Consumer Data Right (Authorised Deposit-Taking Institutions) Designation 2019

The instrument defines or adopts several key concepts that shape how the CDR applies to ADIs. Authorised deposit‑taking institution is given the same meaning as in subsection 5(1) of the Banking Act 1959 (Cth) - essentially, banks, credit unions, building societies and other deposit‑taking entities authorised by APRA. Associate is given the meaning under section 318 of the Income Tax Assessment Act 1936 (Cth), a very broad definition that captures relatives, partners, trustees, and entities with significant influence or control. This extends the CDR’s reach beyond a single customer to cover related persons where a product is supplied to them as well.

Product is defined comprehensively in subsections 4(2)-(4) to cover goods or services offered in connection with taking money on deposit, making advances of money, letting goods on hire (including hire‑purchase), or other financial activities prescribed for the purposes of the definition of “banking business” in the Banking Act 1959. It also includes a purchased payment facility - essentially a prepaid instrument (such as a gift card or stored‑value facility) that is purchased from a provider and usable for payments up to the available balance, paid for by the provider or its agent rather than by the user themselves. This coverage means that transaction data from prepaid cards and similar facilities is within scope.

The three specified classes of information are central. Section 6 covers information “about a user of a product” - identifying details, eligibility information, and contact details - but this is information provided by the person or their associate, or otherwise obtained by the data holder. Section 7 covers information “about the use of a product” - account identifiers, balances, transaction data, and authorisations such as direct debits and scheduled payments. Section 8 covers information “about a product” - its identity, prices (including fees, charges and interest rates), features, benefits, terms, conditions and eligibility criteria. This class includes product information as offered or as tailored to a particular customer, making both standard and customised products subject to disclosure.

The exclusions are equally important. Section 9 excludes credit‑related information defined in paragraphs 6N(d), (i), (j) or (l) of the Privacy Act 1988 - these cover certain consumer credit reporting data, including credit liability information, repayment history information, payment default information, and serious credit infringement information. Also excluded is “new arrangement information” under subsection 6S(2) of the Privacy Act, which covers information about a consumer’s request for a new credit arrangement. This carves out the core of the consumer credit reporting system, which is separately regulated under Part IIIA of the Privacy Act.

Section 10 excludes materially enhanced information - data derived wholly or partly from the section 7 use‑of‑product information, where insight or analysis applied by the data holder has made it “significantly more valuable” than the source material. The instrument gives examples of what is not materially enhanced: calculated balances, interest earned or charged, fees charged, reference numbers, identifying information, authorisation information, categorisations by product features, and simple filtering or sorting by date, amount or category (subsection 10(3)). The exclusion does not apply if the information is publicly available or required to be disclosed under another Australian law. Importantly, the note to section 10 explains that even if information is excluded from the section 7 class, it may still be CDR data under paragraph 56AI(1)(b) of the Act if it is wholly or partly derived from specified information - a subtle double‑counting rule that can pull materially enhanced data back into the regime via a different route.

The primary entities affected are authorised deposit‑taking institutions (ADIs) - the banks, credit unions, building societies and other deposit‑taking institutions that hold the specified information. For these institutions, the designation imposes a legal obligation (via the broader CDR framework) to make the designated classes of data available to accredited data recipients upon consumer authorisation. This covers every ADI operating in Australia, regardless of size; the instrument draws no carve‑outs for small lenders, mutual banks or foreign bank branches. The compliance burden therefore falls on the entire banking sector, with the largest institutions facing the most significant system‑building costs, and smaller ADIs potentially facing disproportionate per‑customer costs due to less mature data management systems.

Consumers and businesses who are customers of ADIs are directly affected. They gain a statutory right to access their banking data in a standardised, machine‑readable format and to direct that data be transferred to accredited third parties (such as budgeting apps, comparison websites, alternative lenders or accounting software providers). The instrument’s inclusion of associates (broadly defined) expands the cohort of eligible persons: if a product is supplied to both the customer and their associate, the associate’s data is also in scope. For business customers, this means data about business accounts, business credit cards, and merchant facilities can be shared, but only where the associate relationship is triggered.

