Consumer Data Rights – What Does It Mean for Your Business?

The Consumer Data Right (CDR) was introduced in response to the Productivity Commission Report on Data Availability and Use. The Report noted that data in the Australian economy was not being fully utilised and expressed concerns about outdated legal and policy frameworks under which data is handled in Australia.

The Government accepted the Report’s recommendation to create a right for consumers to request data transfers between entities. They also recognised the need to balance individual privacy and data control and allow businesses to realise the value of data for commercial gain. The core function of the CDR is to increase competition and improve consumer outcomes. The CDR currently does this by providing a mechanism for data portability for consumers.

Under the regime, a consumer can request an incumbent data holder, such as a bank or energy provider, to pass their data on to another entity – an Accredited Data Recipient within the regime. In the future, the CDR regime will also allow consumers to direct third parties (accredited Action Initiators) to initiate actions on their behalf.

LexisNexis® Legal Writer Alison Cripps spoke with Melissa Fai, Partner at Gilbert + Tobin, and Joy Kim, Lawyer at Gilbert + Tobin on the progress of Consumer Data Rights since its introduction to Australia in 2017 and what it means for businesses now and in the future.

This paper highlights the most salient and practical aspects of that discussion and summarises some of the most important issues you need to be aware of in this complex and changing environment including:

• What is CDR?
• CDR Assessments
• Consumer Consent
• The Privacy Act & Privacy Safeguards
• Regulations & Penalties
• Breaches & Misconduct
• The Future of CDR