Consumer Data Right (Telecommunications Sector) Designation 2022

Designated information: Under subsection 56AC(2) of the Competition and Consumer Act 2010, the Minister may specify classes of information for a sector. This instrument specifies three such classes, making that information "designated information" under the Act. That triggers the obligation on data holders to make that data available through CDR mechanisms.

Data holder: Carriers and carriage service providers (as defined in the Telecommunications Act 1997) are specified as the persons who hold the information (section 5(2)). This includes entities that hold the data themselves or on whose behalf it is held. The note to section 5(2) clarifies that these persons will be data holders of CDR data within the specified classes, subject to section 56AJ of the Act (which addresses outsourcing arrangements). A carrier is an entity licensed to own and operate telecommunications network infrastructure. A carriage service provider supplies carriage services to the public using a carrier's network. Both are caught regardless of size, meaning small internet service providers face the same obligations as Telstra.

Earliest holding day: Set at 1 January 2022 (section 5(3)). This is the date from which a consumer can request CDR data. It does not oblige data holders to retain data before that date, but any data held from 1 January 2022 onward that falls within the specified classes must be made accessible upon request.

Three classes of information:

• Section 6: information about a person or entity who has been or is being supplied a product, or their associate who has used or is using the product. The information must have been provided by or obtained in connection with the supply or use. This captures identity data, contact details, usage demographics, and any data about usage patterns.
• Section 7: billing and account information for retail supplies. This includes account identifiers, billing summaries, usage summaries, payment arrangements, concessions, rebates, contract end dates. However, "materially enhanced information" is excluded: information derived through insight or analysis that renders it significantly more valuable than the source material, unless the derivation was to meet a regulatory requirement.
• Section 8: information about products that are or have been offered or supplied: descriptions, prices, fees, terms, eligibility criteria, duration, bundling arrangements, and services for customers who require additional assistance (e.g. those with disability). This includes offers to particular classes or individuals.

Exclusions: Section 9 excludes location data revealing where a person was when using a mobile product, and content or substance of communications (with a narrow exception for supply-related communication between the supplier and the customer). This ensures that sensitive call content and location are not obtainable through CDR requests, consistent with the Telecommunications Act interception and surveillance regimes.

Materially enhanced information: Defined in section 7(3). It is information wholly or partly derived by applying insight or analysis to source material (the billing/account info in section 7), where that insight or analysis was applied by the data holder and rendered the information significantly more valuable than the source material. The notes clarify that the derivation need not be from source material only; it could combine source material with other data. The exclusion is designed to protect a data holder's proprietary analytics. However, the test is vague: "significantly more valuable" invites disputes. The burden of proving the exclusion falls on the data holder.

The instrument directly affects all carriers and carriage service providers operating in Australia. This includes large integrated telecoms (Telstra, Optus, TPG Telecom), mobile virtual network operators (MVNOs), fixed-line broadband providers, and any entity that supplies retail telecommunications services. The definition of "carriage service provider" under the Telecommunications Act 1997 is broad; it covers essentially any entity that supplies a carriage service to the public using a carrier's network. Small business providers that resell wholesale broadband or mobile services are carriage service providers and therefore data holders for CDR purposes. They are not exempt, even if they have limited technical capacity, low margins, or a customer base of a few hundred. The compliance cost relative to revenue will be significantly higher for these smaller entities.

Retail customers and users are the primary beneficiaries: they can request their data and direct it to accredited data recipients. The instrument includes data about "associates" (defined under section 318 of the Income Tax Assessment Act 1936), which includes relatives, business partners, and entities under common control. This expands the pool of individuals whose data may be disclosed without being the account holder. For example, a user on a family plan who is not the account holder may still have their usage data accessible under section 6. The data holder must manage consent for associates separately if they are identifiable individuals.

Accredited data recipients (ADRs) are the intended recipients of CDR data. They must be accredited under the CDR rules and comply with privacy safeguards. The instrument makes telecom data available for comparison services, switching tools, and financial inclusion products. The absence of fee-charging data classes means ADRs can access data at zero direct cost from data holders (though data holders may seek to recover costs through other means, subject to competition law).

