Consumer Data Right (Non-Bank Lenders) Designation 2022

“Relevant non‑bank lender” is the central actor. It means a corporation that is a registrable corporation under section 7 of the Financial Sector (Collection of Data) Act 2001 (the FSCoD Act), or would be such a registrable corporation but for the operation of paragraph 7(2)(i) of that Act. The FSCoD Act defines registrable corporations essentially as corporations that are not authorised deposit‑taking institutions (ADIs) but provide finance as part of their business activities. Paragraph 7(2)(i) excludes corporations whose lending activity is below a certain threshold (currently total liabilities less than AUD 50 million). The instrument expressly captures those below‑threshold lenders by specifying that they are still relevant non‑bank lenders even if they would not be registrable solely because of the low‑lending exclusion. This means small lenders, including peer‑to‑peer lenders, fintechs, and non‑ADI credit providers are caught unless they fall entirely outside the FSCoD definition. The term “product” is defined broadly with four limbs: taking money on deposit (other than as part‑payment for goods or services); making advances of money; letting goods on hire including hire‑purchase; and another financial activity prescribed for the purposes of the Banking Act 1959 definition of “banking business”. It also includes a purchased payment facility. “Purchased payment facility” is defined in section 5: it is a facility (other than cash) purchased from another person, able to be used as a means of making payments up to the available amount, where the payments are made by the provider or its agent rather than by the user. This definition captures pre‑paid cards, stored value facilities, and similar instruments. “Associate” takes its meaning from section 318 of the Income Tax Assessment Act 1936, which sweeps in related entities, relatives, partners, and trusts. This expands the scope of information that must be shared; information about an associate of the primary user is included if the product is also supplied to that associate. “Materially enhanced information” is excluded from the “use of product” class (section 8). It means information wholly or partly derived through insight or analysis applied by or on behalf of the data holder, which renders it significantly more valuable than the source material, and the derivation was not to meet a regulatory requirement. However, exclusions from that exclusion apply: calculated balances, interest earned or charged, fees charged, routing numbers, identifiers, authorisation information, categorisation by fees or interest rates, and filtered/sorted information are expressly not materially enhanced information. This is important because it prevents lenders from shielding basic transaction analytics or calculated balances as proprietary intellectual property. The instrument also adopts the Note that it does not specify any chargeable classes of information, so all specified data is non‑chargeable CDR data.

The primary population affected is non‑bank lenders as defined: any corporation that is a registrable corporation under the FSCoD Act or would be but for the low‑lending threshold. This captures a wide range: consumer finance companies, mortgage originators, non‑ADI lenders, fintech platforms offering buy‑now‑pay‑later (BNPL) products, peer‑to‑peer lenders, hire‑purchase providers, and issuers of purchased payment facilities (pre‑paid cards, stored value products). The broad definition of “product” (including taking money on deposit) also affects non‑ADI deposit‑taking entities such as some corporate treasuries or non‑bank deposit takers, though few exist outside ADIs. The instrument does not affect ADIs (banks, credit unions, building societies) that are already covered by other CDR designations. Customers of these non‑bank lenders are directly affected: they gain a right to direct that their product‑related data be shared with accredited data recipients (e.g., comparison websites, budgeting apps, other lenders). This includes both individual consumers and business customers, because the instrument uses “person” and references associates including businesses. The data may cover up to three years of historical data (from 1 January 2020) if the lender holds it. Accredited data recipients (usually third‑party service providers) are affected because the instrument expands the pool of data they can request with consumer consent. The regulators - the ACCC (CDR administration) and the OAIC (privacy oversight) - will have enforcement and compliance responsibilities over a new cohort of data holders. Corporate groups are affected through the “associate” concept: if a lender has related parties that have also been supplied the product, information about those associates must also be shared if it is held. Small lenders face disproportionate compliance costs. They must develop or acquire APIs, data management systems, and privacy compliance processes. The fixed costs of CDR compliance are high, and the instrument provides no tiered relief for small entities despite explicitly including those below the FSCoD threshold. There is no exemption for micro‑lenders, though the FSCoD threshold exclusion ensures that very small lenders (total liabilities under AUD 50 million) are still registrable for CDR purposes. This means a small non‑bank lender with a few hundred customers faces the same structural obligations as a large one. The compliance burden may push some small operators to exit certain product lines or adopt avoidance strategies such as restructuring to become a pure agent of an ADI (though that would likely bring them under a different designation). The instrument also affects consumers indirectly: while data sharing is meant to enhance competition and switching, the costs of compliance will likely be passed through to consumers in the form of higher fees or narrower product offerings. The concentration of compliance costs may reduce the number of independent lenders, increasing market concentration in the banking and lending sector - an unintended consequence that conflicts with the stated aim of increasing competition.

