Guide to developing a Consumer Data Right policy

Introduction

All CDR entities must have and maintain a clearly expressed and up-to-date CDR policy.[4] A CDR policy must be a separate document to the general privacy policy.[5]

For this Guide, a ‘CDR entity’ is:

• a data holder of CDR data (other than AEMO)
• a designated gateway for CDR data, or
• an accredited person who is or who may become an accredited data recipient of CDR data.[6]

This Guide uses ‘accredited persons’ to refer to accredited persons who are or who may become an accredited data recipient, unless otherwise indicated.

A CDR policy is a document that provides information to consumers about:

• how CDR data is managed,[7] and
• how they can make an inquiry or make a complaint.[8]

It is a key tool for ensuring that CDR participants manage CDR data in an open and transparent way.

Privacy Safeguard 1 and CDR Rule 7.2 set out the requirements for what information must be included in a CDR policy, what form it should be in, and how it should be made available.

To help you meet these obligations, this Guide sets out a suggested process for developing a CDR policy and outlines the minimum requirements for what must be included.

There is also a checklist to help you work out if you have considered all your CDR policy obligations.

How the CDR policy interacts with other existing privacy and data protection policies

It is important to understand how your CDR policy interacts with your obligations under the Australian Privacy Principles (APPs) contained in the Privacy Act 1988 (Privacy Act), or other obligations (for example, those under the European Union General Data Protection Regulation). The Privacy Act requires APP entities to have a clearly expressed and up-to-date APP Privacy Policy about how the entity manages personal information (APP 1.3 and 1.4).

Your CDR policy must be distinct from your APP Privacy Policy, or any other existing privacy policies.[9] This means your CDR policy must be a separate document and must expressly address each of the applicable matters listed in Privacy Safeguard 1 and CDR Rule 7.2. These matters are set out below in the section What information must be included in a CDR policy? For example, it would not be sufficient for a CDR entity to provide a link to its APP Privacy Policy to address how a consumer could make an inquiry or make a complaint (even where that APP Privacy Policy includes identical or substantially similar complaint process information).

However, for CDR data that is also personal information, it may be appropriate for data holders to explain in a CDR policy when and how the APPs apply to that data. For example, a data holder should explain when and how the APP processes apply to access and correction of CDR data (see the Information on access to and correction of CDR data section below). In this situation, you may wish to link to other existing APP Privacy Policies for further information on the APP process for handling CDR data.

Note: In addition to updating the CDR policy with information about the interaction between the CDR and APP requirements, it may be helpful to also update your APP Privacy Policy so consumers are clear about what processes apply to CDR data and when.

Steps in developing a CDR policy

This section provides an overview of a suggested six-step process for developing your entity’s CDR policy.

These steps are intended to make it easier for you to meet your CDR policy obligations and to ensure that your CDR policy is genuinely informative and useful for consumers.

• Step 1: Understand your obligations and how you handle CDR data
• Step 2: Develop content, structure and presentation
• Step 3: Write your CDR policy
• Step 4: Test your CDR policy
• Step 5: Make your CDR policy available
• Step 6: Review and update your CDR policy

Step 1: Understand your obligations and how you handle or intend to handle CDR data

The first key step in developing a CDR policy is to ensure you have a clear understanding of how you handle (or intend to handle) CDR data. This includes understanding relevant practices, procedures and systems, and the other parties you may have arrangements with, such as outsourced service providers or CDR representatives. This will assist you to accurately and openly describe to your consumers how you will handle CDR data and enable you to deal with inquiries, requests and complaints under the CDR system.

You must include the mandatory requirements set out below under the section What information must be included in a CDR policy?

You must also understand your broader CDR privacy obligations regarding the collection, use and disclosure of CDR data. This will differ based on whether you are a data holder, an accredited person, or a designated gateway.

Where your entity performs more than one role in the CDR system (for example, as both a data holder and an accredited person), you may either have a single CDR policy that outlines how you handle CDR data in both capacities, or have separate CDR policies for each capacity.

Step 2: Develop content, structure and presentation

Although the CDR policy must cover all the topics in Privacy Safeguard 1 and CDR Rule 7.2, the information does not have to be presented in that order. You should aim to make the CDR policy as easy as possible for the consumer to find the information that is most important to them.

Below are some tips to make the content and structure useful and manageable for consumers.

• Arrange the information in a way that makes sense so that it is easy to follow and intuitive to the reader. The presentation of the information should be clear and reflect your entity’s functions, activities and audience.
• Focus on key topics that consumers are likely to be most concerned about, unaware of, won’t reasonably expect or may not understand easily.
• Be as specific as possible about how your entity manages CDR data, as this will provide clarity and build trust. Unqualified use of vague words (such as ‘may’) could lead to concern about uses and disclosures that are not intended.
• Take a layered approach to providing information about how your entity will handle CDR data, by providing a summary version that focuses on what the consumer should know with a link to the complete CDR policy. This will be particularly effective in the online environment.