Accredited data recipients - the third parties that receive CDR data - are affected in that the instrument defines the pool of data they can obtain. Without this designation, they could not lawfully request banking data under the CDR framework. The exclusion of chargeable classes means they can receive the data without paying a fee to the ADI (though they may still face costs under the ADI’s cost‑recovery arrangements for non‑chargeable data, if permitted by the rules). Trade‑credit insurers, fintechs, and other financial service providers benefit from a new data supply, but also face compliance costs under the CDR rules, including accreditation requirements, privacy safeguards, and data‑quality obligations.

The ACCC as the CDR regulator and the OAIC as the privacy regulator are affected in that the instrument expands the sector they oversee. It also affects competitors within the banking industry: larger banks with richer data sets may become de facto data controllers that smaller rivals must rely on for consumer‑permissioned data, potentially entrenching incumbency unless the CDR rules impose reciprocity or data‑minimisation standards. Finally, suppliers of purchased payment facilities (such as prepaid card providers that are not ADIs) are indirectly affected if they are associates of an ADI or if the data passes through an ADI’s systems - but the instrument designates ADIs only, so non‑ADI payment facility issuers are not directly designated.

The instrument itself does not enumerate duties or rights; it operates as a specification that triggers obligations under Part IVD of the Competition and Consumer Act 2010 and the CDR rules made under that Part. Nevertheless, the legal effects are concrete. For an ADI, the designation creates a duty to make CDR data available to an accredited data recipient when requested by the consumer (or their associate). This duty is not absolute; it is conditioned on the consumer having given their consent, and on the data recipient being accredited for that category of data. The ADI must comply with the data standards set by the Data Standards Body (currently the ACCC) and must adhere to the privacy safeguards in Part IVD, including the CDR Privacy Safeguards (set out in Division 5 of Part IVD). The instrument also imposes a temporal duty: the data must be held as at or after 1 January 2017 - the ADI cannot refuse access on the basis that the data predates that cut‑off, but it is not required to retrieve data from before that date.

The rights conferred on consumers are substantial. A consumer may request their CDR data from their ADI, or direct the ADI to transfer the data to an accredited third party. The consumer can also revoke that consent, requiring the ADI to cease sharing data with that recipient (subject to transitional provisions). Because no chargeable classes are specified, the consumer cannot be charged by the ADI for accessing or transferring this data - though the ADI may have a cost‑recovery mechanism for non‑chargeable data if the rules permit (the Act provides for chargeable CDR data but the instrument does not designate any). This zero‑fee rule is a significant constraint on ADIs, who would otherwise have an incentive to charge to recover the compliance cost.

Associates of the consumer also have rights, but only where the product has been supplied to them as well (section 6(1)(a)(ii)). This means the associate’s own data can be shared if the associate gives consent, but it also means the consumer can authorise sharing of data about the associate only where the associate is a co‑party to the product. This limits the risk of a consumer sharing data about a third party without that party’s consent.

For the ADI, there is a right not to share certain excluded information: credit‑related information under section 9, and materially enhanced information under section 10 (subject to the notes about re‑derivative data). The ADI also has a right to be satisfied that the data recipient is accredited and that the consumer’s consent meets the requirements of the CDR rules. Further, the ADI is entitled to rely on the CDR rules and the Act to refuse a request where disclosure would breach an Australian law (other than the Act), or where the information is not CDR data because it falls outside the specified classes or exclusions.

