The Consumer and Product Data Bill (‘Bill’), which introduces a consumer data right (‘CDR’) allowing consumers to request access to and sharing of their consumer data, is open for feedback. 

If passed, the Bill will enable consumers to leverage their data held by companies to make informed decisions. The introduction of a CDR paves the way for freedom of movement between suppliers, lower prices, and more competitive markets. The proposed legislation will work alongside the Privacy Act 2020’s safeguards and data security protocols. 

In November last year, it was announced that the banking sector would be the first sector in New Zealand to implement a CDR. This has been subsequently confirmed, with the Commerce and Consumer Affairs Minister Duncan Webb confirming that the banking sector will be the ‘first cab off the rank’ with the implementation of open banking, followed by the energy, finance, insurance, and health sectors.  

What is the proposed CDR?

The proposed CDR empowers consumers to request access to certain ‘designated customer data’ held by a data holder (i.e. a service provider), and to request that the data holder shares that data with another person in a secure and usable manner. A common use case of a CDR is to facilitate switching between service providers, as a CDR can remove the usual administrative barriers to switching providers, and can also give competitor service providers the ability to access and understand a consumer’s attributes, behaviour and needs, and make accurate and targeted service and product recommendations.

Data-sharing only occurs with the consumer’s explicit consent and the recipient’s compliance with standardised technology and security mechanisms. Data recipients undergo accreditation to ensure proper handling and protection of shared data. 

What can you do with the proposed CDR?

• Unleash the power of your data to find the best deals.  Electricity usage data might be used to discover the cheapest power company for your household. Banking data can be used to compare interest rates, apply for loans and switch between banks seamlessly.
• Elevate your shopping experience with personalised recommendations. Unlock curated offers tailored to your unique preferences and needs.
• Understand and reduce your carbon footprint. Transparent product data will empower you to track your emissions profile and make eco-friendly decisions.

What is needed for a successful CDR?

1. Respect for customer authority

The Bill prioritises consumer privacy and rights. Consumers have control over their data with clear consent requirements, which can be withdrawn at any time. If a consumer has authorised a request, businesses holding consumer data must comply with requests for access to or sharing of information. Consumers have electronic access to product data and are entitled to prompt responses. Both data holders and intermediary accredited requestors are required to maintain comprehensive records, develop customer data policies, and establish an effective complaints process.

2. Care of data during exchange

Streamlined measures are needed to keep data safe when it is exchanged electronically. Achieving interoperability of data standards across sectors will be a priority going forward. By implementing bank-level security for data exchanges, comprehensive protection can be achieved for personal data. However, there needs to be a balance that factors in the potential challenges that arise from extremely high-security standards. Feedback on the associated risks and challenges is sought for shaping the standard-setting process.  

3. Trust in those who access consumer data

The Bill introduces an accreditation system for intermediaries to exercise consumer data rights on behalf of a consumer. Only trusted entities with accredited status will be permitted to do this. Accredited requestors can make binding data requests, while non-accredited requestors’ demands are at the discretion of data holders.  Accreditation criteria include assessments of credibility, information protection, and security measures, and may require proof of business insurance. 

Looking forward

The proposed CDR will bring great advantages for both customers and businesses, as it encourages competition and drives innovation. However, it will also mean additional responsibilities for compliance, as well as the need for IT and regulatory adjustments. Continuous involvement and collaboration from industry stakeholders are essential to ensure the development of regulatory frameworks that promotes access to data while ensuring robust protection.

Have your say

Feedback is sought on the Bill. Consumers have an opportunity to participate in shaping the future of data sharing and privacy rights. Submissions are due 24 July 2023. If you would like assistance in making a submission, or have any questions about the proposed CDR, reach out to our consumer, data and privacy experts Hayley Miller and Campbell Featherstone, or our open banking experts Liz Lim, Catriona Grover and David Ireland. 

This article was written by Lucy Tustin, a law graduate in our corporate and commercial team.