Jenny McAllister (NSW, Australian Labor Party, Shadow Cabinet Secretary) Share this | Link to this | Hansard source

Technology has substantially changed the nature of Australia's economy. Companies that previously saw their core business merely as selling goods or services increasingly recognise the value that is embodied in information about their customers. The result has been a profusion in both the types of data collected about ordinary Australian consumers and the ways in which it's collected. This trend is only likely to accelerate. Just a few years from now, Australians may have their data collected by devices that they never previously considered smart, and sent to companies they never previously viewed as tech. As one submitter to the Senate committee inquiry into this bill noted:

Continued advances in artificial intelligence (AI) and cloud technologies, together with growth in connectivity through the proliferation of Internet of Things devices, could have profound impacts on global commerce …

We should be clear-eyed about what this means: More data may mean more personalised services offered in more convenient ways to more consumers. It may also mean our data being used in ways that we never previously thought possible—perhaps a credit bureau combining information about the type of takeaway we eat with our fitness tracker data, to predict how healthy we'll be in a decade; or a bank looking at the data on driving patterns from a smart car to assess just how risk averse we are. These engage more than just privacy concerns. Each dataset that is collected represents real economic value to the company that collects it, and the result is that the collection of proprietary data can help cement a market position and lead to less competition in crucial sectors.

It poses a novel regulatory challenge. Existing regulatory schemes are, of course, capable of providing some guidance to commercial parties and some protections to consumers. However, they are fundamentally designed to address different problems from a different time. Other jurisdictions have acted to address this challenge—most notably the UK and the EU. This legislation does not go as far as either. It simply establishes a framework for consumers to access and transfer data between businesses. As I will go on to discuss, it is not a comprehensive framework for controlling the use of personal information. However, this bill is an important first step in creating a common understanding about how personal data can be treated and, if properly administered, will have real impacts in the long run on competition in crucial market sectors in Australia.

This bill amends the Competition and Consumer Act 2010, the Privacy Act 1988 and the Australian Information Commissioner Act 2010 to introduce a new framework for a consumer data right. This framework will allow organisations, individuals and businesses more control over the data held on them by certain organisations. They will be given the ability to access that data and to share it and, if they choose, to share it with accredited and trusted third parties. This framework is intended to be progressively extended and rolled out across different sectors of the economy, initially in banking, with energy and telecommunications to follow later.

Under the framework, the ACCC will be empowered to set rules, accredit participants, oversee data standards and take enforcement action when consumers' rights are being seriously or systemically breached. Technical standards will be set by a data standards chair, advised by a data standards body. This body—initially the CSIRO's Data61—will be responsible for working with business and consumers to ensure that the framework is implemented effectively and efficiently. Individual privacy will continue to be the remit of the Australian Information Commissioner who will have responsibility for enforcing privacy safeguards around the framework and providing complaint-handling for breaches of the privacy safeguards.

The bill will also extend the protections under the Privacy Act 1988 to cover data held by small businesses if those small businesses are accredited data recipients under the consumer data right framework. The consumer data right has the clear potential to increase consumer choice and competition. There are benefits for banking and financial services, which will be the first sector affected by the rollout. It will make it easier for consumers to change providers. As CHOICE noted in their submission to the Senate inquiry, consumer advocates have been strongly supportive of the spirit and intention of the bill. The CDR was conceived to empower consumers through improved access to their data and to facilitate consumer mobility between products and services.

One of the disincentives for customers in shopping around for a better product is the difficulty of transferring their information and data across with them, and it's very apparent in the finance sector. Half of all Australians are still customers of the very first bank they opened an account with. Increased competition may lead to better products and services for all consumers, not just those who choose to switch providers. Access to consumer data may also allow the development of new tools to allow people to make the most of the ability to change providers. There are thousands of credit and other financial products available. Most people do not have the time to properly assess which is the most suitable for them. Even if they do, many don't have the skills or the information to make that assessment. Giving consumers control over their data may facilitate the development of tools to help them do this, as well as services that may allow them to budget better and manage their financial lives. We can expect to see similar products and services being developed in sectors other than banking as the CDR regime is applied to other sectors in the economy.

This is clearly important legislation. Throughout the Senate inquiry process, we heard concerns from numerous stakeholders about the rushed nature of the policy process. The BCA, the Law Council of Australia and the Communications Alliance, just to name a few, all had concerns about the time lines for the development and implementation of this legislative framework. The government's haste manifested in a number of ways. Firstly, the shortened time lines for the development and implementation of the legislation; secondly, the fact that this legislation was drafted in parallel to the consumer data right rules, which will be administered by the ACCC; and, thirdly, the technical standards which are overseen by Data61 and the data standards body. There's nothing essentially wrong with doing things in parallel. Developing policy in tandem can allow collaboration and adaptation between groups. But stakeholders had concerns that there was not sufficient time given to ensure that, for each of the workstreams, they were actually complementary, and concerns that a coherent regulatory framework may not be the end product. Stakeholders were also concerned there wasn't sufficient opportunity to understand the interlinkages between these tranches of work.

