Treasury has released an updated timetable for Open Banking in conjunction with ACCC’s release of the Consumer Data Right Rules Outline, CSIRO’s Data61 draft technical standards and a Draft Privacy Impact Assessment.

Consumer Data Right Rules Outline

The Australian Competition and Consumer Commission (ACCC) has released the Consumer Data Right Rules outline for Open Banking. Background.

The rules detail the principles with which Open Banking participants will need to comply.

They follow Treasury’s release of the latest draft Consumer Data Right legislation and explanatory memorandum. Background.

Revised timeline

Parliament has adjourned until 12 February 2019 without the Bill being introduced. It is not clear whether the Bill will be introduced and passed before an election.

The Rules Outline reflects the revised commencement schedule for both the four major banks and regional banks and mutuals (see below) with 1 July 2019 being the date for product reference (generic) data being made publicly available and 1 February 2020 the date by which the remaining obligations to share the first tranche of consumer data will commence. The Rules Outline highlights a number of areas where the ACCC is further considering the implications of the revised timeline for the scope of version one of the Rules.

The positions in the Rules Outline assume that the Bill will be passed in the first quarter of 2019. The Rules Outline is intended to provide guidance to stakeholders, including designated data holders, potential data recipients, and consumers, on what version one of the Rules will require of CDR participants.

Technical standards

The standards body, CSIRO’s Data61, has also released a second draft of technical standards that banks will be required to meet for the sharing of data with consumers.

Draft Privacy Impact Assessment – Consumer Data Right

Treasury has prepared a first version of the Privacy Impact Assessment (PIA) for the Consumer Data Right (CDR), in accordance with the Privacy (Australian Government Agencies – Governance) APP Code 2017.

The Consumer Data Right impacts upon privacy in two primary ways:

• The right of an individual to access data about themselves is recognised to be a core privacy right. The Consumer Data Right grants additional access rights to those contained in Australian Privacy Principle 12, in relation to designated datasets. This new access right has greater functionality, more security and may apply to different kinds of data than existing privacy rights.
• The Consumer Data Right also enables individuals to give direct access to their data to third parties. This may also be considered to be an extension of privacy rights. Additionally, in relation to this third-party data access, the reforms impose an enhanced privacy framework beyond that which would ordinarily apply, directed at preventing inappropriate collection, disclosure, holding and use of data.

Consumer Data Right Revised Timeline