ACCC releases new rules for Open Banking Consumer Data Rights

The competition regulator has dropped changes to laws around consumer data rights, expanding how data can be used and when.

Banking was to be the first sector the CDR targeted, with rules announced in September 2019.

The competition regulator has dropped amendments to the Consumer Data Rights Rules in what is likely to be the last round of changes before rule-making functions transfer to the government in 2021.

The new rules on Consumer Data Rights (CDR), also known as Open Banking, expand the types of businesses that can access consumer data.

The Australian Competition and Consumer Commission was granted oversight of CDR after it was announced in 2017.

The ACCC sets the rules for the scheme, but that responsibility will be transferred to the Treasury on 28 February 2021.

In its explanatory notes for the range of amendments filed on CDR the ACCC noted the new rules provide for separate consent types for the use, collection, and disclosure of consumer data.

“This means that consumers can give more than one type of consent and can independently withdraw or amend each type of consent,” the notes said.

“A consumer may stop the collection of CDR data by withdrawing the authorisation they gave to the data holder.”

“Alternatively, if the (accredited data recipients) provides this functionality, they may either withdraw or amend the consent to collect.”

The amended rules require that when a consumer withdraws an authorisation to disclose CDR data the associated consent to collect CDR data also expires.

“This addresses a potential source of confusion for CDR consumers, and the technical difficulties that may be faced by (accredited data recipients) if they were required to delete or de-identify only a subset of CDR data they had already collected, as required under the former Rules,” the notes said.

The ACCC notes this means that following a change to consent data already collected does not become redundant data and subject to deletion.

The data users may continue to use the already collected data until such time as consent to use is withdrawn or expires.

The amendments come after the ACCC received over 50 submissions from government departments, regulators, banks, credit card providers, fintechs, industry bodies, and consumer and privacy advocates.

ACCC commissioner Sarah Court said the package of amendments was designed to boost participation in CDR through expanding the benefits to more businesses.

“The new rules also include provisions to improve the consumer experience and provide greater flexibility for participants’ business models,” Ms Court said.

“The rules will encourage increased participation in the Consumer Data Right, and new service offerings for consumers, while also ensuring that strong consumer protections continue to apply.”

Banking was to be the first sector the CDR targeted, with rules announced in September 2019.

Consumer data related to credit and debit cards, deposit and transaction accounts was made available on 1 July 2020, followed by data relating to mortgages and personal loans on 1 November.

Energy and telecommunications are next in line.

A framework for consultation about expanding CDR to energy was released in July 2020.