Consumer Data Right: what you need to know

What is the Consumer Data Right?

The Consumer Data Right (CDR) refers to the right of a consumer to control who can access and use their personal data.

As a consumer, businesses hold a lot of information about you – from how you spend money to how you heat your home. While businesses get huge value from using this information, you’re unable to benefit from it. You can share your personal information with a third party, but it’s time consuming and requires you to manually request and pass this personal information on.

The establishment of the CDR aims to correct this imbalance by removing friction in the sharing of information between accredited parties in designated sectors, giving you greater control over how your personal data is used and shared.

Open banking is the first application of the CDR

Banking is set to be the first sector in which the CDR will be established, resulting in the introduction of open banking.

With open banking, you’ll be able to grant third parties access to your financial information. Your data can then be used by third parties provide budgetary analysis, make payments to businesses, or to simplify the process of switching banks.

By adopting an open approach to data through the CDR, it’s hoped that New Zealanders will be able to use their data to get better value and better service. In addition, the CDR should create opportunities for innovation and competition as new players emerge to offer services not currently on the market.

How will the CDR impact me?

The CDR will mean you can get a business to grant another business access to your personal information. We’ve listed some ways you might benefit from data sharing below.

• Budgeting: Based on the budgeting apps created in other open banking markets, such as the UK, you’ll be able to use tools to better understand your spending, boost your credit score, and even automatically invest your money.
• Paying: You’ll be able to authorise third parties to initiate payments. By paying businesses using your bank account, you’ll avoid debit and credit card surcharges and account-to-account services like POLi that can potentially breach a bank’s terms and conditions.
• Shopping around: You’ll be able to find better, more personalised offers by sharing data with price comparison services, such as how much electricity you use, and when you use it.
• Switching: Once you’ve found a better deal, you’ll be able to tell your existing bank or power provider to share your data with a prospective new provider, making switching faster and easier.

What needs to happen before we have the CDR?

For businesses to share customer data with each other, they need to organise it in a way that can be understood by other businesses. There isn’t much incentive for businesses to spend time and money doing this – the data might be used to help a customer get a better deal elsewhere, after all – so a regulatory framework is required to compel businesses to organise their data in line with other players.

To implement the CDR, the Government must pass the Customer and Product Data Bill, which is currently before Parliament. The bill will establish the regulatory framework which will dictate how data is accessed and shared in designated sectors.

Importantly, we cannot allow businesses to share our data with just anyone, so in addition to ensuring that businesses can access and sharing customer data, it’s also important that consumers’ privacy and security are not compromised. To ensure that data is only shared with trusted parties, MBIE has proposed an accreditation regime. Accredited third parties will be required to meet various criteria, including detailed security requirements.

To enforce these regulations the bill sets out penalties for breaches, ranging from up to $20,000 for minor breaches, and up to $5 million for more serious breaches.

The Customer and Product Data Bill is currently moving through Parliament, having passed its first reading with unanimous cross-party support in July 2024. It’s not clear how long this process will take, but according to Commerce and Consumer Affairs Minister Andrew Bayly, open banking could be in place by the end of 2025. The Commerce Commission is currently seeking feedback on how the CDR could be established in the electricity and banking sectors, with the intention to apply it to other sectors such as insurance and telecommunications in future.

What does Consumer NZ think about the CDR

Consumer has been calling for the CDR and open banking for years, which you can read more about in our submission on the Customer and Product Data Bill.

We believe that the CDR could lead to increased competition and innovation, and reduced costs, in sectors that badly need them.

However, while we support the bill in principle, there are risks that must be mitigated such as the potential for new types of scams. We believe open banking will increase New Zealand’s already dire need for greater consumer protection in the banking industry.

Greater privacy protections are needed too, so consumers have confidence and trust in the system. In our view, our current privacy regulations are not strong enough and should be aligned with Europe’s data protection regulations to ensure the best outcomes for consumers.