Consumer Data Right on the Way

The Government has decided to establish a Consumer Data Right (CDR) in New Zealand to give individuals and businesses greater choice and control over their data.

A CDR is a mechanism which enables consumers to securely share data that is held about them with trusted third parties. For example, it would allow a consumer to freely and securely share information that is held about them by a bank with another bank or a financial service/app.

The CDR will be rolled out on a sector-by-sector basis, with the Government designating individual markets, industries and sectors to which it applies. Primary legislation will create the overarching framework of the consumer data right, introducing basic obligations that will apply to those within a designated sector. Designations will specify the type of data that is covered and the functionality that is enabled. For example, if the banking and financial services sector were designated, this could apply to specific data such as bank account information and transactions. More detailed obligations will be set out in rules and data standards.

Security and privacy of consumer data will be of prime importance in the creation of a CDR. To protect the security of data transfers, consumer privacy and commercial confidentiality, third party data recipients will need to be accredited and a range of information protection safeguards will be introduced.

Consumer consent and control of their data will be central to the CDR. Consent must be express (i.e. through a clear opt-in), informed and time-limited, and consumers must be given the ability to review and amend or withdraw consent at any time. Consent for any purpose beyond providing the goods and services the consumer has requested must be optional.

Consumers will be able to consent to:

• Read access – the ability for an accredited person to read consumer data
• Action initiation – the ability for an accredited person to carry out an action with the consent of a consumer.

Action initiation will allow consumers to, for example, ask a third party payment provider to action a bank funds transfer from the consumer’s bank account to a business’s bank account when paying for goods or services.

Later in 2021 the Government will make further decisions about the implementation of the CDR. This will include decisions on which institutions have a role in implementation and developing rules and standards, and measures for enforcing the CDR. The Government will also consider which sectors should be assessed first for the potential application of the CDR.

A Bill implementing the Consumer Data Right will be introduced to Parliament in 2022.