Published on the 03/09/2020 | Written by Jonathan Cotton

Consultation begins on national consumer data right…

Businesses are good at collecting user information. And as the digital revolution rolls on (and as the Covid-19 pandemic accelerates digital adoption), they’re collecting more of it all the time. Now the New Zealand Government is wondering whether it’s time to make that user data available to the consumers themselves.

The Ministry of Business, Innovation and Employment (MBIE) has released a discussion document for a national Consumer Data Right and is inviting submissions from the public. The feedback will help the Government determine how such a system would work in New Zealand – and indeed, whether New Zealand even needs such a right.

“This will increase competition and innovation and lead to reduced prices and improved product offerings.”

Australia, of course, already has a consumer data right system underway. The CDR for the banking sector is live now, with more industries due to be added soon. In May the ACCC – central rule-maker, consumer educator, and enforcer of the scheme – published its compliance and enforcement policy which threatens everything from infringement notices to accreditation revocation to court proceedings for failing to meet the requirements of the data right.

There are, of course, good reasons for liberating user data from private sector silos: Increased innovation, more robust competition, stronger privacy controls and increased productivity, just to name a few.

MBIE says a consumer data right could give individuals and businesses access to a wider range of products and services, reduce search and switch costs, facilitate competition, encourage innovation, increase productivity and help build the digital economy.

“Establishing a CDR would give consumers greater choice and control over their data in new ways with trusted third-party providers,” MBIE says.

‘Third parties’ could mean anything from apps that make it easier for consumers to compare products across – and seamlessly change between – service providers, to managing their finances better across multiple providers.

“This will give rise to new products and services, allow consumers to compare products more easily, seamlessly switch product providers and transact with greater convenience. This will increase competition and innovation which, in turn, will benefit consumers by leading to reduced prices and improved product offerings.”

In New Zealand, there are currently no requirements around the formatting of shared data, with the Privacy Act 1993 being the main mechanism for regulating the collection, use and disclosure of personal information.

Voluntary, industry-led initiatives have been slow to progress. In January, Commerce and Consumer Affairs Minister Kris Faafoi threatened direct government intervention if New Zealand’s banks didn’t hurry up and ‘voluntarily’ implement open banking principles and systems. While there has been progress in developing industry API standards, there has been very limited implementation of the standards, and few partnerships between API providers and third parties formed.

So, what are the options for New Zealand?

The document offers four scenarios for comment, ranging from ‘do nothing’ to economy-wide changes:

Option one: Maintain the status quo
Continue to rely on existing protections and industry-led solutions. The government would not introduce a consumer data right and the development of consumer data portability would be left to individual businesses or sectors.

Option two: A sectoral-designation approach
A legislative framework that can ‘turn on’ a consumer data right in sectors (similar to what is currently being rolled out in Australia). A high-level framework would be established in legislation that would apply across the entire economy, but the CDR would only apply to sectors or markets that had been designated through secondary or tertiary legislation.

Option three: An economy-wide consumer data right
Similar to the GDPR, this would establish an economy-wide consumer data right based on existing privacy protections.

Option four: Sector-specific approach
Under this option, distinct CDRs could be designed for specific sectors as the need arose. This option would effectively be an extension of sector-led initiatives that are underway in New Zealand.

New Zealand is behind the global trend on consumer data regulation. Several jurisdictions have already attempted legislative reform to promote consumer data portability and strengthen existing privacy rights. The UK has bought a consumer data right to bear on the finance sector, and the EU’s GDPR came into effect in 2018 with the aim of strengthening data protection rights for all individuals within the European Union. That regulation gives individuals the right to receive copies of their personal data in structured, commonly used, and machine-readable formats and ensures the right of individuals to transfer this data to trusted third parties.

The Australian Consumer Data Right was introduced last year, but progress has been slow.

The first sectors to be designated were the banking and energy sectors, with phase one of open banking going live in July this year. Covid-19 delays notwithstanding, consumer mortgage and personal loan data are scheduled to become available for data sharing this November.

Following that, the telecommunications and superannuation sectors are likely targets for CDR will implementations, with the insurance sector another proposed candidate.

Submissions for New Zealand’s Consumer Data Right close at 10am on Monday 5 October 2020, with recommendations to the Minister scheduled for late 2020.