[ARCHIVE] Direct-to-Consumer Access: Frequently Asked Questions

This article is out of date and has been archived. Direct-to-consumer access has been deferred indefinitely. Please refer to the CDR website for the most up to date information.

Archived Text

Questions

1. What is direct-to-consumer access?
2. What is the rationale for direct-to-consumer access?
3. What do data holders need to do?
4. What sectors are covered?
5. What will the consultation cover?
6. When is the ACCC planning to consult on direct-to-consumer access?

Answers

1. Direct-to-consumer access obligations will require data holders in the Consumer Data Right ecosystem to enable consumers to access their own data directly, in addition to the ability to do so through an accredited data recipient.

2. The Consumer Data Right is a consumer-focused regime that is about giving consumers greater access to and control over their data. One of the key tenets of the Consumer Data Right is that consumers should have a right to access and data about them that is held by businesses in sectors that have been designated under the Consumer Data Right (data holders).

   The importance of direct-to-consumer obligations in giving effect to a comprehensive consumer data right was outlined in the Productivity Commission’s report on Data Availability and Use.

3. Currently, the Consumer Data Right Rules will require data holders to allow consumers to access any of their CDR data in human readable form and in accordance with the data standards. This obligation has not yet commenced and is due to commence November 2021. This timeframe takes into account exemptions granted in June 2020.

   The ACCC is considering whether direct-to-consumer obligations under the Consumer Data Right Rules should be amended to allow consumers to access their data in machine readable form via application programming interfaces (APIs), with appropriate security and consumer safeguards.

4. Direct-to-consumer obligations will potentially apply in all sectors that are covered by the Consumer Data Right. However, consideration will be given to whether this is necessary where existing mechanisms exist, and whether and how the obligations should be tailored to account for any sector-specific circumstances.

5. The consultation will be about the content and design of direct-to-consumer obligations, as well as when those obligations should commence. This consultation is expected to occur concurrently with the Data Standards Body consulting on a draft standard relating to direct-to-consumer access. 

   This will include:

   • whether consumers should be able to access their data directly, using APIs
   • whether and how direct-to-consumer access should be tailored to account for sector-specific circumstances
   • what safeguards should be put in place to protect the privacy of consumers and the security of data
   • an appropriate timetable for the commencement of direct-to-consumer access

6. The ACCC intends to consult on direct-to-consumer obligations in early 2021. This will occur as part of the consultation on draft amendments to the Consumer Data Right Rules, which will accommodate the energy sector in the Consumer Data Right Rules. A draft Privacy Impact Assessment relating to the proposal will be published as part of the consultation process.

   The ACCC will consult for a minimum period of 28 days. During that consultation period, the ACCC will accept submissions from the public.