Div 41—Preliminary

Division 4.1—Preliminary

4.1  Simplified outline of this Part

This Part deals with consumer data requests that are made to CDR participants by accredited persons on behalf of CDR consumers. Such requests, if made to a data holder, are made using the data holder’s accredited person request service.

In order for such a request to be made, the CDR consumer must have first asked the accredited person to provide goods or services to the CDR consumer or to another person, where provision of those goods or services requires the use of the CDR consumer’s CDR data.

Before making a consumer data request on behalf of a CDR consumer, the consumer must first have consented to the accredited person collecting and using specified CDR data to provide the requested goods or services.

Subject to certain limitations, the requested data can be any CDR data that relates to the CDR consumer.

Collection and use of CDR data under this Part is limited by the data minimisation principle, under which the accredited person:

 (a) must not collect more data than is reasonably needed in order to provide the requested goods or services; and

 (b) may use the collected data only as reasonably needed in order to provide the requested goods or services or as otherwise consented to by the consumer.

A request may be for the CDR consumer’s required consumer data, their voluntary consumer data, or both. Schedule 3 to these rules:

 • provides for what is required consumer data and voluntary consumer data for the banking sector; and

 • sets out the circumstances in which CDR consumers are eligible in relation to a request for their banking sector CDR data.

Consumer data requests made to data holders

Subject to exceptions outlined in this Part, if a request is made to a data holder, the data holder:

 • must seek the CDR consumer’s authorisation to disclose required consumer data; and

 • must seek the CDR consumer’s authorisation to disclose any voluntary consumer data that it intends to disclose.

The data holder then must disclose, to the accredited person, the required consumer data it is authorised to disclose, and may (but is not required to) disclose the voluntary consumer data it is authorised to disclose. The data is disclosed in machine‑readable form and in accordance with the data standards.

Consumer data requests made to accredited data recipients

If a request is made to an accredited data recipient, the accredited data recipient:

 • may (but is not required to) seek the CDR consumer’s consent to disclose the requested CDR data; and

 • once that consent is obtained, may (but is not required to) disclose that CDR data to the accredited person.