Guidance for accredited data recipients on completing biannual reporting forms under rule 9.4

An accredited data recipient (ADR) is required to report a range of key metrics to the ACCC under rule 9.4 of the Competition and Consumer (Consumer Data Right) Rules 2020 (Cth) (CDR Rules).

The sample reporting forms for ADRs including for those who are also CDR representative principals can be found on the CDR website. This article provides information on how particular questions in the reporting forms should be answered, including metrics relating to disclosure consents.

Number of CDR consumers provided with goods or services using CDR data

For question 9 in the ADR reporting form, an ADR must specify the number of CDR consumers it provided goods or services to using CDR data during the reporting period. This includes CDR consumers who gave the ADR one or more disclosure consents to disclose CDR data to:

1. an accredited person in response to a consumer data request (an AP disclosure consent)
2. an accredited person for the purposes of direct marketing
3. a CDR consumer’s trusted adviser (a TA disclosure consent)
4. a specified person in accordance with an insight disclosure consent, or
5. a specified person in accordance with a business consumer disclosure consent.[1]

Where CDR data is disclosed to a third party in accordance with one or more of the above disclosure consents (e.g., a TA disclosure consent), this still amounts to a good or service provided to the CDR consumer. Accordingly, these CDR consumers should be counted when answering question 9. The same applies when reporting on behalf of a CDR representative (see question 19 in the CDR representative principal reporting form).

Goods or services provided by CDR representatives

An ADR who is a CDR representative principal should exclude any CDR consumers served by the ADR’s CDR representatives, when entering the number of CDR consumers to whom it provided goods or services using CDR data in the ADR reporting form. This is because under r 1.10AA(1), a CDR representative is responsible for providing goods or services to the CDR consumer in a CDR representative arrangement.

Instead, the number of CDR consumers served by a CDR representative should be reported by the ADR (as the CDR representative principal) in response to question 19 in the CDR representative principal reporting form.

Example

Monsoon Industries is an ADR that served 100 CDR consumers in a reporting period.

50 of those CDR consumers provided TA disclosure consents which permitted Monsoon to disclose the CDR consumers’ CDR data to their trusted advisers.

The remaining 50 CDR consumers did not provide any disclosure consents and only provided use consents which allowed Monsoon to use their CDR data to provide a personal finance management app.

In addition, Monsoon is the CDR representative principal of Lunar Inc. which served 50 CDR consumers in the same reporting period.

In the ADR reporting form, Monsoon should indicate it served 100 CDR consumers for question 9. In the CDR representative principal reporting form, Monsoon should indicate its CDR representative (Lunar) served 50 CDR consumers for question 19.

Number of disclosure consents received

An ADR is required to specify how many of the below disclosure consents were received by it and its CDR representatives during the reporting period:

1. TA disclosure consents (question 15 for ADRs and question 20 for CDR representatives)
2. insight disclosure consents (question 16 for ADRs and question 21 for CDR representatives).

For questions 17 – 19 in the ADR reporting form, an ADR is also required to specify the number of:

1. consents in relation to which a business consumer statement was given during the reporting period
2. the number of such consents with a duration of more than 12 months
3. the number of times the ADR disclosed CDR data in accordance with a business consumer disclosure consent.

A business consumer statement can be given in relation to use consents, TA disclosure consents, insight disclosure consents and business consumer disclosure consents.[2]

Accordingly, the number of TA disclosure consents for question 15 in the ADR reporting form should include any TA disclosure consents in relation to which a business consumer statement was given. The same applies to question 16 for insight disclosure consents.

Example

Monsoon Industries is an ADR that received the following disclosure consents during a reporting period:

1. 50 TA disclosure consents
2. 50 insight disclosure consents
3. 50 business consumer disclosure consents in relation to which a business consumer statement was given
4. 20 TA disclosure consents in relation to which a business consumer statement was given
5. 30 use consents in relation to which a business consumer statement was given.

When completing the ADR reporting form, Monsoon should indicate:

1. 70 for question 15 concerning the number of TA disclosure consents received (as this includes those received with or without a business consumer statement)
2. 50 for question 16 concerning the number of insight disclosure consents received
3. 100 for question 17 concerning the number of consents received in relation to which a business consumer statement was given.

Number of consumer data requests

Question 10 in the ADR reporting form requires an ADR to specify the number of consumer data requests made by the ADR.[3] This number is a total and should include consumer data requests made in accordance with the above disclosure consents and other consents.

Example

Monsoon Industries is an ADR that provides the following services to its CDR consumers:

1. a real-time overview of a CDR consumer’s financial position via a personal finance management app (in accordance with a collection and use consent)
2. the disclosure of CDR data to a CDR consumer’s trusted adviser (in accordance with a collection, use and disclosure consent).

When calculating the number of consumer data requests made during a reporting period, Monsoon should include the number of consumer data requests made for both of the above services.

CDR representatives

Where an ADR is a CDR representative principal, the response to question 10 in the ADR reporting form should also include the number of consumer data requests made by the ADR on behalf of its CDR representative(s). That is, the response should include the total number of requests made by the ADR:

• in relation to its own goods and services, and
• on behalf of its CDR representative(s) in relation to their goods and services.

This is because under rule r 1.10AA(1)(b), it is the ADR (as the CDR representative principal) and not the CDR representative who makes consumer data requests.

In contrast, for question 14 in the CDR representative principal form, the ADR (as the CDR representative principal) should only specify the number of consumer data requests made on behalf of its CDR representative and exclude requests made for itself.

Sponsors

An ADR who has entered into one or more sponsorship arrangements should also include the number of consumer data requests made on behalf of affiliates in its response to question 10 in the ADR reporting form. This is in addition to the number of consumer data requests made for itself.

Important notice

The information in this publication is for general guidance only. It does not constitute legal or other professional advice, and should not be relied on as a statement of the law in any jurisdiction. Because it is intended only as a general guide, it may contain generalisations. You should obtain professional advice if you have a specific concern.

The ACCC has made every reasonable effort to provide current and accurate information, but it does not make any guarantees regarding the accuracy, currency or completeness of that information.

Parties who wish to re-publish or otherwise use the information in this publication must check this information for currency and accuracy with the ACCC prior to publication.

This should be done prior to each publication edition, as ACCC guidance and relevant transitional legislation frequently change. Such queries should be addressed to [e-mail] 

---

[1] See rule 1.10A of the CDR Rules for the meanings of ‘disclosure consent’ and other categories of consents such as TA disclosure consents and insight disclosure consents. Note, a CDR representative cannot seek a business consumer disclosure consent (see rule 1.10A(1)(c)(v)).

[2] See rule 1.10A(10) of the CDR Rules.

[3] For guidance on the meaning of ‘consumer data requests’ for reporting purposes, see Consumer data requests and related reporting requirements for ADRs.