This instrument does not itself create penalties; enforcement is handled through the broader competition and consumer legislation. However, the designation is critical to enforcement because it defines the scope of what is CDR data. If an ADI fails to provide data that falls within the specified classes (and is not excluded), it may be contravening the CDR rules, which are a legislative instrument. Breaches of the CDR rules can attract civil penalties under the Competition and Consumer Act 2010. The maximum penalty for a body corporate for a contravention of a provision of Part IVD (or a rule made under it) can be the greater of $10 million, three times the value of the benefit obtained, or 10% of turnover (depending on the provision). For individuals, the maximum is $500,000. The ACCC is the primary enforcer, with power to issue infringement notices, seek court orders, and accept enforceable undertakings. The OAIC also enforces the CDR Privacy Safeguards, which carry their own penalty regime under the Privacy Act 1988 (with maximum penalties for serious or repeated interference with privacy currently up to $2.2 million for bodies corporate). The instrument’s designation of no chargeable classes means that if an ADI attempts to charge a fee for access to the specified data, it would likely breach the CDR rules (since the Act only permits charging for chargeable CDR data, and none is designated). This could attract civil penalty proceedings as well.

Importantly, the instrument itself can be reviewed by the Administrative Appeals Tribunal or subject to judicial review under the Administrative Decisions (Judicial Review) Act 1977 (Cth) if a person is aggrieved by a decision made under the instrument (though the instrument is a legislative instrument, not a decision). The practical enforcement target is the ADI’s refusal to share data, not the designation itself. The ACCC can also seek declarations and injunctions to compel compliance. The exclusion in section 10 creates a potential enforcement grey area: an ADI may claim that certain data is “materially enhanced” and therefore not required to be shared. If the ACCC or a consumer disputes that characterisation, the court would need to assess the threshold of “significantly more valuable” - a factual inquiry that could generate litigation. Similarly, the credit‑information exclusion in section 9 requires careful mapping to the Privacy Act definitions; an overly broad interpretation by an ADI could amount to non‑compliance.

The instrument operates within a complex legislative framework. Its parent Act is the Competition and Consumer Act 2010 (Cth) (CCA), specifically Part IVD which establishes the consumer data right. The instrument is made under subsection 56AC(2) of that Act. The Privacy Act 1988 (Cth) is explicitly referenced in two ways: first, the definition of “Australian law” (subsection 4(1) of the instrument) adopts the meaning from subsection 6(1) of the Privacy Act 1988; second, the exclusion for credit information (section 9) incorporates paragraphs 6N(d), (i), (j) and (l) and subsection 6S(2) of the Privacy Act. This means the instrument aligns the CDR regime with the existing consumer credit reporting framework - information that is already regulated under Part IIIA of the Privacy Act is excluded from the CDR for ADIs, avoiding dual regulation for the same data. However, the exclusion is not blanket: only specific paragraphs are excluded. For example, credit‑worthiness information (such as a credit score) that is not captured by those paragraphs might still be in scope if it falls under sections 6, 7 or 8. This creates a potential overlap: an ADI may hold a credit score derived from transaction data, and the status of that score as CDR data will depend on whether it is materially enhanced and whether the underlying data is excluded.

The Banking Act 1959 (Cth) is relevant because the instrument defines ADI by reference to that Act. The secrecy provisions in the Banking Act (e.g., section 63) are potentially overridden by the CDR regime to the extent that the Competition and Consumer Act 2010 authorises the disclosure. The CDR framework includes provisions that prevail over other confidentiality obligations (section 56GA of the CCA), so an ADI cannot refuse data sharing on the basis of banking secrecy.

The Income Tax Assessment Act 1936 (Cth) definition of associate (section 318) is adopted and is broader than the concept of “related party” in many financial services laws. This may pull in data about entities that would otherwise not be considered connected for privacy purposes.

The instrument also interacts with data standards set by the Data Standards Body under Part IVD of the CCA, which prescribe the format and technical specifications for sharing the designated data. The standards are legislative instruments themselves, and compliance with them is mandatory. An ADI must ensure its systems can produce data in the required format for each specified class.