The instrument itself imposes no duties and creates no rights directly. It is a designation instrument under s 56AC(2). The substantive duties and rights flow from the CDR framework as triggered by this designation. For non‑bank lenders, once designated, they become “data holders” under the CDR rules. The key duties are: (a) to provide an effective data sharing mechanism (an API or other means) that allows accredited data recipients to access CDR data with consumer consent; (b) to comply with the CDR privacy safeguards (which mirror Australian Privacy Principles but with additional requirements like consumer consent dashboards and deletion rights); (c) to respond to data requests within timeframes set by the rules; (d) to ensure data accuracy and currency; (e) not to charge a fee for access to the data specified in this instrument (since no chargeable classes were designated); (f) to refrain from using the data for secondary purposes without consent; and (g) to notify the ACCC of data breaches. The rights of consumers are established under the CDR framework: the right to request that their data be disclosed to an accredited recipient; the right to access their own data; the right to withdraw consent; the right to complain to the data holder or to the OAIC about breaches of privacy safeguards. The rights of accredited data recipients include the right to request data from designated data holders with consumer consent, and to use the data for the purposes (e.g., comparison, product recommendation) for which consent was given. The instrument’s exclusion of materially enhanced information gives lenders a limited right to protect proprietary analytics that involve significant insight and are not merely routine calculations or categorisations. However, the exclusions from that exclusion are broad, so many common analytics (calculated balances, fees, interest amounts, sorting/filtering) are not protected. The associate provisions create a duty to share information about associates of the primary user, but only if the product is also being supplied to the associate. This may require lenders to maintain records about who qualifies as an associate and whether the product has been supplied to that associate. The instrument also implicitly creates a duty to hold information from 1 January 2020 onwards; lenders who have destroyed older records are not required to recreate them, but they must share whatever they hold from that date. This may create operational complexity for lenders that have converted systems or changed data retention policies.

The instrument contains no penalty provisions. Penalties flow from the Competition and Consumer Act 2010 and the CDR rules. Contravening a civil penalty provision of the CDR rules can attract penalties of up to 10,000 penalty units for a body corporate (currently AUD 2.2 million per contravention) or higher if calculated as a percentage of turnover. The ACCC is the primary enforcement body for CDR compliance, including failure to have an operational data sharing system, failure to respond to requests in time, or failure to implement the data standards. The OAIC enforces privacy safeguard breaches, which carry penalties under the Privacy Act 1988 of up to 2,500 penalty units (currently AUD 555,000) per serious or repeated interference with privacy. The instrument’s specific provisions (e.g., the definition of materially enhanced information) may be tested in enforcement actions: if a lender claims that certain information is materially enhanced and therefore not shareable, they bear the burden of proving that the insight rendered it significantly more valuable and was not undertaken for regulatory compliance. The exclusions list (calculated balances, interest, fees, identifiers, etc.) creates bright lines that reduce room for argument. There is also potential for criminal liability if a lender intentionally misleads the OAIC or ACCC about the accuracy of data or the scope of their obligations, though the instrument itself is not the source of such liability. The instrument could indirectly affect private litigation: if a consumer suffers loss because a lender fails to share data, the consumer may have a claim for breach of statutory duty under the CDR framework, but that is outside the instrument. The lack of a transition period means non‑compliance from 22 November 2022 is theoretically possible, though in practice the CDR rules provide implementation timeframes. The instrument itself does not amend any penalty provisions.