Step 3: Write your CDR policy

Once you have a clear idea of how your entity handles CDR data, what must be included in the CDR policy, and the proposed content and structure for your policy, you can begin drafting.

The CDR policy must be clearly expressed and up-to-date.[11] To ensure the CDR policy is easy to read and understand:

• use an active voice and simple language — avoid legal jargon, acronyms and terms that may only be understood in-house
• use short sentences, break up text into paragraphs and group relevant sections together
• use headings to assist navigation
• avoid unnecessary length — include only relevant information.

Step 4: Test your CDR policy

Test your CDR policy on the target audience or audiences, including likely readers. Where your resources are limited and systematic testing is not possible, you could consider providing it to colleagues from other internal business units to give you an idea of how easy it is to read.

Step 5: Make the CDR policy available

Your CDR policy must be freely and publicly available for consumers. If you are an accredited person or data holder, the CDR policy must be available through each online service that you ordinarily use to deal with consumers, such as your website or mobile applications.[13] Additionally, you must provide the CDR policy electronically (for example in a word document or pdf) or in hard copy if requested by the consumer.[14] If you are an accredited person with one or more CDR representatives, your CDR policy must also be available through each online service that your CDR representatives ordinarily use to deal with consumers.[15]

Appropriate accessibility measures should also be put in place so that the CDR policy may be accessed by all consumers (including consumers with a vision impairment, or those from a non-English speaking background). It is a good idea to provide information about how to request an accessible copy of the CDR policy in the same locations where consumers can access the policy.

Once you become accredited, a hyperlink to your CDR policy will need to be included on the CDR Register.[16]

Step 6: Review and update your CDR policy

As there is a requirement to ensure the CDR policy is to up-to-date, the CDR policy should be reviewed regularly. This will help to ensure that the information in the CDR policy accurately reflects your current CDR data handling practices.[17]

This review should, at a minimum, be undertaken as part of annual planning processes. To assist readers, you could also:

• include the date the CDR policy was last reviewed or updated
• invite comments on the CDR policy to gain feedback and evaluate its effectiveness, and
• explain how any comments will be dealt with.

What information must be included in a CDR policy?

Depending on whether you are an accredited person, data holder or designated gateway, there are different matters that need to be covered in your CDR policy.

Categories of information that must be included are:

• Requirements for both data holders and accredited persons:
  • Information about the consumer complaints process
  • Information about access to and correction of CDR data
• Specific requirements for data holders:
  • Acceptance of voluntary consumer or product data requests
• Specific requirements for accredited persons:
  • What CDR data is held, and how it is held
  • Purposes CDR data is used for
  • Information about undertaking general research
  • Additional information about who CDR data may be disclosed to
  • Overseas storage practices
  • When consumers will be notified about certain events
  • Consequences of withdrawing consent
  • Deletion of CDR data
  • De-identification of CDR data
  • Information about sponsorship arrangements
  • Information about CDR representative arrangements, and
  • Information about CDR outsourcing arrangements.
• Specific requirements for designated gateways:
  • Facilitating disclosure or accuracy of CDR data
  • Information about the complaints process

The sections below cover each of these items in more detail. There is also a checklist at Attachment A below to help you work out whether you have considered all of the relevant requirements.

For further information, see Chapter 1 (Open and transparent management of CDR data) of the CDR Privacy Safeguard Guidelines.

Information about the consumer complaints process — for data holders and accredited persons

Both accredited persons and data holders must have a process to deal with consumer complaints, in the event that a consumer thinks you have not met your CDR related obligations under the Competition and Consumer Act and/or CDR Rules.[18]

The CDR Rules specify that the CDR policy needs to cover:

• where, how and when a complaint can be lodged
• when a consumer should expect an acknowledgment of their complaint
• the information that the consumer needs to provide
• the process for handling consumer complaints[19]
• the time periods associated with the various stages of the complaints process
• options for redress,[20] and
• options for review both internally (if available) and externally.[21]

Information on access to and correction of CDR data — for data holders and accredited persons

How to access CDR data

Both accredited persons and data holders must include information for consumers about how they may access their CDR data.[22]

A data holder may receive a request from an accredited person on the consumer’s behalf, or a consumer may make a request directly to the data holder.[23]

A data holder that is a retailer in the energy sector must also ensure that its CDR policy explains how a consumer can access their AEMO data.[24]

Where the data holder is also an APP entity under the Privacy Act, the data holder should provide information in its CDR policy about how a consumer may access their personal information (that is also CDR data) under APP 12.[25]

For further information about the CDR access requirements, see the Guide to privacy for data holders.