Finally, the Competition and Consumer Act 2010 also contains provisions on unconscionable conduct, misleading or deceptive conduct, and consumer guarantees; these may apply to behaviour in the CDR ecosystem but are not directly modified by this instrument.

The instrument is titled the Consumer Data Right (Authorised Deposit‑Taking Institutions) Designation 2019. As provided in the source text, it appears to be the original version, with no amendments or variations recorded in the instrument itself. The source text does not include any amending instruments, repeal provisions, or commencement clauses other than the name and date of making. The instrument likely commenced on the date of registration on the Federal Register of Legislation, as is standard for legislative instruments. It has not been amended in the provided text. However, the broader CDR regime has undergone multiple changes, including expansions to other sectors (energy, telecommunications) and amendments to the parent Act. None of those changes affect this instrument unless a later designation or amendment to the Act expressly narrows or expands the classes of information or the designated persons. The instrument’s specification of “no chargeable classes” has not been reversed, though the Act contemplates future designations can add chargeable classes for this sector. Similarly, the 1 January 2017 cut‑off date is fixed in the instrument; any change to that date would require an amending instrument. The instrument is now nearly five years old, and there may have been calls to update the classes (e.g., to include additional types of product data or to update the exclusion for credit information following changes to the Privacy Act 1988). However, based solely on the source text, no amendment history is available.

The instrument itself has not been the subject of reported litigation. No cases are mentioned in the instrument, and the source text provides no information about judicial consideration. There have been administrative proceedings concerning the CDR regime more broadly, particularly around accreditation decisions and data sharing disputes, but these have not turned on the validity or interpretation of this specific designation. The exclusion for materially enhanced information (section 10) could become a fertile ground for litigation, especially around the meaning of “significantly more valuable”. The Federal Court may eventually be asked to determine whether an ADI’s claim of material enhancement is legitimate, or whether the ADI has improperly withheld data on that basis. Similarly, the cut‑off date of 1 January 2017 may be litigated if an ADI argues that certain data predates that date and is therefore outside the designation, or if a consumer argues that the ADI should have retained data from earlier periods. The instrument’s interaction with the Privacy Act definitions could also be tested, for example, whether information about a direct debit authorisation that includes credit default information is excluded under section 9 or is still in scope under section 7. For now, the instrument has operated without direct judicial scrutiny, but that may change as the CDR system matures and compliance disputes arise.

Several provisions in this instrument contain traps for the unwary. The no chargeable classes rule is absolute: because the instrument does not specify any classes of information for which a fee may be charged, the designated data is not chargeable CDR data. An ADI that attempts to levy a fee for access (unless permitted under the CDR rules for non‑chargeable data) would breach the regime. This is a sharp disincentive, but it also means ADIs cannot recover the significant compliance costs of building CDR‑compatible systems, data extraction, and ongoing maintenance. Those costs must be absorbed or passed on through other charges - cross‑subsidisation that may affect the pricing of banking products for all customers, not just those who use CDR.

The materially enhanced information exclusion (section 10) is narrower than it first appears. Paragraph 10(3) lists examples of what is not materially enhanced: calculated balances, interest amounts, fees, reference numbers, identifying information, authorisation information, and categorisations or filtering. This list is not exhaustive (subsection 10(4)), but the explicit exclusion of these common enhancements means that a large amount of transaction data processed by an ADI is still within scope. Banks cannot simply claim that any computational output is excluded. Moreover, even if information is excluded from section 7, the note to section 10 reminds the reader that the data might still be CDR data under paragraph 56AI(1)(b) of the Act if it is derived from specified information. For example, an ADI might calculate a “average daily balance with interest optimisation” that it claims is materially enhanced; but if that output is produced by combining section 7 data with other data, it may still be captured as derived CDR data. The exclusion operates only for the “use of product” class, not for the “about user” or “about product” classes (sections 6 and 8). So an ADI cannot rely on section 10 to withhold enhanced user or product data.