Thirdly, stakeholders were very concerned that there had been insufficient consumer testing. Consumer behaviour—how consumers respond to this regulatory framework—is a very important part of the regulatory framework. Consumers will only exercise their rights under this legislation if they both understand what the purpose of the scheme is and are satisfied with the level of consumer and privacy protections. As the Australian Banking Association observed in their evidence to the committee:

Consumer education will be a critical part of this, remembering this is about putting the customer in the driver's seat in control of their information to authorise that sharing with another provider, so it is very much designed to benefit all customers.

Of course, the fourth concern was the very short time frame for a Senate inquiry: just five weeks from open to close. We on this side of the chamber are concerned that it is politics, not policy, that is driving these compressed time frames. The substantive policy issues that this bill addresses have existed for years. The government has previously taken no real steps to address them. One representative of an energy company gave evidence to the committee saying:

I don't understand why the legislation appears to be rushed. It would seem that we are rushing this legislation to allow banking to be implemented as quickly as possible.

That raises a few questions, doesn't it? It raises a question about whether the government is rushing this legislation in order to provide cover for its total failure to take timely action in response to the recommendations of the banking royal commission.

As I alluded to earlier, this bill is not the last word, by any means, on consumer data rights and protections. More will need to be done to ensure that Australians have control over their data and their privacy. In the first instance, the government will need to monitor the rollout of this framework to ensure that it does not have unintended consequences for vulnerable Australians. As the New South Wales Energy & Water Ombudsman noticed:

The biggest concern is vulnerable customers. They seem to be on the receiving end of what doesn't go right, and they don't get the benefits of new technology that might drive prices down.

I want to be clear about the dynamic that's being described here. Increased access to consumer data has the potential to enable private sector businesses to segment markets into more profitable and less profitable cohorts. For less profitable cohorts, this may mean increases in cost or decreases in the services available to them—and there is an indication that that is already happening in some parts of the energy market. There are significant risks that vulnerable customers could be, directly or indirectly, excluded from essential services provided in the private sector.

These concerns were raised by the Financial Rights Legal Centre in their evidence to the Senate inquiry. They said:

Those experiencing financial hardship are often very profitable to debt management firms and fringe financial service providers and therefore most vulnerable to exploitation. Those in more precarious financial situations are more likely to be unfairly charged higher amounts or pushed to second tier and high cost fringe lenders.

This is the consequence of excluding low-income people from mainstream services, and it needs to be part of the government's thinking about how the private sector is going to use the vast quantities of data that are already available in the market. The consumer data right is a new regulatory framework. It should not be set and forget. The government will need to be actively monitoring and responding to emerging situations to avoid problems such as this. There will be further regulatory interventions needed in the future to deal with other aspects of the data economy.

The ACCC's recent Digital Platforms Inquiry supported a range of improvements to privacy protections. Amongst other things, it recommended giving consumers a 'right to delete' across the economy—that is, allowing consumers to require data holders to erase their personal information. The inquiry recommended introducing direct rights for individuals to bring court actions against organisations that violate their privacy. It recommended raising penalties for breaches of the Privacy Act. It recommended strengthening consent and notification requirements and prohibiting unfair contracts. We would encourage the government to consider these recommendations to help build a safer information economy.

Labor is also concerned about the rise of screen-scraping technology. Some financial service companies are asking customers to provide them with sensitive login information and scraping the data off their screens. This can potentially lead to customers violating their banking terms of service and have other consequences. While other jurisdictions, such as the UK, have banned the use of screen-scraping, the government is yet to act.

We support this bill and the benefits it will bring to competition in the banking market. It will create new rights for consumers to direct the transfer of their data. Labor has listened to consumer groups who have raised concerns about a consumer's right to have their own data deleted in certain circumstances. And, as I noted earlier, these concerns are echoed by the ACCC. We have secured a commitment from the government that consumers will be given the right to have their data deleted. An amendment to this legislation will be moved by the government after the winter break to give effect to this commitment.

Although we support this bill, it is only a partial response to the changes that have overtaken the Australian economy. The growth in the collection of data about Australian consumers has clear privacy, competition and productivity issues, and these are issues that the government should address in a more substantive way in this, their third term. The government has shown very little inclination to deal with policy challenges facing Australia. They have no energy policy. They have no policy for wages growth and they have no policy on climate change. The government's preference seems to be to occupy the Treasury benches without doing the work that comes with it. Australia can only hope that this changes.

Jane Hume (Victoria, Liberal Party, Assistant Minister for Superannuation, Financial Services and Financial Technology) Share this | Link to this | Hansard source

Firstly, I'd like to thank senators who have contributed to this debate. In order to further strengthen the privacy provisions in the bill, the government has agreed with the opposition to make a further change to ensure that rules under the scheme contain a requirement for an accredited data recipient to delete a consumer's data if requested. The circumstances in which this requirement is exercised will be established in the rules and may vary from industry to industry. I table the text of what will be a new bill that the government will introduce in the next sitting period, which will amend this bill. I want to thank the opposition in working with the government to ensure the passage of this bill today, which will give certainty to the industry that they have been asking for. I commend this bill to the Senate.

Question agreed to.

Bill read a second time.