CDR Accredited Data Recipient: Banking Sector Accreditation Process

CDR statutory framework

The Consumer Data Right (CDR) is established under Part IVD of the Competition and Consumer Act 2010 (Cth), inserted by the Treasury Laws Amendment (Consumer Data Right) Act 2019. It enables consumers to choose to share data held about them by designated data holders with accredited data recipients. See also CDR data holder accreditation banking.

The CDR is rolled out sector by sector. It is active in banking and energy, and non-bank lending is to follow as the third sector.

Treasury leads CDR policy, including development of the CDR Rules, and within Treasury the Data Standards Body develops the standards that prescribe how data is shared. The two regulators are the ACCC, which runs the accreditation process and the CDR Register and enforces compliance with the Rules, and the OAIC, which regulates privacy and confidentiality and handles complaints and notifications of eligible data breaches relating to CDR data (cdr.gov.au).

Accreditation tiers and criteria

A business that wants to receive CDR data as a data recipient generally applies to the ACCC for accreditation through the CDR Participant Portal. The ACCC may accredit the applicant, accredit it with conditions, or refuse accreditation. Once accredited, the recipient must pass CDR Register on-boarding, including conformance testing, before it can share data.

To be accredited, applicants must demonstrate that they are a fit and proper person to manage CDR data; have taken steps to adequately protect data from misuse, interference, loss, unauthorised access, modification or disclosure; have internal dispute resolution processes meeting the CDR Rules (for most applicants, consistent with ASIC Regulatory Guide 271); belong to a relevant external dispute resolution scheme; have adequate insurance to compensate consumers for loss from a breach of the recipient's obligations; and have an Australian address for service.

In banking, authorised deposit-taking institutions that are not restricted ADIs meet the criteria for streamlined accreditation. The ACCC publishes accreditation guidelines, including supplementary guidelines on insurance and information security.

Alternative access models

The CDR Rules also provide for sponsored accreditation (the ACCC publishes a separate sample application for it), CDR representative arrangements and CDR outsourced service provider arrangements. Accredited data recipients must tell consumers about any affiliate and sponsor arrangements that may apply and keep records of any outsourced service provider, sponsorship or CDR representative arrangements.

Each of these models is subject to the consent, notification and record-keeping requirements in the CDR Rules.

Ongoing obligations and enforcement

Accredited data recipients must comply with the 13 CDR Privacy Safeguards in Part IVD of the Act, which cover matters including open and transparent management of CDR data, anonymity and pseudonymity, collection, notification, use and disclosure, direct marketing, overseas disclosure, government related identifiers, data quality, security and destruction of redundant data, and correction. The OAIC publishes the CDR Privacy Safeguard Guidelines.

Recipients must also keep prescribed records (rule 9.3(2) of the CDR Rules) and provide periodic reports to the regulators, including attestation statements and verification (assurance) reports on information security within set timeframes. Eligible data breaches involving CDR data must be notified to the OAIC.

The ACCC and OAIC jointly monitor compliance with and enforce the CDR framework, and can take enforcement action where breaches are identified. Consumer complaints about the handling of CDR data are made to the OAIC.