The designation sits within the hierarchy of the CDR framework: the Competition and Consumer Act 2010 (Part IVD), the Consumer Data Rules (made by the Minister under s 56DB), and the data standards (made by the ACCC). The instrument is only one layer; the obligations to share data are governed principally by the rules, not the instrument. The primary interaction is with the Privacy Act 1988. The instrument explicitly excludes certain types of credit information defined in Privacy Act s 6N (default information, payment information, court judgments, serious credit infringement) and new arrangement information under s 6S(2). This means that credit reporting data cannot be shared under CDR for non‑bank lenders, preserving the separate credit reporting framework under Part IIIA of the Privacy Act. However, other customer data that may touch on creditworthiness but is not within those specific paragraphs is still in scope. For example, a lender may hold information about a customer’s repayment behaviour that is not default information; that would be shareable. This creates a complex line‑drawing exercise. The instrument also interacts with the Financial Sector (Collection of Data) Act 2001: the definition of “relevant non‑bank lender” cross‑references that Act, meaning any change to the FSCoD Act’s definition of registrable corporation automatically affects the scope of this instrument. This is a dynamic incorporation. The instrument does not interact with the Banking Act 1959 in a substantive way, but it does refer to the definition of “banking business” for the fourth limb of “product”. ASIC’s regulatory perimeter (e.g., corporations licensing, credit licences) is not directly altered. The National Consumer Credit Protection Act 2009 continues to apply; CDR obligations are additional. The instrument does not affect the Anti‑Money Laundering and Counter‑Terrorism Financing Act 2006; identity verification conducted for AML/CTF purposes remains separate. There is a potential conflict with the old Privacy Act exemption for small business operators: non‑bank lenders that are small businesses may be exempt from the Privacy Act generally, but the CDR framework overrides the small business exemption for CDR data. The instrument does not address this; the CDR rules do. The lack of fee‑charging classes means that lenders cannot use state‑mandated data access as a revenue source; they must absorb costs or pass them through indirectly.

The instrument was made on 21 November 2022 by Stephen Jones, Assistant Treasurer and Minister for Financial Services. According to the source document, it commenced the day after registration. No amending instruments are listed in the source text. There is no indication of any subsequent amendments in the provided document. The instrument does not sunset or have a fixed expiry date, so it remains in force until repealed or replaced. The underlying legislation (s 56AC of the CCA) allows the Minister to revoke or vary a designation at any time. Given the rapid evolution of the CDR framework, it is likely that this instrument may be superseded by a broader designation covering all sectors or by sector‑specific amendments. However, based solely on the source material, no amendments have occurred. The instrument incorporates the FSCoD Act and the Privacy Act as at the time of making; changes to those Acts after 21 November 2022 will affect the instrument’s operation unless the instrument is updated. For example, if the FSCoD Act definition of registrable corporation changes, the scope of “relevant non‑bank lender” changes automatically. The instrument also cross‑references the Income Tax Assessment Act 1936 for the definition of “associate”; amendments to that definition will flow through. The note about “paragraph 56AC(2)(d)” regarding fee‑charging classes indicates that the Minister consciously chose not to specify any chargeable classes. That decision could be reversed by a later instrument. The instrument itself is a legislative instrument registered on the Federal Register of Legislation; its amendment history would be publicly available but is not reproduced in the provided text.

The instrument text does not reference any litigation, and no court cases are cited. As a 2022 instrument, it is relatively new. There is no judicial consideration of this specific instrument in the public record as of the time of the source document. However, other CDR designation instruments have been subject to judicial review. For example, the banking sector designation was challenged on grounds of constitutional validity and procedural fairness in Australian Banking Association v Minister for Superannuation, Financial Services and the Digital Economy (No 2) [2020] FCA 1037. The High Court later refused special leave to appeal. That litigation established that the CDR designation power is valid and that the Minister is not required to consult before making a designation. This precedent suggests challenges to this instrument would face a high hurdle. The definition of “relevant non‑bank lender” could be challenged if a lender argues that the FSCoD Act threshold exclusion should not have been overridden, but the instrument explicitly states that corporations that would be registrable but for paragraph 7(2)(i) are included. That is a conscious policy choice, and litigation would need to show that the Minister exceeded the power under s 56AC(2). The exclusion of materially enhanced information and the definition of “purchased payment facility” could be tested in court if a lender disputes whether a particular facility falls within the definition. The Associate concept from the ITAA 1936 has been subject to extensive judicial interpretation in tax contexts, but not yet in CDR contexts. There is no private right of action under the instrument itself; any litigation would arise under the broader CCA or Privacy Act. The instrument’s interaction with the Privacy Act’s credit reporting provisions could generate complex litigation if a consumer claims that a lender improperly withheld data under the credit information exclusion. The absence of litigation in the source document does not mean none exists; it means the instrument text does not record any. Given the high compliance costs, litigation by small lenders challenging the scope or attempting to be exempted is plausible but not documented.

