Could you please clarify the expectations of the data required to be provided in relation to Rule 9.5 as a data holder?
For 9.3(d) disclosures of Consumer Data Right (CDR) data made in response to consumer data requests; does this mean details of the response ie: to which Accredited Data Recipient (ADR), date of disclosure, and data type within that consent contract, OR does it mean a entire list of all the data disclosed within the response?
For 9.3 (f) (f) CDR complaint data. Please provide some examples of the type of information required here.
Also, please confirm the intent of this rule, is to support customer to retrieve this data above and beyond the information provided in the Consumer dashboard or is the Consumer dashboard the solution to this rule?
The intention of rule 9.5 is to enable CDR consumers to access copies of records relating to particular information that is held and maintained by data holders and ADRs as it relates to their activities as CDR consumers. The requirements of rule 9.5 are separate to the requirements to provide specific information to the CDR consumer via the consumer dashboard.
Regarding the expectations for record keeping for the purposes of rule 9.3(1)(d), we note that paragraph 278 of the Explanatory Statement for the rules states that the record keeping requirements do not include a requirement to keep a copy or copies of collected CDR data itself. Rather, it is expected that data holders maintain ‘disclosure logs’ evidencing the type of CDR data that was disclosed, when the CDR data was disclosed (including time and date) and the relevant ADR the CDR data was disclosed to.
‘CDR complaint data’ is a defined term for the purposes of the rules (see rule 1.7). The definition includes the number of CDR consumer complaints received by the CDR participant, the number of such complaints resolved and the average number of days taken to resolve CDR consumer complaints through internal dispute resolution, amongst other things. For the purposes of rule 9.3(1)(f), data holders must keep and maintain records that record and explain their CDR complaint data. This could be in the form of ‘complaint logs’ which evidences information such as the following: name of the CDR consumer complainant; time/date complaint was made; complaint type; summary of the complaint; status summary of the complaint, including whether it was referred to an internal or external dispute resolution scheme, and if so, when; and if it was resolved, when it was resolved and a summary of the resolution outcome.
We also wish to note that, in line with the Explanatory Statement, records kept for the purposes of rule 9.3 should only contain personal information where it is necessary to comply with the rules.