Consumers with disability are referenced in section 8(2)(g): product information must include details about services for customers requiring additional assistance. This aids accessibility but imposes a data mapping obligation: providers must ensure that information about disability-specific plans and support services is captured and made available in CDR format.

The exclusion of location data and communication content protects the interests of all users of mobile products. However, the exclusion is narrow. For example, location data derived from billing records that shows the postcode of a fixed broadband connection may not be excluded because it does not reveal where a person was when using a mobile product. Similarly, anonymised aggregated location data may fall outside the exclusion if it cannot identify a specific person's location at a specific time. The instrument also does not exclude metadata such as numbers dialled, call duration, or data volumes; these are likely within section 6 or 7.

The instrument itself does not impose detailed operational duties; those arise from the CDR rules made under Part IVD of the Competition and Consumer Act 2010, the CDR data standards, and the Privacy Safeguards. However, the designation triggers the following key duties for carriers and carriage service providers:

• Data provision duty: Upon receiving a valid consumer request via an accredited data recipient, the data holder must provide the CDR data in the specified format and within the timeframes set out in the CDR rules. The instrument sets the scope of data that must be available. For sections 6 and 7, the data holder must respond with information about the person/entity and their associates. For section 8, product information must be kept current and accessible.

• Accuracy and currency duty: The CDR rules require that CDR data be accurate, up-to-date, and complete. This is particularly relevant for product information (section 8) which changes often (pricing, plans, terms). Data holders must maintain processes to ensure data is correct at the time of request.

• Consent management duty: For section 6 information about individuals (including associates), the data holder must obtain and manage consumer consent. The CDR rules require consent to be specific, clear, and capable of withdrawal. Data holders cannot disclose information about an associate without that associate's consent if they are a separate individual.

• Outsourcing and third-party duty: If the data holder uses a third party to hold or process CDR data (e.g., a billing platform provider or a wholesale network operator), section 56AJ of the Act requires the data holder to have arrangements to ensure CDR compliance. The instrument's definitions of "holder" capture entities on whose behalf data is held, so the principal data holder remains responsible.

• No fee right: The instrument does not specify any chargeable classes of information. Therefore data holders cannot charge a fee for providing CDR data under these classes. They must bear the cost of implementing and maintaining CDR infrastructure, including API development, data mapping, consent systems, and ongoing compliance. This is a direct transfer of cost from data recipients (and consumers) to data holders, which may affect pricing for all customers.

• Right to exclude materially enhanced information: Section 7(2) allows data holders to withhold billing and account information that has been materially enhanced through their own insight or analysis that significantly increases its value. This is a limited right: the onus is on the data holder to demonstrate that the information meets the three criteria in section 7(3). If disputed by a consumer or ADR, the data holder may need to justify the classification.

• Right to exclude location and communication content: Section 9(1) and (2) give data holders a clear exclusion for location data and communication content. They must not disclose this information as CDR data, even if it falls within the section 6 or 7 definitions. The narrow exception in section 9(2)(a)-(b) permits disclosure of a communication that is related to an offer or supply between the supplier and the customer (e.g., a text message confirming a plan change). This exception is limited to two-party supply-related communications; it does not cover communications with third parties or general customer service chats.

The instrument does not itself prescribe penalties. Penalties arise from the Competition and Consumer Act 2010 and the CDR rules. The Act provides for civil penalties for contraventions of CDR obligations, including failure to provide CDR data, failure to comply with privacy safeguards, and breaches of accreditation requirements. Maximum penalties for corporations can reach the greater of $10 million, three times the benefit obtained, or 10% of annual turnover (for serious contraventions). For individuals, penalties can be up to $500,000. The ACCC and the Office of the Australian Information Commissioner (OAIC) share enforcement roles. The ACCC enforces consumer data access and competition provisions, while the OAIC enforces privacy safeguards and consent obligations.

Because the instrument makes these classes of information "designated information", any failure to provide that data upon a valid request becomes a potential civil penalty contravention. The absence of fee-charging classes removes a potential justification for non-compliance based on fee disputes; data holders cannot refuse to disclose on the basis they are not paid.

