The Competition and Consumer (Consumer Data Right) Amendment Rules (No. 1) 2023 have been registered to amend the Competition and Consumer (Consumer Data Right) Rules 2020 to allow consumers to have more choice over who they can consent to share their data with.

The Amending Rules enable businesses to consent to accredited data recipients (ADRs) sharing their CDR data with specified persons who are not accredited, like bookkeepers, consultants and other advisers who are not classified as trusted advisers under the current CDR Rules. It also allows disclosures to the wide range of software providers that offer services to small businesses in Australia.

Before disclosing the business consumer’s CDR data in response to a “business consumer disclosure consent”, ADRs must take reasonable steps to confirm that the consumer is either not an individual or that they have an active ABN. The business consumer must provide the ADR with a business consumer statement that certifies that the consent is given for the purpose of enabling the ADR to provide goods or services to the business consumer in its capacity as a business and not as an individual.

The Amending Rules extend the maximum duration of certain use and disclosure consents given by a CDR business consumer to an ADR from 12 months to 7 years. While 7 years is the maximum duration, it is possible for a shorter consent period to be selected, and it is also possible for the CDR business consumer to withdraw their consent at any time.

The Amending Rules enable data holders in the banking sector to publicly offer small scale pilot products (for up to 1,000 customers and for a 6-month maximum duration) without being subject to data sharing obligations.

If you found this article helpful, then subscribe to our news emails to keep up to date and look at our video courses for in-depth training. Use the search box at the top right of this page or the categories list on the right hand side of this page to check for other articles on the same or related matters.