The Data Availability and Use Report of the Productivity Commission, released yesterday, recommends the introduction of a "Comprehensive Right" right for consumers to access their "consumer data" or direct that it be provided to third parties.
The Comprehensive Right could be utilised by bank customers to require their bank to send transaction and other account data to a competitor (such as a FinTech provider), who could use it to price alternative financial services.
The Commission recommends that this be done through a new Data Sharing and Release Act which would:
- give participants in individual industries the capacity to determine what data constitutes "consumer data" relevant to their industry, via a data-specification agreement. The Productivity Commission expects that these agreements would also articulate transfer mechanisms, security of data measures and the requirements necessary to authenticate a consumer request prior to any data transfer; and
- if there is no agreement in a particular industry, the holders of "consumer data" in that industry will be required to provide it to consumers or third parties in "machine-readable form". Significantly, the Commission rejected the approach of mandating the development of an API, concluding that as long as data is transferred in a machine readable form, the industry should be free to determine how data is transferred.
The Commission suggested that 12 months should be a sufficient transitional period after the legislation comes into effect to give data holders the ability to adapt systems, and for the data-specification and standards-setting process to work.
The Commission proposed that the ACCC be given broad oversight and complaints handling functions relating to the use of the Comprehensive Right, including approving and registering industry data specification agreements and standards. It rejected the suggestion that data sharing be regulated by Privacy regulators on the basis that privacy is merely one aspect of data use, not the preeminent aspect.
The AFR (8 May 2017) has quoted Treasurer Scott Morrison as "hinting strongly" that the Government will give banking customers power over their own data so that they can shop around for a better deal from other financial institutions.
The Commission acknowledges that open questions still remain, such as the precise nature of information that forms part of consumer data (particularly imputed information) and liability issues for data breaches in the context of these obligations.
In addition, the Productivity Commission recommended that if a minimum target for voluntary participation in comprehensive credit reporting of 40% of all active credit accounts is not achieved by 30 June 2017, the Government should mandate participation in comprehensive credit reporting by 2018. The Report considers, but dismisses, the practical difficulties that lenders have in introducing comprehensive credit reporting.
It is likely that the Government will make a series of announcements in relation to these recommendations in the near future (possibly as part of the Federal Budget tonight). However, there is a lot of detail which must be considered before any of these recommendations can be properly and practically implemented. There are likely to be both formal and informal opportunities to make submissions.
Please feel free to contact us if you would like to understand in greater depth how these changes will affect your business.