Guide to developing a Consumer Data Right policy

Download the print version

Introduction

All CDR entities must have and maintain a clearly expressed and up-to-date CDR policy.[3] A CDR policy must be a separate document to the general privacy policy.[4]

A ‘CDR entity’ is:

• a data holder of CDR data
• a designated gateway for CDR data, or
• an accredited person who is or who may become an accredited data recipient of CDR data.[5]

This Guide uses ‘accredited persons’ to refer to accredited persons who are or who may become an accredited data recipient, unless otherwise indicated.

A CDR policy is a document that provides information to consumers about:

• how CDR data is managed,[6] and
• how they can make an inquiry or make a complaint.[7]

It is a key tool for ensuring that CDR participants manage CDR data in an open and transparent way.

Privacy Safeguard 1 and CDR Rule 7.2 set out the requirements for what information must be included in a CDR policy, what form it should be in, and how it should be made available.

To help you meet these obligations, this Guide sets out a suggested process for developing a CDR policy and outlines the minimum requirements for what must be included.

There is also a checklist to help you work out if you have considered all your CDR policy obligations.

How the CDR policy interacts with other existing privacy and data protection policies

It is important to understand how your CDR policy interacts with your obligations under the Australian Privacy Principles (APPs) contained in the Privacy Act 1988, or other obligations (for example those under the European Union General Data Protection Regulation). the Privacy Act requires APP entities to have a clearly expressed and up-to-date APP Privacy Policy about how the entity manages personal information (APP 1.3 and 1.4).

Your CDR policy must be distinct from your APP Privacy Policy, or any other existing privacy policies.[8] This means your CDR policy must be a separate document and must expressly address each of the applicable matters listed in Privacy Safeguard 1 and CDR Rule 7.2. These matters are set out below in the section What information must be included in a CDR policy? For example, it would not be sufficient for a CDR entity to provide a link to its APP Policy to address how a consumer could make an inquiry or make a complaint (even where that APP policy includes identical or substantially similar complaint process information).

However, for CDR data that is also personal information, it may be appropriate for data holders to explain in a CDR policy when and how the APPs apply to that data. For example, a data holder should explain when and how the APP processes apply to access and correction of CDR data (see the Information on access to and correction of CDR data section below). In this situation, you may wish to link to other existing APP policies for further information on the APP process for handling CDR data.

Note: In addition to updating the CDR policy with information about the interaction between the CDR and APP requirements, it may be helpful to also update your APP policy so consumers are clear about what processes apply to CDR data and when.

Steps in developing a CDR policy

This section provides an overview of a suggested six-step process for developing your entity’s CDR policy.

These steps are intended to make it easier for you to meet your CDR policy obligations and to ensure that your CDR policy is genuinely informative and useful for consumers.

• Step 1: Understand your obligations and how you handle CDR data
• Step 2: Develop content, structure and presentation
• Step 3: Write your CDR policy
• Step 4: Test your CDR policy
• Step 5: Make the policy available
• Step 6: Review and update your policy.

Step 1: Understand your obligations and how you handle or intend to handle CDR data

The first key step in developing a CDR policy is to ensure you have a clear understanding of how you handle (or intend to handle) CDR data, including relevant practices, procedures and systems. This will assist you to accurately and openly describe to your consumers how you will handle CDR data and enable you to deal with inquiries, requests and complaints under the CDR system.

You must include the mandatory requirements set out below under the section What information must be included in a CDR policy?

You must also understand your broader CDR privacy obligations regarding the collection, use and disclosure of CDR data. This will differ based on whether you are a data holder, an accredited person, or a designated gateway.

Where your entity performs more than one role in the CDR system (for example as both a data holder and an accredited person), you may either have a single CDR policy that outlines how you handle CDR data in both capacities, or have separate CDR policies for each capacity.

Step 2: Develop content, structure and presentation

Although the CDR policy must cover all the topics in Privacy Safeguard 1 and CDR Rule 7.2, the information does not have to be presented in that order. You should aim to make the policy as easy as possible for the consumer to find the information that is most important to them.

Below are some tips to make the content and structure useful and manageable for consumers.