Enforcement tools include infringement notices (penalty notices of up to 60 penalty units per contravention), court-ordered injunctions to compel disclosure, and directions to comply. The ACCC has published CDR compliance priorities and may investigate complaints from ADRs or consumers.

For material enhanced information disputes (section 7(2)-(3)), if a data holder withholds data claiming it is materially enhanced, an ADR or consumer could challenge that characterisation. If the data holder is wrong, it faces liability for failing to provide CDR data. This creates a deterrence risk that data holders may err on the side of inclusion rather than exclusion, contrary to the design.

Another enforcement risk is misclassifying data as excluded under section 9. For example, a data holder might incorrectly treat aggregated usage statistics as location data excluded under section 9(1). If an ADR disagrees and the matter goes to court, the data holder bears the burden of proving the exclusion applies. The narrowness of the communications exception means that internal notes from customer service calls may not be excluded if they relate to supply communications, but the data holder may mistakenly exclude them, leading to non-disclosure penalties.

The ACCC can also issue written directions requiring a data holder to provide CDR data in a particular form if it believes the holder is not complying with the CDR rules. Failure to comply with a direction is itself a contravention.

Given the compliance burden and the lack of cost recovery for telecom data holders, enforcement may be particularly aggressive against smaller providers who cannot afford CDR infrastructure and may be slow to implement. However, the ACCC has shown willingness to issue no-action letters or transition periods in other sectors. No such relief is provided in this instrument.

This instrument operates within the CDR framework established by Part IVD of the Competition and Consumer Act 2010. It designates the telecommunications sector specifically. The CDR rules made under section 56AC(3) of the Act set out detailed obligations, including data standards, consent requirements, accreditation, and timeframes. Data holders must comply with those rules as they exist from time to time. The instrument references the Act's definitions of "designated information", "earliest holding day", and "supply" (section 4). It adopts the definition of "associate" from section 318 of the Income Tax Assessment Act 1936, which means CDR obligations for associates are tied to that expansive definition.

The instrument relies heavily on definitions from the Telecommunications Act 1997: "carriage service", "carriage service provider", "carrier", and "communication". This ensures consistency with existing telecom regulatory concepts. However, it creates a tension: the Telecommunications Act prohibits the disclosure of certain communications under Part 13 (interception and access). The instrument's exclusion of content of communications (section 9(2)) aligns with that prohibition. But the exclusion only covers content, not metadata. The Telecommunications Act may still restrict disclosure of some metadata (e.g., call records) in certain circumstances. A carrier may face conflicting obligations: CDR may require disclosure of call usage data under sections 6 or 7, but the Telecommunications Act or its regulations may limit disclosure to third parties. The data holder would need to rely on an exemption or a waiver from the ACMA to avoid breaching the Telecommunications Act. The instrument does not resolve this conflict; it only excludes content, not metadata.

The Privacy Act 1988 applies to CDR data through the CDR Privacy Safeguards set out in Part IVD. These safeguards mirror but are not identical to the Australian Privacy Principles. For CDR data, the safeguards include restrictions on use, disclosure, storage, and destruction. The instrument adds telecommunications-specific data types to the scope of the safeguards. Data holders must also comply with the Telecommunications Act's customer privacy provisions (Part 13). The CDR Privacy Safeguards sit alongside these, not in substitution.

State and territory laws may also apply, such as consumer protection laws about unsolicited communications. The instrument does not override them. The designation may also interact with the Telecommunications Consumer Protections Code registered by the ACMA. That Code imposes rules about billing, complaints, and information provision. The CDR requirements may duplicate or conflict. For example, the Code requires providers to give customers usage alerts; CDR requires that same usage data be made available via API to ADRs. This increases the total compliance burden rather than replacing existing obligations.

Based on the text provided, the instrument is the original Consumer Data Right (Telecommunications Sector) Designation 2022, made on 24 January 2022 and commencing the day after registration. The instrument is not stated to be amended. The commencement table in section 2 covers only the original instrument. No amending instruments are referenced.

However, a thorough analysis notes that the CDR framework is subject to ongoing amendments through subsequent instruments. For example, the Minister may vary the data classes, add new sectors, or change the earliest holding day. The user's source text is the designation as originally made. It does not include later variation instruments that may have been registered. In practice, the telecommunications designation has been followed by CDR rules specific to telecoms, and those rules may have been amended. But from this instrument alone, no amendment history is available.