How to correct CDR data

Both accredited persons and data holders must include information for consumers about how they can correct their CDR data. The CDR policy should make clear that the consumer has a right to request correction of their CDR data.[26] For data holders, a consumer’s right to request correction under Privacy Safeguard 13 applies once the data holder has previously been required or authorised to disclose the CDR data.[27] Where a data holder is also an APP entity under the Privacy Act, the data holder should provide additional information in its CDR policy about how a consumer who is an individual may seek correction of their personal information that is also CDR data under APP 13.[28]

A data holder that is a retailer in the energy sector must also ensure that its CDR policy explains how a CDR consumer can correct their AEMO data.[29]

For information about the correction requirements, see Chapter 13 (Correction of CDR data) of the CDR Privacy Safeguard Guidelines and the Guide to privacy for data holders.

Specific requirements for data holders — acceptance of voluntary consumer or product data requests

In addition to the requirements set out above, a data holder’s CDR policy must:

• make clear whether the entity accepts voluntary consumer or product data requests,[30] and
• state whether the data holder charges fees for such requests (and if so, how consumers can obtain information about those fees).[31]

Specific requirements for accredited persons

In addition to the requirements set out above, an accredited person’s CDR policy must include information about:

• what CDR data is held, and how it is held
• purposes for which CDR data is collected, held, used and disclosed
• undertaking general research
• who CDR data may be disclosed to
• overseas data storage practices
• when consumers will be notified about certain events
• consequences of withdrawing consent
• deletion of CDR data
• de-identification of CDR data[32]
• information about sponsorship arrangements
• information about CDR representative arrangements, and
• information about CDR outsourcing arrangements.

More detail on these requirements is set out below.

What CDR data is held, and how it is held

An accredited person’s CDR policy must refer to the different classes of CDR data that it holds or may hold. This includes CDR data that another entity holds or may hold on the accredited person’s behalf (for example, by an outsourced service provider).[33] The classes of CDR data for each sector will be set out in the relevant designation instrument. For example, for the banking sector the designation instrument sets out 3 classes of information: customer information, product use information and information about the product.[34] For the energy sector, the designation instrument sets out 4 classes of information: information about a customer or associate, information about the sale or supply of electricity, information about retail arrangements, and information about retail arrangements (natural gas).[35]

The CDR policy must also set out how the CDR data is held. This means providing general information about how data is stored.[36]

Purposes for which CDR data is collected, held, used and disclosed

An accredited person must indicate the purposes for which it does each of the following (with the consumer’s consent): collects, holds, uses or discloses CDR data.[37]

Undertaking general research

If an accredited person wishes to undertake general research[38] using de-identified CDR data, its CDR policy must include:

• a description of the research to be conducted, and
• a description of any additional benefit to be provided to the consumer for consenting to the use.

Who CDR data may be disclosed to

An accredited person must include further specific information about its disclosures of CDR data to outsourced service providers, non-accredited entities and entities located overseas, as set out below.[39]

Disclosures to outsourced service providers and non-accredited entities:

• Disclosures to outsourced service providers: Where an accredited person may disclose CDR data to an outsourced service provider, it must include the CDR data or classes of CDR data that may be disclosed to these outsourced service providers.[40][41]
• Disclosures to any non-accredited entities (including non-accredited outsourced service providers):If an accredited person intends to disclose CDR data to any non-accredited entity, it must include the circumstances in which the accredited person intends to disclose such data. [42] Disclosures to non-accredited entities include disclosures:
  • to unaccredited outsourced service providers
  • to CDR representatives with whom the accredited person has a CDR representative arrangement[43]
  • to trusted advisers with a TA disclosure consent,[44] and
  • of CDR insights to specified persons with an insight disclosure consent.[45]

Disclosures to entities located overseas:

• Disclosures to any overseas accredited persons: If an accredited person is likely to disclose CDR data to any overseas accredited persons,the CDR policy must state this fact,[46] and must also include the countries where they are likely to be located, where practicable.[47] If there are numerous countries where CDR data may be disclosed, one option would be to list those countries in an appendix or linked document. If it is impractical to list countries, the CDR policy could instead provide general regions.
• Disclosures to any overseas, non-accredited outsourced service providers: If an accredited person is likely to disclose CDR data to any overseas-based, non-accredited outsourced service providers, the CDR policy must include the countries where they are likely to be based, where practicable.[48] If there are numerous countries where CDR data may be disclosed, one option would be to list those countries in an appendix or linked document. If it is impractical to list countries, the CDR policy could instead provide general regions.