• Arrange the information in a way that makes sense so that it is easy to follow and intuitive to the reader. The presentation of the information should make sense and reflect your entity’s functions, activities and audience.
• Focus on key topics that consumers are likely to be most concerned about, unaware of, won’t reasonably expect or may not understand easily.
• Be as specific as possible about how your entity manages CDR data, as this will provide clarity and build trust. Unqualified use of vague words (such as ‘may’) could lead to concern about uses and disclosures that are not intended.
• Take a layered approach to providing information about how your entity will handle CDR data, by providing a summary version that focuses on what the consumer should know with a link to the complete CDR policy. This will be particularly effective in the online environment.

Step 3: Write your CDR policy

Once you have a clear idea of how your entity handles CDR data, what must be included in the CDR policy, and the proposed content and structure for your policy, you can begin drafting.

The CDR policy must be clearly expressed and up-to-date.[10] To ensure the CDR policy is easy to read and understand:

• Use an active voice and simple language — avoid legal jargon, acronyms and terms that may only be understood in-house
• Use short sentences, break up text into paragraphs and group relevant sections together
• Use headings to assist navigation
• Avoid unnecessary length — include only relevant information.

Step 4: Test your policy

Test your CDR policy on the target audience or audiences, including likely readers. Where your resources are limited and systematic testing is not possible, you could consider providing it to colleagues from other internal business units to give you an idea of how easy it is to read.

Step 5: Make the policy available

Your CDR policy must be freely and publicly available for consumers. If you are an accredited data recipient or data holder, the policy must be available through the online service that you ordinarily use to deal with consumers, such as your website or mobile applications.[12] Additionally, you must provide the CDR policy electronically or in hard copy if requested by the consumer (for example in a word document or pdf).[13]

Appropriate accessibility measures should also be put in place so that the policy may be accessed by all consumers (including consumers with a vision impairment, or those from a non-English speaking background). It is a good idea to provide information about how to request an accessible copy of the CDR policy, in the same locations where consumers can access the policy.

Once you become accredited, a hyperlink to your CDR policy will need to be included on the CDR Register.[14]

Step 6: Review and update your policy

As there is a requirement to ensure the CDR policy is to up-to-date, the CDR policy should be reviewed regularly. This will help to ensure that the information in the policy accurately reflects your current CDR handling practices.[15]

This review should, at a minimum, be undertaken as part of annual planning processes. To assist readers, you could also:

• include the date the policy was last reviewed or updated
• invite comments on the policy to gain feedback and evaluate its effectiveness, and
• explain how any comments will be dealt with.

What information must be included in a CDR policy?

Depending on whether you are an accredited person, data holder or designated gateway, there are different matters that need to be covered in your CDR policy.

Categories of information that must be included are:

• requirements for both data holders and accredited persons:
  • information about the consumer complaints process
  • information about access to and correction of CDR data
• specific requirements for data holders:
  • acceptance of voluntary consumer or product data requests
• specific requirements for accredited persons:
  • what CDR data is held, and how it is held
  • purposes CDR data is used for
  • information about undertaking general research
  • additional information about who CDR data may be disclosed to
  • overseas storage practices
  • when consumers will be notified about certain events
  • consequences of withdrawing consent
  • deletion of CDR data
  • de-identification of CDR data
• specific requirements for designated gateways:
  • facilitating disclosure or accruracy of CDR data
  • information about the complaints process.

The sections below cover each of these items in more detail. There is also a checklist at Attachment A below to help you work out whether you have considered all of the relevant requirements.

For further information, see Chapter 1 (Open and transparent management of CDR data) of the CDR Privacy Safeguard Guidelines.

