The Australian Competition and Consumer Commission (ACCC) has announced that National Australia Bank Limited (NAB) has paid penalties totalling $751,200 after the ACCC issued it with four infringement notices for alleged contraventions of the Consumer Data Right (CDR) Rules.
The infringement notices relate to alleged failures by NAB to disclose, or accurately disclose, credit limit data in response to four separate requests made by different CDR accredited providers on behalf of consumers.
The failure to provide accurate information in relation to credit card limits impacted the service a number of fintechs provided to consumers, including some fintechs who offer mortgage broking tools using CDR data.
Using third-party providers: first decision
In Commissioner Initiated Investigation into Regional Australia Bank Limited
(Privacy) [2025] AICmr 89, the Commissioner found that Regional Australia Bank (RAB), in its capacity as a data holder in CDR, breached Privacy Safeguards 1 and 11 by virtue of the conduct of its third-party service provider, Biza.
The Privacy Commissioner has observed that where CDR functions are outsourced, businesses should review and consider opportunities to strengthen the terms of contractual agreements, especially audit and monitoring activities.
Productivity Commission review
Separately, the Government has requested the Productivity Commission to review the benefits of obtaining data through consumer access rights
If you found this article helpful, then subscribe to our news emails to keep up to date and look at our video courses for in-depth training. Use the search box at the top right of this page or the categories list on the right hand side of this page to check for other articles on the same or related matters.
Author: David Jacobson
Principal, Bright Corporate Law
Email:
About David Jacobson
The information contained in this article is not legal advice. It is not to be relied upon as a full statement of the law. You should seek professional advice for your specific needs and circumstances before acting or relying on any of the content.