The credit information exclusion (section 9) is also limited. It excludes only specific paragraphs of section 6N of the Privacy Act. This does not include, for example, basic identity information that is also credit‑related (like a name and address that appear in a credit report) - that information may still be CDR data if it falls under section 6. Also, the exclusion for “new arrangement information” is limited to requests for a new credit arrangement under the Privacy Act; information about a decline decision or a credit score not covered by the excluded paragraphs remains in scope.

The associate definition creates risks for both consumers and ADIs. A consumer may inadvertently authorise the sharing of data about their associate if the associate is a co‑borrower, joint account holder, or otherwise tied to the product. The associate may not want that data shared, but the instrument only requires sharing with the associate’s consent? Actually, the instrument does not address consent - that is left to the Act and rules. However, the class definition in section 6 explicitly includes information about the associate where the product is “also being supplied to the associate”. This means the ADI must be able to identify which data relates to the associate and which to the primary consumer, which may require system segmentation.

The 1 January 2017 cut‑off date is retrospective. An ADI must be able to retrieve and share data going back to that date - nearly eight years from now. Older systems may not retain transaction data that far back, or may store it in formats that are not easily extractable. The instrument does not impose data retention obligations; it only says that information held as at that date is in scope. If the ADI has already purged records from before that date, there is no obligation to recreate them. But if the ADI holds any data from that date onwards, even if it is archived or on legacy systems, it must be treated as potentially CDR data.

Finally, the instrument’s definition of product includes purchased payment facilities even where the facility is not issued by an ADI. If an ADI holds data about a gift card or transit card that was purchased from a third party but is linked to an account at the ADI, that data is in scope. The ADI may not even realise it holds such data, particularly if it processes transactions for the facility issuer.

Compliance with this instrument requires an ADI to understand precisely which data falls within the designated classes and which exclusions apply. The first step is a data mapping exercise across all business lines: every account, transaction, product, customer record, and authorization must be categorised under sections 6, 7 or 8. The ADI must also identify whether any data is excluded under sections 9 or 10. This mapping must cover both standard and tailored products (section 8(2)), and must include data held on behalf of the ADI by third‑party processors or cloud services.

Second, the ADI must build or procure a CDR‑compliant data sharing infrastructure. This includes an interface (typically an API) that can produce the data in the format mandated by the Data Standards Body, with real‑time or near‑real‑time response times. The ADI must implement authentication mechanisms to verify the identity of the consumer and the accreditation status of the data recipient. It must also maintain logs of data requests, consents, and transfers.

Third, the ADI must adopt the CDR Privacy Safeguards set out in Division 5 of Part IVD of the CCA. These include obligations around consent (informed, specific, and revocable), data quality, data security, notification of breaches, and restrictions on use and disclosure. The Privacy Safeguards impose strict accountability on the ADI as the data holder.

Fourth, the ADI must train staff to handle CDR requests, handle disputes about exclusions, and respond to consumer inquiries. The compliance team must understand the narrow scope of the credit‑information and material‑enhancement exclusions to avoid over‑reliance.

Fifth, the ADI should review its data retention policies to ensure it holds data as far back as 1 January 2017 for all products within scope. Where data from that period is archived in formats that cannot be extracted, the ADI may need to develop retrieval capabilities. The ADI cannot simply assert that older data is too difficult to access.

Sixth, the ADI must monitor changes to the CDR rules, the Data Standards, and any future amendments to this instrument. The ACCC and OAIC issue guidance and compliance expectations; the ADI should maintain a compliance register and regular audit schedule.

Finally, the ADI should consider engaging with industry bodies and the ACCC on interpretive issues, particularly around the boundaries of the exclusions. Given that no chargeable classes exist, the ADI cannot recoup costs through fees, so compliance budgets must be treated as fixed costs. For smaller ADIs, shared services or third‑party CDR providers may be a practical option to avoid duplicative investment.