Overseas data storage practices

If an accredited person proposes to store CDR data outside of Australia or an external territory, it must specify the countries where it proposes to store the data in the CDR policy.[49]

When consumers will be notified about certain events

An accredited person’s CDR policy must specify the events it will notify the consumer about, in relation to their CDR data.[50]

The events that an accredited person is required to notify the consumer about include:

• when a consumer gives consent to the person collecting, using and/or disclosing their CDR data[51]
• when a consumer amends[52] or withdraws consent[53]
• collection of a consumer’s CDR data[54]
• disclosure of a consumer’s CDR data to an accredited person[55]
• ongoing notification requirements about a consumer’s consent[56]
• notification requirements in relation to the expiry of a consumer’s consent[57]
• responses to a consumer’s correction request,[58] and
• any eligible data breaches affecting a consumer under the Notifiable Data Breach Scheme.[59]

Consequences of withdrawing consent

An accredited person must provide a statement in the CDR policy indicating the consequences for the consumer of withdrawing their consent to collect and use CDR data.[60] This may include the details of any early cancellation fees or loss of access to goods or services based on CDR data.

Deletion of CDR data

An accredited data recipient has obligations to destroy or de-identify any redundant CDR data that it holds under Privacy Safeguard 12 and the CDR Rules.

An accredited person must include the following information about the deletion of redundant CDR data in its CDR policy:

• When redundant CDR data is deleted.[61] An accredited data recipient may be required to delete redundant CDR data, including where:
  • the consumer has elected for their redundant CDR data to be deleted[62]
  • the general policy is to delete redundant CDR data,[63] or
  • it is not possible to de-identify CDR data to the required extent.[64]
• Elections to delete CDR redundant data. An accredited person must include information about:
  • how a consumer may elect for their redundant CDR data to be deleted[65]
  • how the election operates
  • the effect of an election, and
  • how a consumer may exercise their election.[66]
• How redundant CDR data is deleted.[67]
  • An accredited person should include a general description of how redundant CDR data is deleted in a way that is helpful and meaningful to the consumer.[68]

De-identification of CDR data

An accredited person must include the following information about the de-identification of CDR data in its CDR policy:

• The circumstances in which CDR data is de-identified in accordance with a consumer’s request.[69]
• The following information about de-identification of CDR data that is not redundant:[70]
  • how de-identified CDR data is used to provide goods or services to consumers[71]
  • the process for de-identification including, a description of techniques that are used to de-identify CDR data,[72] and
  • if de-identified CDR data is ordinarily disclosed to one or more persons:
    • the fact of this disclosure
    • the classes of persons to whom such data is ordinarily disclosed,[73] and
    • the purposes for which de-identified CDR data is disclosed.[74]
• The following information about de-identification of redundant CDR data:[75]
  • how the entity ordinarily uses any de-identified redundant CDR data, including examples
  • the process for de-identification, including a description of techniques that are used to de-identify CDR data,[76] and
  • if de-identified redundant CDR data is ordinarily disclosed (by sale or otherwise) to one or more persons:
    • the fact of this disclosure
    • the classes of person to whom such data is ordinarily disclosed,[77] and
    • the purposes for which the de-identified data is disclosed.[78]

Information about sponsorship arrangements

An accredited person must ensure that its CDR policy sets out:

• if the accredited person is a sponsor, a list of affiliates with whom the sponsor has a sponsorship arrangement, and the nature of the services one party provides to the other under each arrangement, and
• if the accredited person is an affiliate, a list of sponsors with whom the affiliate has a sponsorship arrangement, and the nature of the services one party provides to the other party under each arrangement.[79]

Information about CDR representative arrangements

Where an accredited person is a CDR principal under a CDR representative arrangement, its CDR policy must include:

• a list of its CDR representatives
• for each CDR representative, the nature of the goods and services that the CDR representative provides to customers using CDR data.[80]

Information about CDR outsourcing arrangements

Where an accredited person has one or more CDR outsourcing arrangements with outsourced service providers, its CDR policy must include:

• a list of its outsourced service providers (whether based in Australia or overseas, and whether they are accredited or not)[81]
• specific details about the nature of the services provided by these outsourced service providers (for example, where an outsourced service provider is collecting CDR data on the accredited person’s behalf)[82]
• the CDR data or classes of CDR data that may be disclosed to, or collected by, these outsourced service providers.[83]

Specific requirements for designated gateways

A designated gateway’s CDR policy must provide details about how a consumer can make a complaint in the event that they think the designated gateway has not met its CDR related obligations under Part IVD of the Competition and Consumer Act and/or CDR Rules. The CDR policy must also set out how the designated gateway will deal with these complaints.[84]

Designated gateways must also include information about how they will facilitate the disclosure or ensure the accuracy of CDR data, and any other matters set out under the CDR Rules.[85]

Note: There are currently no designated gateways in the banking sector or the energy sector.

Attachment A — Checklist for your CDR policy

General — for all participants

Data holders

Accredited persons

Designated gateways