Consumer access to copies of records

Question

Could you please clarify the expectations of the data required to be provided in relation to Rule 9.5 as a data holder?

Rule 9.3(1)(d) relates to disclosures of Consumer Data Right (CDR) data made in response to consumer data requests. If a consumer requests copies of records referred to in rule 9.3(1)(d), what information must the data holder disclose to the consumer? For example, must the data holder provide details of the response  including the relevant Accredited Data Recipient (ADR), date of disclosure, and data type within that consent contract, OR does it  mean the data holder must provide an entire list of all the data disclosed within the response ?

Rule 9.3 (1)(f) relates to CDR complaint data. Please provide some examples of the types of information data holders must disclose to consumers in response to their request of this data under rule 9.5(1).

Also, please confirm the intent of rule 9.5(1), is to support customer to retrieve this data above and beyond the information provided in the Consumer dashboard or is the Consumer dashboard the solution to this rule?

Answer

The intention of rule 9.5 is to enable CDR consumers to access copies of records relating to particular information that is held and maintained by data holders and ADRs as it relates to their activities as CDR consumers. The requirements of rule 9.5 are separate to the requirements to provide specific information to the CDR consumer via the consumer dashboard.

Regarding the expectations for record keeping for the purposes of rule 9.3(1)(d), we note that paragraph 278 of the Explanatory Statement for version 2 of the CDR rules states that the record keeping requirements do not include a requirement to keep a copy or copies of collected CDR data itself. Rather, it is expected that data holders maintain ‘disclosure logs’ evidencing the type of CDR data that was disclosed, when the CDR data was disclosed (including time and date) and the relevant ADR the CDR data was disclosed to.

‘CDR complaint data’ is a defined term for the purposes of the rules (see rule 1.7). The definition includes the number of CDR consumer complaints received by the CDR participant, the number of such complaints resolved and the average number of days taken to resolve CDR consumer complaints through internal dispute resolution, amongst other things. For the purposes of rule 9.3(1)(f), data holders must keep and maintain records that record and explain their CDR complaint data. This could be in the form of ‘complaint logs’ which evidences information such as the following: name of the CDR consumer complainant; time/date complaint was made; complaint type; summary of the complaint; status summary of the complaint, including whether it was referred to an internal or external dispute resolution scheme, and if so, when; and if it was resolved, when it was resolved and a summary of the resolution outcome.

We also wish to note that, in line with the Explanatory Statement, records kept for the purposes of rule 9.3 should only contain personal information where it is necessary to comply with the rules.