Inquiry into Future Directions for the Consumer Data Right – Issues Paper — submission to Treasury

Potential expansions to read access

The Issues Paper considers a range of potential options that could expand the current scope of ‘read access’ functionality, which describes any process where a consumer can transfer CDR data to a trusted third party, which can be read but not modified.[5]

The OAIC understands that the Inquiry will consider a range of issues, including a standard ‘consent taxonomy’, expanding the types of CDR participants and service providers in the CDR system, and how a tiered accreditation model may support this. In view of the broad range of matters raised regarding read access, the OAIC’s comments are focussed on the privacy impacts associated with enabling greater participation and tiered accreditation, as these would likely have a significant impact on the existing privacy framework within the CDR system.

Expanding participation to non-accredited third parties

The OAIC recognises that expanding the types of actors that can participate in the CDR system may enable greater participation from interested parties, potentially promoting innovation and allowing new products and services to be offered to consumers. However, any such expansion of the CDR system should also maintain the strong privacy protections and safeguards that currently exist within the system.

The existing protections reflect the sensitive nature of CDR data and are designed to prevent misuse of the data and build consumer trust in the system. For example, a central privacy protection of the system is the accreditation framework, which promotes trust by requiring entities to satisfy a range of accreditation criteria, prior to the transfer of any consumer data.

The OAIC would therefore caution against an expansion of the CDR system to allow non-accredited third parties to participate, unless there are compelling policy reasons to allow data transfers to such parties, and adequate mitigation strategies can be put in place to address the associated privacy risks.

Tiered accreditation

To reduce the risks associated with wider participation in the CDR framework, the Issues Paper considers introducing tiered levels of accreditation.[6] The OAIC understands that tiered accreditation would reduce barriers to entry, as some entities may find the full accreditation requirements financially and technologically burdensome. Under a tiered accreditation system, entities could instead comply with a lower level of accreditation requirements, accompanied by risk-based restrictions on access and use.

The OAIC recommends that any changes to accreditation requirements should be carefully tailored to mitigate the risks posed by the specific data handling activities of the relevant entities, and in a way that ensures the privacy and security risks are managed consistently across the scheme and that the overall integrity of the CDR system is maintained.

Consumers directly accessing their own CDR data

The Issues Paper notes that as the CDR system evolves, consumers will be provided with greater opportunities to have control over and access to their own data.[7] In principle the OAIC supports consumers having the ability to directly access their own data. Providing consumers with increased access to their own data is consistent with fundamental privacy principles.

However, the OAIC is aware that there may be risks associated with providing access directly to consumers. Given the sensitivity of CDR data, this may increase the security and privacy risks for a consumer, if they were to provide such data to an unaccredited third party, outside the protection of the CDR framework. The risks are likely greater for vulnerable consumers, who may be incentivised or pressured by malicious actors into disclosing their sensitive CDR data. In addition, in the absence of restrictions entities may request access to an individual’s CDR data, effectively making this a pre-requisite for the provision of goods or services.

While the CDR Rules currently provide that a consumer can make a request for access to their own CDR data, the relevant standards have not been developed to enable this.[8] The OAIC supports this approach for the early implementation phase. However, we recommend that careful consideration should be given to how direct access could be facilitated in future, and in particular what privacy risk mitigation strategies need to be put in place to protect consumers and retain consumer trust.

One potential mitigation strategy may be to introduce restrictions on certain types of non-CDR entities asking consumers to provide their CDR data. This would build on a similar approach under Part IIIA of the Privacy Act, which prohibits all entities except credit providers from requesting direct access to an individual’s credit report from a credit reporting body (excluding all others from access, importantly real estate agents, landlords, employers, and insurance companies).[9]

Privacy Act coverage for all CDR entities

Given the sensitivity of CDR data, and the potential for any expansions to the CDR system to result in more complex data flows between and within entities, it is critical that there are privacy protection and governance mechanisms in place for all of the personal information which may be handled by CDR entities.

The OAIC considers that all entities participating in the CDR system should be bound by the Privacy Act in relation to all personal information held by the entity, including personal information that is not CDR data. While the CDR system has extended the protection of the Privacy Act in this way to accredited persons (via s 6E(1D) of the Privacy Act), there is no equivalent provision for other entities that handle CDR data. While many of these entities (such as data holders) are likely to be subject to the Privacy Act already, some entities may not be where they are small businesses.[10]

The OAIC therefore recommends that s 6E(1D) of the Privacy Act be expanded so that all data holders, designated gateways, outsourced service providers and any other entities which may participate in the CDR system in future are bound by the Privacy Act in relation to any personal information that is not CDR data. Extending coverage in this way will ensure that there is a baseline level of protection for the handling of personal information in all CDR entities. Further, the OAIC recommends that accredited persons at all future potential tier levels should be subject to the Privacy Act, which will help to retain consumer trust in the CDR system.

Leveraging international developments

The Issues Paper notes that the Inquiry presents the opportunity to increase interoperability between Australian and international jurisdictions, in relation to data portability and open banking frameworks. Interoperability does not mean uniformity – but rather recognises the differences in regulatory frameworks and provides a bridge to ensure that information is protected, regardless of where it flows.

In particular, the Issues Paper notes the recent developments in several international data portability and open banking regimes, including the United Kingdom’s Open Banking regime and the European Union’s Payment Services Directive 2, but also emerging regimes in Singapore, Hong Kong and Canada.[11]

Given the global nature of data flows, the OAIC is actively engaged in a range of international privacy and data protection forums, ensuring shared expertise and cooperation on cross-border privacy matters, including through the Global Privacy Assembly.[12] One of the key objectives in forging these and other international partnerships is to enhance the interoperability of Australia’s privacy regime with the various data protection frameworks around the world. The OAIC is therefore supportive of the Inquiry’s focus on leveraging developments and experiences from other jurisdictions, and would welcome the opportunity to be consulted further and assist on these issues as policy developments progress.

In the OAIC’s view, one key area for further assessment and consideration would be the United Kingdom and European Union’s prohibition of unsafe online practices (such as screen scraping by non-accredited third parties), and how this could be leveraged to assist with future developments in the CDR.