Open Season for Open Banking

Spring is in the air and so is change! So on top of a new Prime Minister (yet again), Australia is also welcoming the first buds of Open Banking.

On 14 August 2018, the Commonwealth Treasury released draft legislation to implement the new Consumer Data Right (CDR). This legislation – the Treasury Laws Amendment (Consumer Data Right) Bill 2018 - provides the legislative scaffolding for Open Banking in Australia, which is due to commence on 1 July 2019 and will initially apply to transaction, deposit and card-based accounts held at the four major banks. Open Banking will be rolled out to a wider range of accounts and deposit-taking institutions over 2020 and 2021 and CDR be extended to other industries in the future.

The package includes draft legislation released for comment, as well as an Explanatory Memorandum and “ready reckoner” which summarises the key provisions. Submissions on the draft legislation are due on 7 September 2018.

The main amendments insert a new Part IVD – the Consumer Data Right – into the Competition and Consumer Act 2010.  There are also proposed amendments to the Privacy Act 1988 and the Australian Information Commissioner Act 2010.

The CDR regime provides new powers to the responsible Minister, the Australian Competition and Consumer Commission (ACCC) and the Office of the Australian Information Commissioner (OAIC). The regime will also establish the position of the Data Standards Chair and Data Standards Body (a role to be initially undertaken by Data61 at the CSIRO) as well as creating new roles such as the Data Recipient Accreditor and the Accreditation Registrar (roles to be initially undertaken by the ACCC).

In brief, the CDR regime provides the Minister with the power to designate a sector of the Australian economy for the purpose of the Consumer Data Right. Once designated, the ACCC can makes rules for the designated sector. 

The ACCC and OAIC will jointly regulate the regime – with the ACCC focusing on overall compliance and the OAIC focusing on privacy. The Data Standards Body will assist the Data Standards Chair, who will make the relevant data standards. 

The CDR regime creates three main parties – Consumers (including individual and businesses); Data Holders; and Accredited Data Recipients. In simplest terms, the CDR regime enables a Consumer to provide consent to an Accredited Data Recipient (which will need to be accredited by the ACCC) for access to data about the Consumer held at the Data Holder. This is to be done under the rules set by the ACCC and the standards issued by the Data Standards Chair.

Open Banking is new terrain. While the Farrell Report on Open Banking provided an excellent starting point for developing the regime, the Government has committed to implementation by 1 July 2019 – a tad over 10 months away.

The draft legislation has left me with a few thoughts:

Multiple Regulators - The CDR / Open Banking regime has a lot of bodies involved – the ACCC, OAIC, the newly created Data Standards Chair, and Data61 at the CSIRO as the Data Standards Body. The newly created Australian Financial Complaints Authority may (or may not) play a role as an external dispute resolution body.  In the UK, the Competition and Markets Authority will have a much more central role as regulator. While not wanting to draw too long of a bow, the recent hearings on superannuation before the Royal Commission has suggested that multiple regulators (in that case ASIC and APRA) can create serious moral hazard issues – something for policymakers and industry to reflect carefully on before flipping the switch on Open Banking.   

Rules and Standards - The ACCC will be responsible for “rules” while the Data Standards Chair will be responsible for “standards”. All well and good, but where does a rule end and a standard begin? The Explanatory Memorandum at 1.120 states optimistically:

“The data standards will be largely in the nature of specifications for how information technology solutions must be implemented to ensure safe, efficient, convenient and interoperable systems to share data. They will only describe how the CDR must be implemented in accordance with the rules which will set out the substantive rights and obligations of participants.”

Having spent many years working in multi-participant, interoperable environments, this leaves a lot of grey space to be resolved in a very short period of time. Having the rule-making role with one body and the standard setting role with another, only makes this task even harder.    

Fees – One of the striking recommendations from the Farrell Report was that data holders should not be able to charge data recipients a fee to access data.  There were serious concerns from industry participants and the legislation has reversed this, now providing that a fee may be payable to disclose certain class or classes of information.  The Explanatory Memorandum explains the change by noting, “The ability to set a fee acknowledges that some CDR data may be value-added data, or that in limited circumstances, provision of data for free would impact on incentives for data holders to collect data.” A big challenge to the ACCC and hopefully a level can be set that finds the right balance.

There are a lot of other interesting issues in here – like the obligations on the Minister and ACCC to consult, misleading and deceptive conduct provisions and a more prescriptive approach to privacy - but a lot more than need to be resolved.

So remember – submissions are due 7 September! Happy reading!