The instrument includes a note that the table in section 2 will not be amended to reflect later amendments. Any later amendment would be in a separate instrument. Therefore, the only reliable statement is that the instrument came into force shortly after 24 January 2022, with an earliest holding day of 1 January 2022. The absence of fee-charging classes is a notable policy choice that has not been reversed within the text.

The instrument has not been the subject of any litigated case that is mentioned in the instrument. The instrument itself contains no references to any court proceedings. Given that the instrument is only a designation specifying classes of information, direct challenge to its validity would be rare. However, there may have been litigation under the broader CDR framework (e.g., in banking) that could be relevant, but the user's source does not reference it.

Potential litigation issues that could arise from this instrument include disputes over the scope of "materially enhanced information" (section 7(3)). The phrase "significantly more valuable" is inherently subjective and likely to be contested. A data holder and an ADR may disagree on whether a particular data set (e.g., a churn prediction model derived from billing data) is excluded. The data holder must prove the three elements: insight or analysis, applied by or on behalf of the holder, rendering the data significantly more valuable. The third limb turns on a comparison of value to the source material, not to the cost of creation. Valuation disputes are fact-intensive and could lead to litigation.

Another possible litigation area is the boundary of the "communication" exclusion. Section 9(2) excludes content or substance of a communication, but includes an exception for communications related to an offer or supply between the supplier and the customer. What constitutes a "communication" in the digital age? Does an automated SMS from the provider to the customer about a plan change fall within the exception? Does a recorded call about a complaint? The definition of communication from the Telecommunications Act 1997 may be narrow (focused on transmission over a carriage service). A data holder may argue that a written email is not a "communication" under that definition, but section 9 uses the same meaning. Uncertainty creates risk of either over or under disclosure, both of which have penalties.

Finally, the "associate" definition could be challenged as overbroad. If an associate of a customer has not consented to their data being requested, the data holder might be required to seek their consent under CDR rules. Whether the associate is considered an affected individual under the Privacy Safeguards could be litigated. No cases are reported in this instrument.

Materially enhanced information test vague: Section 7(3) requires that the insight or analysis renders the information "significantly more valuable" than the source material. "Significantly" is not defined. Does a 10% increase in commercial value count? 200%? The notes say the analysis may have enhanced "usefulness, usability or commercial value". A data holder's proprietary algorithm that enriches billing data is likely excluded, but if the enrichment is minor (e.g., converting to preferred currency), it might not be "significant". Data holders cannot rely on this exclusion without careful internal documentation and willingness to defend it.

No fee recovery: Unlike the banking sector, where certain data classes can be charged for, this instrument specifies none. The note says the information "will, therefore, not constitute chargeable CDR data". This means the full cost of CDR compliance - building and maintaining APIs, data mapping, consent platforms, training, audit - is borne by the data holder without any direct revenue stream from data provision. This disproportionately affects small providers for whom these costs are a larger share of revenue. They may be forced to raise prices for all customers, not just those using CDR.

Associate data scope: Section 6(ii) covers information about an "associate" of the person or entity who has been or is being supplied. The definition from the Income Tax Assessment Act 1936 is broad and includes relatives, business partners, trustees, and entities with common control. A provider may hold personal data (health records, concession details) about a customer's spouse who is an associate. That spouse may not have consented to CDR disclosure. The data holder must manage consent separately. If the associate is unidentifiable in the data (e.g., aggregated), it may still be considered information about the associate. The definition creates privacy risks that could lead to OAIC complaints.

Earliest holding day backdated: The earliest holding day is 1 January 2022 - only a few weeks before the instrument was made. Data holders may not have stored or retained data from that date in a CDR-compliant format. If a consumer requests data from 1 January 2022 onward, the data holder must reconstruct it, subject to the accuracy requirements. The instrument imposes no obligation to retain data before that date, but any data that does exist must be provided. Data holders with auto-deletion policies for billing data could face gaps. They cannot claim they discarded the data as part of ordinary business without risk of non-compliance if they still had it at the time they discarded it after the designation commenced.

