On 26 November the Federal Government announced its intention to legislate a national Consumer Data Right next year, following the recommendations of the Productivity Commission (which you can view here).
In today’s article we look at what we currently know about this proposed data right and suggest how it relates to existing data rights and other changes proposed by the Government.
By Dr Drew Donnelly, Compliance Quarter.
What we know so far
The Government will announce its formal response to the Productivity Commission’s Inquiry Report Data Availability and Use (PC Report) in a few weeks time, so this announcement is a ‘sneak peek’, with more detail to be released shortly. Nevertheless, there are a few things that we know from the Government’s comments to date:
- This follows the recommendations of the Productivity Commission with respect to a proposed consumer right, so is likely to have similarities with that proposed right
- It will be established sector-by-sector, beginning with the energy, telecommunications and banking sectors.
- Utilities will be required to provide standard, comparable, easy-to-read digital information, that third parties can readily access.
The consumer data right as recommended by the Productivity Commission
The Productivity Commission recommended a Comprehensive Consumer Right which would enable consumers to:
- share in perpetuity joint access to and use of their consumer data with the data holder
- receive a copy of their consumer data
- request edits or corrections to it for reasons of accuracy
- be informed of the trade or other disclosure of consumer data to third parties
- direct data holders to transfer data in machine-readable form, either to the individual or to a nominated third party (See PC Report, recommendation 5.1).
So, what is consumer data?
According to the Productivity Commission, consumer data is digital data, provided in a machine-readable format, that is:
- held by a product or service provider
- identified with a consumer
- associated with a product or service provided to that consumer.
Participants in an industry would determine the scope of consumer data relevant to their industry through a ‘data-specification agreement’. These agreements would also set out transfer mechanisms and procedures for the security of data.
These agreements would require approval by the Australian Competition and Consumer Commission, which would then register them (See PC Report, recommendation 5.2).
Of course, at this stage, we do not know to what extent the Government’s proposed right would reflect the recommendations in the PC Report.
Don’t the Privacy Act and the GDPR already provide access to such information?
Both the Privacy Act 1988 and the General Data Protection Regulation (for businesses that have dealings with EU customers) provide a data access right. But this right relates to accessing personal information or data. Consumer data includes personal information or data, but it is a wider category. For example, it may include data created from consumers’ online transactions or internet activity or data purchased about a consumer, which cannot be used to identify a person, and therefore does not count as personal information or data. The precise scope of consumer data will depend on the industry in question and the content of the agreements that apply in that industry.
How does this relate to other Government reviews?
Recently, the Government separately announced its intention to introduce mandatory comprehensive credit reporting (http://sjm.ministers.treasury.gov.au/media-release/110-2017/). This will mean access to a richer credit data set for potential lenders. It is likely that that bank of credit information will constitute part of that individual’s consumer data that they have a right to access under the new consumer right
The Government also announced earlier this year the introduction of an ‘Open Banking Regime’ (for more information see https://compliancequarter.com.au/open-banking-regime-fintech/). The review looking at how a regime would be implemented is due to report back by the end of the year. The Open Banking Regime would seek to “increase access to banking product and consumer data by consumers and third parties, if the consumer consents”. Note the proposal that this regime would go beyond rights of consumer access to include third parties.
While we will have to wait until the Government’s formal response to the PC Report to find out the essential details of the regime, let us know if you need advice on how you might respond to the proposed consumer right into your 2018 compliance program.
