The Australian Government has released draft legislation that will amend the Competition and Consumer Act 2010 to provide businesses and individuals with a Consumer Data Right. The new legislation intends to provide a regime to allow individuals and businesses to access certain data held in relation to them by businesses, and to direct the transfer of that data to either themselves or to accredited data recipients. The Consumer Data Right regime will be first applied in the Australian banking sector, and will be applicable to the big 4 Australian banks from 1 July 2019.
How will it work?
The key requirement of the Consumer Data Right Regime will be that, a data holder (for example a bank), must, at the direction of a Consumer, share data relating to the Consumer’s with:
- an accredited data recipient to which the Consumer has given their consent (e.g. another bank); or
- the Consumer.
“Consumer” will mean small, medium and large businesses as well as individuals.
A register will be created of accredited data recipients to whom data can be transferred to or shared with.
The Australian Competition and Consumer Commission (ACCC) will be responsible for the creation and oversight of the relevant “consumer data rules” for each sector that will be subject to the Consumer Data Right. These rules will outline how a Consumer may request access to data and how data holders and data recipients should deal with the data. The Office of the Australian Information Commissioner (OAIC) will be responsible for handling complaints made in relation to the Consumer Data Right regime.
Although the Consumer Data Right regime will only initially apply to the banking sector, the Australian Government will also ensure that it is extended to cover the energy and telecommunications sectors. Due to the nature of the proposed legislation, the Consumer Data Right regime could be expanded to apply to any sector of the economy. It is unclear at this time how the regime will affect each sector, as the “consumer data rules” created by the ACCC for each sector will set out the relevant privacy obligations that data holders and recipients will need to comply with, and the types of data to which the regime will apply in each sector.
If you require further advice on how these changes will affect you or if you require any assistance, please do not hesitate to contact us.