Stephen Jones (Whitlam, Australian Labor Party, Assistant Treasurer) Share this | Link to this | Hansard source

I move:

That this bill be now read a second time.

Every day of the week Australians are conducting transactions with their bank; with their shops; with their payment platforms; with insurance companies, telecommunications and electricity retailers; and on social media platforms, and on a daily basis they are producing data which is held by those companies. In some cases that data is monetised, packaged up and sold for the purposes of advertising and targeting products towards certain individuals, a typical business model in some of the social media platforms. In other cases, cases of banks and others, they might use that data to make sure that they're better providing services and service offerings to the customers who are dealing with their institution. Until the introduction of a consumer data right there wasn't a mechanism for consumers to have access to their data and use it for their own purposes. This bill will change that. The consumer data right regime sets in place a set of laws and rules which provide rights to consumers to direct the way that their data is used in a safe environment.

This bill will amend the Competition and Consumer Act 2010 to expand the consumer data right to enable action initiation, a functionality which will empower consumers to authorise, manage and facilitate actions securely in a digital environment. The consumer data right or CDR is a pioneering economic reform that gives consumers the ability to safely share the data Australian businesses hold about them for their own benefit. Australia's CDR will be rolled out across the economy with banking almost complete, energy being rolled out now and others to follow. It's the first and most ambitious way of rolling out this initiative in the world. Other countries are looking at our regime. There are other countries which have done a version of this inside one industry, so in the UK Open Banking is confined to the banking system. It's been in operation for quite some years, but nobody has taken on the ambitious project of rolling it out across the economy.

The important thing about CDR is it places consumers at the centre of a data-sharing framework that protects their privacy and gives them the ability to opt in and to determine when and how they share their data with other businesses and professionals of their choosing. Consumers can use their data for things like switching service providers, taking out a loan, applying for a new mortgage or using budgeting apps to help manage finances. Consumers can better manage cost-of-living pressures, saving time and effort in a safe and regulated environment.

It's important that data security and privacy are at the very core of the CDR. There are strict protocols, rules and other requirements to protect consumers and their data. Privacy and security considerations are key to ensuring that information within the CDR framework is held, used and disclosed securely, allowing confidence in the framework to grow—and this is a really important point. There has been some commentary, in the light of Optus and Medibank, that a CDR regime could create risks. To the contrary, a CDR regime is a safe answer to some of those risks that currently exist. It provides a safe and secure set of protocols and frameworks for enabling consumers to do things that they may be doing now in an unsafe way or don't do now because a safe protocol does not exist. To the contrary of what some commentators have been saying, this will actually enhance consumer protection, not create a risk for cyber and other data breaches.

In time, as the CDR is introduced to other datasets and sectors across the economy, consumers will gain even more capacity to extract value from their data. This bill delivers the power of action initiation to the CDR. That means consumers and small businesses will be able to securely instruct a third party—these will be known as accredited action initiators—to carry out everyday tasks on their behalf. When combined with the pre-existing data-sharing capacity—actions like opening and closing accounts, for example—making payments and applying for services will be made easier as will going to a service provider and saying, 'In all of these accounts or in all of these online environments that I operate in, please change my address, please change my phone number, please change this other piece of important information.' This is important for consumers. In fact, to the point of security, a friction point in consumers updating personal information or providing relevant information across the range of services they have is to have the time to go through account by account or service by service and update information.

This bill will enable a consumer to go to a single service provider and say, 'Please update all of my accounts.' That is of great benefit to consumers and will enhance competition, because it removes one of the friction points for a consumer—a consumer saying, 'I can't move from one account to another, or from one service provider to another, because it's just too damn hard.' A common example of this is in the banking industry. It's often referred to as the bank book tax. There's a stickiness once someone has taken on an account with a banking institution with multiple services provided by that bank. It's just too damn hard to switch providers. CDR is a game changer in this regard. Action initiation is a game changer in this regard.

The government anticipates that these changes will support a range of innovative business models. In the same way that we could not have imagined things called apps when the smartphone was invented, we can't today imagine some of the innovations and new business models that will be enabled through the initiation of the consumer data right and the initiation powers that will be brought forward in this bill. We do know that it's going to offer entirely new ways of doing things, boost competition and reduce time pressures on time poor individuals and the costs and complexity experienced by consumers and small businesses when they are carrying out everyday tasks.

The bill gives effect to the key recommendations of the inquiry into the future directions for the consumer data right to move ahead to enable action initiation.

I take this opportunity to recognise and praise the work of Scott Farrell, a truly remarkable human being. He has provided advice and service to governments of both persuasions over quite some period of time. He has been a driving force in the area of CDR. I see the member for Hume in the chamber acknowledging and agreeing with these comments. He has done a great job of work for us in the area of CDR, as he has in the area of payment systems reform, and there are linkages between these two initiatives.

This bill is going to give the minister the ability to declare actions that could be initiated using the CDR, just as the minister can already designate new sectors for data sharing.

Before making such a declaration, public consultation and analysis needs to occur and the minister needs to have regard to a range of matters, including consumer interests, market efficiency, competition, innovation and, of course, the public interest.

This process would enable the minister to require existing data holders (such as banks, energy companies or energy retailers) to become action service providers in the CDR, meaning that they would have to perform actions in accordance with valid instructions received from third-party accredited action initiators as if they came directly from the consumer.

What does all of that mean? It means that, if I as a consumer instructed a business that I've engaged to perform a service of transferring a range of banking products from bank A to bank B, the law would require those instructions to be followed by the bank as if I had given them myself directly to the bank. It will enhance competition and mobility in the banking sector and other financial services, and in energy as well.

There will also be flexibility for other organisations to apply so that they can participate voluntarily in CDR action initiation with appropriate safeguards. Accredited action initiators would need to meet strict accreditation requirements that are set by the rules—getting back to that safety and data security stuff that I mentioned earlier. They'd also be required to act efficiently, honestly and fairly when initiating actions.

The bill will also extend the existing privacy safeguards so that the privacy of CDR consumers continues to be appropriately protected.

The bill will primarily regulate what is known as the 'instruction layer'—that is, the communication channel between the accredited action initiator and the action service provider. It doesn't seek to regulate the performance of the action itself. Existing sectoral laws, like those in the banking sector, would continue to govern how an action, such as opening a bank account, must be performed. This bill doesn't affect or interfere in that.

While the bill doesn't seek to reach into the 'action layer', or the performance of the action itself, it would prevent action service providers from discriminating against a valid action request that came through the CDR. Again, what does that mean? If request A and request B came to a bank, requiring them to move a product or service from your bank to another bank, and one of those requests came from a CDR action initiator and another came, let's say, from a mortgage broker, it would be unlawful for the bank to prioritise the mortgage broker or another direct channel over a request coming from a CDR intermediary.

Importantly, it would not prevent the service provider from applying security or other checks, of course, or refusing to perform an action, provided that that action was consistent with existing practices.

Enabling action initiation in the CDR is part of the government's commitment to expand the CDR across the economy and grow opportunities for consumers to safely use their own data for their benefit. This is something that the Mark Zuckerbergs of the world have been onto for a long time. They see the value in consumer data. The consumer data right and, importantly, the action initiation, which will be enlivened by this bill, will give consumers just a smidgen of the value that the big platform providers have had out of hoovering up and using all of that customer data for their own business purposes.

Deputy Speaker Vamvakinou, I apologise for some of the manner in forming the introduction of this bill, but I inform the House that full details of the measure are contained, in the normal way, in the explanatory memorandum.

Debate adjourned.