Information about the consumer complaints process — for data holders and accredited persons

Both accredited persons and data holders must have a process to deal with consumer complaints, in the event that a consumer thinks you have not met your CDR related obligations under the Consumer and Competition Act and/or CDR Rules.[16]

The CDR Rules specify that the CDR policy needs to cover:

• where, how and when a complaint can be lodged
• when a consumer should expect an acknowledgment of their complaint
• the information that the consumer needs to provide
• the process for handling consumer complaints
• the time periods associated with the various stages of the complaints process
• options for redress
• options for review (both internally, if available) and externally.[17]

Information on access to and correction of CDR data — for data holders and accredited persons

How to access CDR data

Both accredited persons and data holders must include information for consumers about how they may access their CDR data.[18]

A data holder may receive a request from an accredited data recipient on the consumer’s behalf, or a consumer may make a request directly to the data holder.[19]

Where the data holder is also an Australian Privacy Principle (APP) entity under the Privacy Act, the data holder should provide information in its CDR policy about how a consumer may access their personal information (that is also CDR data) under APP 12.[20]

For further information about the CDR access requirements, see the Guide to privacy for data holders.

How to correct CDR data

Both accredited persons and data holders must include information for consumers about how they can correct their CDR data. The CDR policy should make clear that the consumer has a right to request correction of their CDR data.[21] For data holders, a consumer’s right to request correction under Privacy Safeguard 13 applies once the data holder has previously been required or authorised to disclose the CDR data.[22] Where a data holder is also an APP entity under the Privacy Act, the data holder should provide additional information in its CDR policy about how a consumer who is an individual may seek correction of their personal information that is also CDR data under APP 13.[23]

For information about the correction requirements, see Chapter 13 (Correction of CDR data) of the CDR Privacy Safeguard Guidelines and the Guide to privacy for data holders .

Specific requirements for data holders — acceptance of voluntary consumer or product data requests

In addition to the requirements set out above, a data holder’s CDR policy must:

• make clear whether the entity accepts voluntary consumer or product data requests[24] 
• state whether the data holder charges fees for such requests (and if so, how information about those fees can be obtained).[25]

Specific requirements for accredited persons

In addition to the requirements set out above, an accredited person’s CDR policy must include information about:

• what CDR data is held, and how it is held
• purposes CDR data is used for
• undertaking general research
• who CDR data may be disclosed to
• overseas storage practices
• when consumers will be notified about certain events
• consequences of withdrawing consent
• deletion of CDR data
• de-identification of CDR data.[26]

More detail on these requirements is set out below.

What CDR data is held, and how it is held

An accredited person’s CDR policy must refer to the different classes of CDR data that it holds or may hold. This includes CDR data that another entity holds or may hold on the accredited person’s behalf (for example, by an outsourced service provider).[27] The classes of CDR data for each sector will be set out in the relevant designation instrument. For example, for the banking sector the designation instrument sets out three classes of information: customer information, product use information and information about the product.[28]

The CDR policy must also set out how the CDR data is held. This means providing general information about how data is stored.[29]

Purposes CDR data is used for

An accredited person must indicate the purposes for which they collect, hold, use or disclose CDR data with the consumer's consent.[30]

Undertaking general research

If an accredited data recipient wishes to undertake general research[31] using de-identified CDR data, their CDR Policy must include:

• a description of the research to be conducted
• a description of any additional benefit to be provided to the consumer for consenting to the use.

Who CDR data may be disclosed to

An accredited person must include further specific information about their disclosures of CDR data to outsourced service providers, non-accredited entities and entities located overseas, as set out below.[32]

Disclosures to outsourced service providers and non-accredited entities

Disclosures to outsourced service providers (OSPs): An accredited data recipient must provide:

• a list of all the outsourced service providers to whom information may be disclosed (whether based in Australia or overseas, and whether they are accredited or not) [33],
• specific details about the nature of the services provided by these OSPs (for example, where an accredited OSP is collecting CDR data on the accredited data recipient’s behalf)[34]
• the CDR data or classes of CDR data that may be disclosed to these OSPs.[35]

Disclosures to any non-accredited entities (including OSPs): If an accredited person intends to disclose data to any non-accredited entity, they must include the circumstances in which the accredited person intends to disclose such data.[36]

Disclosures to entities located overseas

Disclosures to any overseas accredited data recipients: If an accredited person is likely to disclose data to any overseas accredited data recipients, the CDR policy must state this fact,[37] and must also include the countries where they are likely to be located, where practicable.[38] If there are numerous countries where CDR data may be disclosed, one option would be to list those countries in an appendix or linked document. If it is impractical to list countries, the CDR policy could instead provide general regions.

