon able to consent to share their CDR data with an ADR (for example, via a budgeting app) without requiring consent from all other joint account holders.
This will simplify means of data-sharing under the regime, whilst maintaining security and transparency. All joint account holders will equally be able to switch off data sharing in place. Where a single member of the joint account consents to share CDR data, all other existing joint account holders will be notified of this.
How will these amendments affect businesses?
These amendments intend to accelerate the uptake of the CDR by making it more accessible and allowing flexible arrangements for businesses previously unable to complete the rigorous accreditation process.
In addition, these changes open up exciting opportunities for existing ADRs to expand their role by forming affiliations and partnerships with other organisations.
Such collaboration could become increasingly useful once the CDR is rolled out to additional sectors, as this may permit new methods for cross sector aggregation of services.
For example, an existing ADR in the banking sector could become a sponsor for or gain representatives from organisations in other sectors such as energy and telecommunications. This would enable them to provide services and insights across multiple sectors without requiring them to collect and handle this information independently.
As a result, we could see networks of organisations being formed under the CDR as functionality may be delegated and shared across sectors to maximise the customer experience.
Guidance on the CDR journey
We continue to work with many organisations on all aspects of their CDR journey. We advise on legal and regulatory obligations under the CDR regime as data holders or accredited data recipients, as well as the newly formed roles of sponsor, principal and representative.