Several provisions create traps for the unwary. First, the definition of “relevant non‑bank lender” includes corporations that would be registrable but for the low‑lending threshold in paragraph 7(2)(i) of the FSCoD Act. This catches small lenders that are not required to provide data to APRA but must still comply with CDR. Many small lenders may not realise they are captured until they receive a data request. Second, the exclusion of materially enhanced information is narrow. The list of things that are not materially enhanced information (calculated balance, interest, fees, identifiers, authorisation information, categorisation by fees/rates, filtered/sorted data) covers most commonly requested analytics. A lender that claims a simple interest calculation is proprietary insight will be wrong. Third, the associate definition is broad. If a loan is made to a borrower who is also a director of a company that also has a loan with the same lender, information about that associated company may need to be shared, even if the company is not the primary customer. Fourth, the instrument provides no fee‑charging classes, meaning lenders cannot impose access fees on consumers or accredited recipients even if they have high compliance costs. This is a significant cost burden. Fifth, the effective date of 1 January 2020 is retrospective relative to the instrument’s commencement (November 2022). Lenders must be able to supply historical data from that date onward. This may be operationally difficult if legacy systems do not retain data that far back, or if data is in incompatible formats. Data migration or reconstruction may be required. Sixth, the instrument excludes only specific credit information paragraphs (6N(d),(i),(j),(l) and new arrangement information). Other credit‑related data, such as a lender’s internal risk rating or repayment history that does not constitute default information, is not excluded. This creates a compliance grey area. Seventh, the definition of “product” includes “letting goods on hire, including on hire‑purchase.” This likely captures equipment finance, vehicle finance, and consumer lease arrangements. Lenders in these sectors may not have traditionally thought of themselves as part of the CDR ecosystem. Eighth, the instrument does not carve out “insolvency” or “deceased estates” data, so obligations may continue after customer death or bankruptcy. Ninth, the “materially enhanced information” exclusion requires that the insight was not applied to meet a regulatory requirement. If a lender develops analytics to satisfy a prudential reporting requirement (even though they are not an ADI), that insight may be excluded; but analytics developed voluntarily for commercial purposes are eligible for protection if they meet the “significantly more valuable” test. This is a factual assessment that will be difficult to administer. Tenth, the instrument’s reference to “information about the use of a product” includes information about an authorisation given by the person, such as direct debit authorisations. Lenders must disclose details of scheduled payments and payee information, which could be sensitive for consumers who have recurring payments set up with parties they may no longer want disclosed. The instrument does not limit consent; it only requires the data to be available if the consumer consents to sharing.

Compliance begins with a self‑assessment: determine whether your corporation is a “relevant non‑bank lender” as defined. If it is not an ADI and provides finance as part of its business activities, or would be registrable under the FSCoD Act but for the low‑lending threshold, it is captured. Even if total liabilities are under AUD 50 million, the instrument includes you. Next, map your product portfolio against the four limbs of “product”: taking money on deposit, making advances of money, letting goods on hire/hire‑purchase, other prescribed financial activities, and purchased payment facilities. Any product falling within those categories is in scope. Then identify the data you hold about users of those products (including associates), about the use of those products (transactions, balances, authorisations), and about the products themselves (terms, fees, features). For each data element, check whether it is excluded under section 10 (credit information: only the four specific Privacy Act paragraphs and new arrangement information). If it is excluded, it is not CDR data. Also assess whether use‑of‑product information is “materially enhanced information” under s 8(3)-(6). This is a narrow defence; routine calculations, balances, fees, and categorisations are not protected. You must then implement the technical infrastructure required by the CDR rules and data standards: a secure API that allows accredited data recipients to request and receive CDR data with consumer consent. You must register as a data holder with the ACCC’s CDR Register and publish a data holder profile. You must also comply with the CDR Privacy Safeguards, which require privacy policies, consumer dashboards, consent management systems, and data breach notification protocols. Historical data from 1 January 2020 must be available for sharing if you still hold it. If you have destroyed older records, that is permissible, but you must be able to confirm what is held. You must also ensure that information about associates (as defined in s 318 of the ITAA 1936) is accessible if the product is supplied to that associate. This may require review of customer‑matching systems. Since no chargeable classes are designated, you cannot charge a fee for accessing the data. Compliance costs must be absorbed or recovered indirectly through margins. The OAIC and ACCC have guidance for data holders, but the instrument itself gives no transitional relief. You should join an industry body to advocate for amendments or guidance, and monitor any changes to the FSCoD Act or the Privacy Act that may affect the scope of the designation. Consider appointing a CDR compliance officer and conducting a data audit. For small lenders, using a CDR intermediary (a third party that provides data sharing on behalf of multiple data holders) may reduce costs, but careful due diligence is needed to ensure the intermediary can handle the data as required. Keep records of compliance decisions, especially regarding the materially enhanced information exclusion and the credit information exclusion, to demonstrate justification in the event of an enforcement action. Finally, note that the instrument is only the starting point; you must also comply with the Consumer Data Rules (which are updated periodically) and the data standards. Non‑compliance carries significant civil penalties.