Using incentives programs to encourage data sharing by consumers

The CDR rules do not prohibit ADRs from offering incentives to encourage consumers to use their products or services. The CDR rules do however impose several obligations on an ADR's collection and use of CDR data, which may be relevant considerations for ADRs planning and developing incentives programs.

ADRs are encouraged in the first instance to refer to Division 1.2 – Simplified outline and overview of these rules (refer to Competition and Consumer (Consumer Data Right) Rules 2020, accessible via the Federal Register of Legislation, which provides a useful summary and explanation of the CDR Rules). Division 1.2 makes clear that an ADR must only seek consumer CDR data if providing the consumer with a good or service, or a limited number of other purposes which require an additional consent from the CDR consumer. An ADR providing a good or service to a CDR consumer is further limited to seeking only that data necessary to provide that good or service.

Provided below is an outline of CDR rules which may be relevant to an ADR considering an incentives program, depending on the ADR's intended use of data generated by the incentives program, and covers rules 1.17 and 4.15; 1.8; 4.13; 4.3, and 7.5. ADRs should refer directly to the Competition and Consumer (Consumer Data Right) Rules 2020, and subsequent revisions to ensure all requirements are considered by the ADR as relevant to their circumstances.

Rule 1.8 (Data minimisation principle):

• ADRs must not collect more data than is reasonably needed to provide the requested goods or services.
• ADRs may use the collected data only as reasonably needed to provide the requested goods or services or as otherwise consented to by the consumer.

Rule 1.17 (CDR data de‑identification process) & CDR rule 4.15 (Additional information relating to de‑identification of CDR data):

ADRs seeking increased access to CDR data for research purposes must meet several requirements.

• An ADR must adopt processes which comply with rule 1.17 when de-identifying CDR data (CDR data de-identification process).
• 4.15(c )(ii) requires an ADR seeking a de-identification consent for the purpose of general research to inform the consumer of that fact, and provide a link to a description in the ADR’s CDR policy which includes:
  • the research to be conducted.
  • any additional benefit to be provided to the CDR consumer for consenting to the use.

For the purposes of 4.15(c )(ii), an ‘additional benefit’ may include the accredited data recipient paying a fee to a consumer for use of their data or providing discounts for services provided to the consumer.

Rule 4.13 (Withdrawal of consents, and notifications):

• CDR consumers must be able to withdraw their consent to share their data at any time.

Rule 7.5 (Meaning of permitted use or disclosure and relates to direct marketing):

• An ADR intending to use CDR data for direct marketing is constrained by the permitted uses and disclosures of sub-rule 7.5(3).