Disclosures to any overseas, non-accredited OSPs: If an accredited person is likely to disclose to any overseas-based, non-accredited OSPs, the CDR policy must include the countries where there are likely to be based in the CDR policy, where practicable.[39] If there are numerous countries where CDR data may be disclosed, one option would be to list those countries in an appendix or linked document. If it is impractical to list countries, the CDR policy could instead provide general regions.

Overseas storage practices

Where an accredited data recipient proposes to store CDR data outside of Australia or an external territory, it must specify the countries where it proposes to store the data in the policy.[40]

When consumers will be notified about certain events

An accredited person’s CDR policy must specify the events it will notify the consumer about, in relation to their CDR data.[41]

The events that an accredited person is required to notify the consumer about include:

• when a consumer gives consent to the person collecting, using and/or disclosing their CDR data[42]
• when a consumer amends[43] or withdraws consent[44]
• collection of a consumer’s CDR data[45]
• disclosure of a consumer’s CDR data to an accredited person[46]
• ongoing notification requirements about a consumer’s consent[47]
• notification requirements in relation to the expiry or amending of a consumer’s consent[48]
• responses to a consumer’s correction request[49]
• any eligible data breaches affecting a consumer under the Notifiable Data Breach Scheme.[50]

Consequences of withdrawing consent

An accredited data recipient must provide a statement in the CDR policy indicating the consequences for the consumer of withdrawing their consent to collect and use CDR data.[51] This may include the details of any early cancellation fees.

Deletion of CDR data

An accredited data recipient has obligations to destroy or delete or de-identify any redundant CDR data that they hold under Privacy Safeguard 12 and the CDR Rules.

Consequently, an accredited data recipient must include the following information about the deletion of redundant CDR data in their CDR policy:

• When redundant data is deleted.[52] An accredited data recipient may be required to delete redundant data, including where:
  • the consumer has elected for their redundant data to be deleted[53]
  • the general policy is to delete redundant data,[54] or
  • it is not possible to de-identify CDR data to the required extent. [55]
• Elections to delete redundant data. An accredited data recipient must include information about:
  • how a consumer may elect for their redundant data to be deleted[56]
  • how the election operates
  • the effect of an election
  • how a consumer may exercise their election.[57]
• How redundant data is deleted.[58]

An accredited data recipient should include a general description of how redundant data is deleted in a way that is helpful and meaningful to the consumer.

De-identification of CDR data

An accredited data recipient must include the following information about the de-identification of CDR data in their policy:

• The circumstances in which CDR data is de-identified in accordance with a consumer’s request.[59]
• For an accredited data recipient, the following information must be included about de-identification of CDR data that is not redundant,:[60]
  • how de-identified CDR data is used to provide goods or services to consumers[61]
  • the process for de-identification including, a description of techniques that are used to de-identify CDR data,[62]and
  • if de-identified CDR data is ordinarily disclosed to one or more persons:
    • the fact of this disclosure
    • the classes of persons to whom such data is ordinarily disclosed[63]
    • the purposes for which de-identified CDR data is disclosed.[64]

For an accredited data recipient, the following information about de-identification of redundant CDR data must be included:[65]

• How the entity ordinarily uses any de-identified redundant data, including examples:
• the process for de-identification, including a description of techniques that are used to de-identify CDR data[66]
• if de-identified redundant data is ordinarily disclosed (by sale or otherwise) to one or more persons:
  • the fact of this disclosure
  • the classes of person to whom such data is ordinarily disclosed[67]
  • the purposes for which the de-identified data is disclosed. [68]

Specific requirements for designated gateways

A designated gateway’s CDR policy must provide details about how a consumer can make a complaint in the event that they think the designated gateway has not met its CDR related obligations under the Consumer and Competition Act and/or CDR Rules. The CDR policy must also set out how the designated gateway will deal with these complaints.[69]

Designated gateways must also include information about how they will facilitate the disclosure or ensure the accuracy of CDR data, and any other matters set out under the CDR Rules.[70]

Note: There are no designated gateways in the banking sector.

Attachment A — Checklist for your CDR policy

General — for all participants

Data holders

Accredited persons

Designated gateways