The Ministry of Business, Innovation, and Employment (‘MBIE’) has released a discussion document on consumer data rights for New Zealand – whether such rights are needed and what form such rights should take.

What is a consumer data right?

A consumer data right is the statutory ability for a consumer to freely and securely share their data, held by one person (for example, their bank), with a trusted third party (for example, another bank the consumer is interested in doing business with). This concept is known as “data portability”.

Data portability should ensure a consumer’s data can be better used for the consumer’s benefit. It will enable a consumer to switch between, or manage, different products and services available to them to better meet their needs, and therefore foster greater competition in the market place.

Internationally, variations of data portability are some times only available in limited sectors, such as through “open banking”. With open banking, a consumer can direct their bank to share their data with a trusted third party. A consumer data right is broader, as a consumer can share their data with almost any entity, such as telecommunications or energy companies, and it is possible for the third party to modify such data, rather than merely accessing it. This is closer to the European Union’s General Data Protection Regulation (GDPR) version of the right to data portability.

The current New Zealand position

In New Zealand, the current position is that consumer data portability is limited and there is no legislative framework for it.

The only industry-led initiative in the banking sector is the API Centre. The API Centre was launched in early 2019 by Payments NZ, which is primarily owned by the big four banks (ANZ, ASB, BNZ, and Westpac). The API Centre provides common payment initiation and account information standards to registered users for the sharing of consumer data. Banks, non-bank deposit-takers, entities regulated by the RBNZ, and third parties can register as standard users. Participation is voluntary.

The Minister for Commerce and Consumer Affairs, Hon Kris Faafoi, has been concerned about the lack of progress in this space, which brings us to the MBIE discussion document.

MBIE discussion document

At a high level, the MBIE paper sets out four options for New Zealand:

Option one: Maintain the status quo

No government intervention and industries are left to develop their versions of data portability at their own pace (as is currently the case).

Option two: A sectoral-designation approach

High-level legislative framework that would apply across the whole economy, but with consumer data rights applying only to certain sectors or markets through additional legislation. This approach is similar to the Australian position (more on this option further below).

Option three: An economy-wide approach

A general consumer data right established across all sectors of the economy. This approach would be similar to the GDPR, where standardised data portability and greater data protection is legislated.

Option four: A sector-specific approach

Different consumer data rights for individual sectors implemented as the need arises.

As option two is most likely to meet MBIE’s assessment criteria, we delve deeper into the Australian consumer data right below.

The Australian position

Australian consumer data right rules came into effect this year, and currently apply to the banking sector. In time, these rules are intended to apply to the energy and telecommunications sectors. As of 1 July, customers of the four major banks can request their bank share their data for deposit and transaction accounts, and credit and debit cards. Over time, it is intended more data holders will be added to this list of initial data holders. Provided there is no further delay in implementation due to the COVID-19 pandemic, consumer mortgage and personal loan data will also be available for sharing from 1 November 2020.

MBIE’s option two is similar to the Australian position. A consumer data right would be applicable across the New Zealand economy. Specific sectors would be designated into the framework through additional legislation. Such legislation would provide specific detail and tailoring to a sector following sector-wide consultation.

Comments

The MBIE paper leans towards any option other than letting data portability develop at each industry’s own pace. If legislating for consumer data rights is proposed following consultation, we would expect the banking sector to be one of the first sectors for implementation. Financial institutions and third parties in that sector would need to be prepared for the mandatory sharing, and portability, of consumer data. It would be interesting to see if there is any leveraging off the common standards used by the API Centre.

Exploring option two makes sense given the big four New Zealand banks are subsidiaries of Australian banks. We would expect some level of alignment between the New Zealand and Australian positions, even if option two is not selected. Depending on how a New Zealand consumer data right is developed, New Zealand banks may be able to tap into the systems and processes established by their Australian parents.

Start a conversation

Consultation closes at 10 a.m. on 5 October 2020. The request for feedback focusses on whether there is need for a consumer data right and the options proposed. If you need advice on any of the matters in this update, or assistance with preparing submissions on the discussion document, please email Hayley Miller or Liz Lim or email the team.