Narrow communications exception: Section 9(2)(a)-(b) excepts from exclusion communications related to an offer or supply between the supplier and the customer. But this is limited to two-party communications. If a customer communicates with a third-party service centre operated by a different entity, that communication is not excepted and should be excluded. However, the data holder might inadvertently include it in CDR data because it appears in customer records. Conversely, a data holder might exclude a supply-related communication that is not between the supplier and customer (e.g., an automated message from a network system). The error could lead to either under or over disclosure.

Location data exclusion ambiguous: Section 9(1) excludes information that would reveal "where a person was when they used a mobile product". This covers precise GPS or cell tower location at time of use. But what about billing information that shows the postcode of the customer's service address? That may not be "where a person was when they used" - it is where they are billed. The exclusion likely does not cover fixed broadband location data. Mobile users' billing addresses are also not excluded. Data holders could be pressured to disclose location-based usage summaries that, when combined with other data, effectively reveal location patterns. The exclusion only applies to information that would reveal where a person was at the time of use, not to aggregated or post-processed location data.

No sunset or review clause: The instrument does not provide for automatic expiry or mandatory review. Once in force, it remains until repealed. This means that even if the CDR framework is later modified or another sector is prioritised, the telecom designation persists. Data holders must continue compliance indefinitely. There is no mechanism to opt out if the cost outweighs the benefit.

Compliance begins with a thorough data mapping exercise to identify all information held that falls within sections 6, 7, and 8, while recognising the exclusions under section 9. Data holders must catalogue customer records, billing systems, product catalogues, and any associate data. For section 6, look at CRM systems that store customer names, addresses, dates of birth, usage history, and any data provided during sign-up (e.g., concession cards, credit checks). For section 7, examine billing systems: account numbers, invoices, payment history, usage summaries, contract end dates, and rebate information. For section 8, product databases: plan names, prices, terms and conditions, eligibility criteria, bundled services, and disability assistance offerings. The data holder must decide which billing data is "materially enhanced" and prepare documentation to support that characterisation, because the ACCC may request it.

Data holders must then implement the CDR data standards issued by the Data Standards Body. These standards specify API schemas, data formats, authentication, and consent models. Most telecom providers do not have CDR-ready APIs; they will need to either build custom solutions or procure CDR platform providers. Given the prohibition on charging fees, data holders must choose cost-effective solutions. Smaller providers may consider joining a CDR intermediary or using white-label CDR services offered by larger billing platforms.

Consent management is critical. Data holders must integrate consent flows into their customer portals and ensure that when a consumer directs an ADR to request data, the holder obtains and validates the consumer’s consent. For associate data within section 6, the holder must have processes to either exclude it unless the associate has separately consented, or to obtain consent from the associate. This may require contacting associates directly, which raises its own privacy issues.

Data holders must also register on the CDR register as data holders if they are not already (the instrument does not exempt any class). The accreditation process for data holders is simpler than for recipients but still requires compliance attestation. They must also appoint a CDR compliance officer and establish internal monitoring.

Timeframes under the CDR rules: data holders must respond to a valid data request within 45 days initially (phased down to near real-time for some data). They must provide data in the standardised format via API. They cannot refuse a request based on customer's default on payment unless the CDR rules allow it. The instrument does not provide any exemption for credit-impaired customers.

Data holders should also prepare for ongoing updates: as products change, section 8 product information must be kept current. The earliest holding day of 1 January 2022 means that if a customer requests historical data, the holder must provide it from that date if available. Data retention policies should be reviewed: if a holder would normally purge billing data after two years, they should ensure they retain it until after the earliest holding day for the period that may be requested.

Finally, data holders should consider whether their contract terms with consumers need updating to reflect CDR obligations and the potential disclosure of data to ADRs. While CDR overrides contractual prohibitions on disclosure, having express terms reduces confusion. The exclusion of chargeable classes means there is no cost recovery, so the business case for CDR compliance is purely defensive: avoid penalties and maintain consumer trust. Given the heavy compliance burden, telecom providers should model total cost and consider whether to challenge the instrument's validity or seek amendments. But as the instrument stands, compliance is mandatory.