Dear <<First Name>>, 

Thank you for your continued interest in the Consumer Data Right (CDR). We would like to provide updates on a number of recent developments.

Ecosystem testing

All participants have entered industry testing, which includes functional, process and workflow elements. So far six data recipients and all four data holders have now completed connectivity testing. The ACCC is working closely with data recipients to provide information and assistance on accreditation and testing.

Managed Rollout is currently being planned in collaboration with testing cohort participants, and will occur in May and June before the official launch of CDR on 1 July 2020. Consistent with the published 2nd Stage Testing and Assurance Strategy, Managed Rollout aims to manage risk associated with implementing CDR. The approach is complementary to the Industry Testing activities occurring presently, and aims to effectively manage risk as functionality is deployed into live production by the participants.

The proposed approach to Managed Rollout is based on progressively opening up the ecosystem in production with increasing levels of exposure to real customers and monitoring usage and issues at each stage as we prepare for full launch on 1 July. To support this process, we intend to launch the Register & Accreditation Platform by mid-April, after a further round of penetration testing. The Register & Accreditation Platform will be used to accredit data recipients and verify the identity of data holders and accredited data recipients.

The approach proposed is consistent with existing data holder approaches for complex IT deployments, as well as reflecting the approach taken in the UK for launch of open banking by the Open Banking Implementation Entity (OBIE).

During Managed Rollout, all CDR rules and standards that will apply to mandatory consumer data sharing from 1 July will apply, including the requirements for consent and secure transfer of consumer data in the manner prescribed by the information security standards. In order to participate in Managed Rollout, a data recipient will need to be formally accredited, such that all obligations of ADRs will apply, including IT security requirements for CDR data.

First Data Recipient accredited

We are pleased to announce that Regional Australia Bank is the first participant to be granted accreditation as a Data Recipient. Regional Australia Bank’s accreditation will take effect when it is placed on the CDR Register.

Recent CDR publications

On 20 March 2020, the ACCC published guidelines for applicants seeking exemption under section 56GD of the Competition and Consumer Act 2010 (Cth) (CCA) and a CDR Frequently Asked Questions (FAQs) document.

CDR s56GD exemption guidelines

Section 56GD gives the ACCC broad discretionary power to exempt a person from one or more of the provisions in the CDR regime.

The guidelines set out how the ACCC will approach and interpret section 56GD in deciding whether or not to grant an exemption and under what conditions (if any). Exemptions are not intended to be used as a remedy for general non-readiness to meet CDR obligations. Exemptions can take into account the unique circumstances surrounding a company’s participation in the CDR ecosystem. For example, a data holder wanting to participate in the CDR regime early may seek an exemption such that only a subset of its brands participate.

The guidelines are available at: CDR guidance for applicants seeking exemption under section 56GD.

CDR frequently asked questions

The FAQs document provides a simple overview of various processes under the CDR regime, anticipating some of the likely common questions that may arise from stakeholders.

The FAQs are available at: CDR interagency FAQs.

Consultation on phasing, intermediaries and ADR-ADR transfer

The ACCC’s consultation on the proposed timetable for participation of non-major ADIs in the CDR, and on facilitating participation of intermediaries, has concluded. We received a number of submissions from each process. Submissions relating to intermediary participation will be published on the ACCC’s website shortly. We are planning to provide further details on the non-major ADI timetable, and advice on our proposed approach to including intermediaries in the CDR ecosystem, in coming weeks.

Engagement with data holders

The ACCC and the Data Standards Body (DSB) have commenced a series of meetings about all things CDR; initially principally aimed at data holders and their implementation partners. The meetings are expected to expand to a broader audience over time. They are hosted by DSB every Thursday by phone and Webex. More information is available on the DSB website.

Product reference data for non-major ADIs

All stakeholders are reminded that the obligation for non-major ADIs to share Product Reference Data for Phase 1 products commences on 1 July 2020. Data holders have certain reporting requirements in relation to Product Reference Data sharing under the Rules. In addition, certain information will be reported via Admin APIs, as set out in the data standards. The ACCC notes that admin APIs may be deployed in a staged approach, but they must be available in time for the commencement of consumer data sharing.

CDR Division update on coronavirus developments

Like many organisations around the world, the ACCC’s COVID-19 contingency planning responses are evolving rapidly at present. The ACCC understands that CDR participants’ staff will increasingly work remotely, minimise travel and reduce attendance in-person at meetings and events.

The ACCC expects that responding to the COVID-19 pandemic will require changes to our ways of working across the CDR community (for example, by utilising video and phone conferences), and we are currently in discussions with participants to determine what measures are appropriate to ensure we continue to deliver the program schedule.

The ACCC will continue to review COVID-19 developments and keep participants informed of developments relevant to the program.

Kind regards,

Paul Franklin

Executive General Manager

Consumer Data Right Division

Australian Competition and Consumer Commission (ACCC)