As part of the initiative to facilitate Open Banking in Australia, the Treasury Laws Amendment (Consumer Data Right) Act 2019 passed into law on 1 August 2019. Open Banking involves opening up the use of banking customer data to third party providers to provide customers with new or enhanced financial services. It was pioneered in the United Kingdom by the regulatory actions of the UK competition authority.
The amending Australian legislation, which will be enforced by the Australian Competition and Consumer Commission (ACCC), amends the Competition and Consumer Act 2010 and the Privacy Act 1988 to introduce a new Consumer Data Right (CDR). This CDR is designed to unlock certain consumer data held by banks so that banking customers may permit this banking data to be shared with third party recipients.
The CDR was initially conceived in March 2017 by the Data Availability and Use Report published by the Productivity Commission. Open Banking and the portability of customer data within the banking centre was recommended by the Review into Open Banking in Australia 2017, commissioned by the Treasurer. This Review recommended the implementation of Open Banking through a CDR framework. This approach differs to how Open Banking developed in the United Kingdom which occurred as a result of regulatory enforcement by the UK Competition and Markets Authority to force established banks to share customer data to encourage account switching and third party competition.
The CDR provides a framework for consumers to obtain information about themselves and products that they use from existing service providers such as banks. It provides a mechanism for consumers to then direct their service providers to share that information to other potential third party service providers. The customer data may relate to a wide range of products and will include, for example, mortgages and credit/debit cards.
CDR legislation also allows consumers to provide disclosed information to “accredited persons” for use subject to privacy safeguards. Privacy standards are provided for in Part IVD of the CCA and include, amongst other things, mandatory notification upon collection of data as well as open and transparent management of consumer data.
Additionally, data will be directly available for access by accredited persons to the extent that such information is about goods and does not relate to any identifiable consumers. Through the use of Application Programming Interfaces (APIs) in data transfer, a seamless and open network of information will be available to new financiers and FinTech firms.
The passing of CDR legislation follows the initial phase of data portability from 1 July 2019, in which the big four banks voluntarily provided access to product data for credit and debit cards, deposit accounts and transaction accounts. The next key phase for Open Banking is scheduled for February 2020. At that time, banks will be required to grant consumers access to product/consumer data for mortgage accounts and will also make the permitted sharing of data regarding credit and debit cards, deposit accounts and transaction accounts compulsory.
Several important legal and practical challenges remain. Key issues include determining the specific requirements of an entity becoming an “accredited data recipient” of consumer data, the impact of data breaches and cyber-attacks on an accredited data recipient’s status as well as the overall costs of regulatory and technological advancements and upkeep required to maintain relevant privacy standards.
Despite these legal and practical changes, the introduction of the CDR is a significant regulatory development which is expected to increase competition in the Australian retail banking market. Existing traditional banks may face new market entrants who’s digital offerings utilise Open Banking to provide new value-added services to banking customers. For established market players, the development of Open Banking may also provide an incentive to innovate and update existing customer-facing services in the evolving financial services industry.