Open Banking available to Australian Businesses
New CDR Business Consumer Provision
Consumer Data Right has taken a step further in Australia with the Competition and Consumer (Consumer Data Right) Amendment Rules (No. 1) 2023 introduction of new rules that apply to CDR business consumers. The new provisions outline for CDR participants how business consumers can now participate in CDR and how they should be dealt with under these new CDR rulings. These new provisions account for stakeholder feedback from Treasury’s exposure draft of the Amending Rules released in September 2022.
Two Newly Added Functionalities
With commencement beginning on the 28th of November 2023 accredited persons can now deal with CDR consumers in the capacity of CDR business consumers with two brand new functionalities added for CDR Business Consumers.
Distributing a ‘business consumer disclosure consent’ which now enables CDR business consumers to share their data with a broad range of individuals, including unaccredited third parties (CDR Rules, Rule 1.10A(11).
Providing certain use and disclosure consents with a maximum duration of up to 7 years, increased from the 12-month maximum (CDR Rules, Rule 4.12(1A).
These new functionalities allow accredited persons to now ask:
Business consumer statements (Use consents relating to goods and services requested by the CDR business consumer, Trusted Advsier (TA disclosure consents, Insight Disclosure Consents, Business Consumer Disclosure Consents)
Ask for certain consents with an extended maximum duration of 7 years
Business Consumer Disclosure Consent
Previous rulings required that businesses were only able to share data with‘Trusted Advsiors’ as defined 1.10C of the Competition and Consumer (Consumer Data Right) Rules 2020. These ‘Trusted Advisors’ are considered as professional advisors such as qualified accountants within the meaning of the Corporations Act 2001, lawyers who hold a current practising certificate under a law of a State or Territory that regulates the legal profession or mortgage brokers within the meaning of the National Consumer Credit Protection Act 2009.
Under the new provisions, businesses gain the ability to authorise from their own accord or through an ADR the sharing of Consumer Data Right (CDR) data to those whom are not ‘Trusted Advsiors’. Specifically, they can now extend this privilege through the ‘Business Consumer Disclosure Conset’ to specified individuals or entities - ranging from unaccredited third parties to bookkeepers, consultants, and other advisers. Importantly, these recipients need not hold formal accreditation status. The Business Consumer Disclosure Consent empowers businesses to selectively share their data for essential business services, fostering greater flexibility and efficiency within the CDR framework.
Business Consumer Statements
A ‘business consumer statement’ outlines made by a CDR business consumer certifying that certain consents are provided for the purpose of allowing an accredited person to provide goods and or services to the CDR business consumer in its capacity as a business (not an individual). Obtaining a business consumer statement is required for accredited individuals wishing to rely on certain consents from CDR business consumers with an extended maximum duration of up to 7 years. The accredited person must obtain this statement before using or disclosing CDR data on behalf of the CDR business consumer in the capacity as stated beforehand.
A business consumer statement can only be given in relation to the following types of consents:
• Use consents relating to the goods or services requested by the CDR business consumer
• Trusted adviser (TA) disclosure consents
• Insight disclosure consents
• Business consumer disclosure consents.
Extended Maximum Duration for Certain Use and Disclosure Consents
Previous rulings stated that content for consent to data being shared was for a maximum length of 12 months. This saw strong feedback from members regarding this rule as 12 months was inconvient for business especially in regard to record keeping requirements.
Now the new maximum duration of consent given by CDR business consumers will change based on:
If consent is one of the use or disclosure consents discussed in the Business Consumer Statements with its maximum duration being 7 years.
Otherwise, the maximum duration of the consent is 12 months.
It must be noted that even if a CDR business consumer has given one of the use or disclosure consents which include a business consumer statement having a maximum duration of 7 years, a related collection consent for the specified CDR data must be renewed every 12 months.
