In brief 3 min read
The Federal Government has finally passed the Treasury Laws Amendment (Consumer Data Right) Act 2019 (the CDR Act) through Parliament. This follows the Government's first attempt to introduce draft legislation that would implement the Consumer Data Right (CDR) back in February this year, which failed to pass through both Houses before Parliament was dissolved ahead of the Federal Election. It's been a long time coming, but the CDR regime is finally live.
Key takeaways
- The CDR Act establishes an economy-wide, consumer-directed data transfer system that allows consumers to access certain data held about, or related to, them by designated organisations, and direct that data to be transferred to accredited third parties.
- This is nothing new – proposals for a national CDR framework have been in train for several months and a pilot program for the Big Four Banks already kicked off in July 2019.
- The legislation's successful passage has kickstarted a series of regulatory steps needed to formally activate the Open Banking regime – the CDR's first application to the financial services sector – including the passing of a designation instrument and release of the ACCC's final CDR Rules.
Who else in your organisation needs to know about this?
Legal, risk and compliance, as well as IT and customer relations teams should be aware of the CDR Act's passage and its first (and fast!) application to the banking industry, with the energy and telco sectors to follow.
Has anything changed since the previous Bill?
While the two pieces of CDR legislation introduced to Parliament are not identical, the Government has not made any substantive changes to the instrument that passed through Parliament on Thursday. You can read more on the substance of the previous (and now current) CDR legislative framework here.
What's next?
The CDR Act sets up the legal structure for an underlying CDR framework that will apply to relevant industry sectors as and when they are designated by Treasury.
In the immediate term, the Open Banking regime will commence once the Open Banking Designation Instrument and ACCC Consumer Data Rules are finalised. The designation instrument is now in its second stage of public consultation, and the ACCC published its draft rules for the CDR on 29 March 2019 (for more, see our Insight: ACCC releases draft Consumer Data Right Rules for consultation). We expect to see final documents swiftly given the successful passage of the CDR Act.
In truth, the Open Banking regime has already started, with a voluntary pilot program opted into by the Big Four Banks commencing in July 2019. However, once the designation instrument is passed, the Big Four will be statutorily required to share the first tranche of consumer data upon request from February 2020, and other financial institutions will be phased in to compliance from July 2020 onwards.
Actions you can take now
For steps your business can take to ensure compliance with the CDR regime (both before and once your industry has been designated), see our Insight: Top 10 things to know about the Consumer Data Right.