Consumer data must be provided on request to consumers or directly to a designated third party in order to exercise a number of rights, summarised as the Comprehensive Right to access and use digital data. This Comprehensive Right would enable consumers to:
- share in perpetuity joint access to and use of their consumer data with the data holder
- receive a copy of their consumer data
- request edits or corrections to it for reasons of accuracy
- be informed of the trade or other disclosure of consumer data to third parties
- direct data holders to transfer data in machine-readable form, either to the individual or to a nominated third party.
Where a transfer is requested outside of an industry (such as from a medical service provider to an insurance provider) and the agreed scope of consumer data is different in the source industry and the destination industry, the scope that applies would be that of the data sender.
The Government agrees in principle with this recommendation.
Consumers will benefit from having more control over their digital data. This in turn will increase competition in a range of markets and foster innovation from businesses to offer consumers greater choice and new kinds of products and services.
A Consumer Data Right will be established that will enable consumers, including individuals and small-medium enterprises (SMEs), to access their data, or to direct that their data be provided to third parties (recommendation 8.1 refers).
The Consumer Data Right will be implemented on a sector-by-sector basis, commencing initially in the banking, energy and telecommunications sectors. Implementation of the Consumer Data Right will be informed by the Independent Review into Open Banking, which is due to report to the Government by the end of December 2017.
Correction and transparency rights over data will not be implemented under the Consumer Data Right. The Privacy Act 1988 already contains similar correction and transparency rights for individuals, and these will not be expanded to apply to SMEs. The Consumer Data Right will be designed to operate alongside the existing personal information access mechanisms available to individuals under the Privacy Act 1988.
The Productivity Commission’s views on the transfer of data to third parties outside of a sector will be considered when the Consumer Data Right is designed in legislation.
Lead Agency: The Treasury