The Consumer Data Right (CDR) is expanding into Open Finance, now capturing non-bank lenders (NBL) and Buy Now Pay Later (BNPL) product providers. Consumers will soon be able to request the sharing of product and consumer data from these entities, in a machine-readable form, which must be displayed across a ‘consumer dashboard’.
Background
The CDR aims to give consumers greater control over their data and increase their ease of access, not only to their own data, but also to data relating to other relevant products and services.
The Government is rolling out the CDR on a sector-by-sector basis, following its introduction to the banking industry in 2020, and the energy sector in 2022.
It is intended to help consumers save time and money by encouraging product comparisons and switching, and by streamlining application processes for a variety of financial products. Accordingly, one of the main aims of the CDR is to allow consumers to share their data with service providers seamlessly and securely.
Who does the CDR apply to?
Treasury has released exposure draft Rules for the implementation of the CDR. The Rules provide that NBL with data sharing obligations are to be classified as either an initial or large provider. The timeline for the rolling-out of the CDR will depend on whether an NBL is deemed an initial or large provider.
- Initial providers – are NBLs with more than $10 billion in resident loans and finance leases for the calendar month preceding the commencement date and on average over the 11 previous calendar months; and
- Large providers – are NBLs with more than $500 million (but less than or equal to $10 billion) in resident loans and finance leases in the calendar month preceding the commencement date and on average over the 11 previous calendar months, and that also has more than 500 customers.
When does the CDR begin?
If a banking data holder has offered BNPL products prior to 1 November 2023 (12 months before the tranche 1 date), it must share data from the following dates:
- initial and large providers must be able to handle product data requests under Part 2 of the CDR Rules – by the tranche 1 date (1 November 2024);
- initial providers must be able to handle consumer data requests (except complex requests) under Part 4 of the CDR Rules – by the tranche 2 date (1 February 2025);
- initial providers must be able to handle complex requests under Part 4 of the CDR Rules – by the tranche 3 date (1 May 2025);
- large providers must be able to handle consumer data requests (except complex requests) under Part 4 of the CDR Rules – by the tranche 4 date (1 August 2025); and
- large providers must be able to handle complex requests under Part 3 of the CDR Rules – by the tranche 5 date (1 November 2025).
Product, consumer, and complex data requests
Product data requests
The Draft CDR Rules provide that required product data, in relation to the banking and/or NBL sector, means CDR data for which there are no CDR consumers that is:
- banking sector or NBL sector data;
- about the eligibility criteria, terms and conditions, price, availability, or performance of a covered product;
- about publicly available performance or availability data;
- product specific data about a covered product; and
- held in a digital form.
Consumer data requests
Required consumer data, under the Draft CDR Rules, means CDR data for which there is at least one CDR consumer that is:
- banking sector data or NBL data of a kind mentioned in the Rules relating to a relevant account of the CDR consumer; and
- held by the data holder in a digital form.
The product specific data referred to could include the following:
- any product prices that were negotiated individually with a CDR consumer;
- the interest rates that are current at the time of the request, as well as any other interest rates applicable to the covered product, and any terms and conditions associated with those interest rates; and
- any features and benefits negotiated individually with a CDR consumer.
Complex data requests
A complex data request, under the Draft CDR Rules, is a consumer data request that:
- is made on behalf of a secondary user of the consumer; or
- relates to a joint account or a partnership account; or
- is made on behalf of a non-individual CDR consumer whose authorisations are handled by a nominated representative.
How will it work in practice?
When requested a data holder MUST, unless an exception applies, disclose required product and consumer CDR data in accordance with the timelines outlined above.
In respect of complex data requests, a data holder must: seek the CDR consumer’s authorisation to disclose required consumer data; and seek the CDR consumer’s authorisation to disclose any voluntary consumer data that it intends to disclose. The data holder must then disclose, to the accredited person, the required consumer data it is authorised to disclose.
The data must be disclosed to the person who made the request, in machine-readable form, and in accordance with the data standards. A data holder must not impose conditions, restrictions, or limitations of any kind on the use of the disclosed data.
A fee cannot be charged for the disclosure of required product or consumer data.
What do NBLs and BNPL providers need to do?
Generally, the Draft CDR Rules will require relevant data holders to:
- disclose relevant CDR data when a valid request is received;
- offer consumers access to an ‘easy-to-use’ consumer dashboard for managing and viewing their data and any authorisations;
- comply with the relevant privacy and data-storing safeguards;
- manage and maintain appropriate dispute resolution services; and
- keep proper records and report where required to the ACCC.
Next steps
Ensuring compliance with the new CDR expansion will require participants to review and uplift existing systems and to implement new data management and strategy practices. This is a legal and regulatory challenge, as much as it also a significant technical challenge.
If you have questions, or require assistance, in relation to how the proposed reforms to the Consumer Data Right may impact your business, please contact the Financial Services & Advisory team at HWL Ebsworth.