The Customer and Product Data Bill was introduced to Parliament on 16 May 2024 and is set to undergo its first reading.

The introduction to the House follows a round of consultation undertaken by MBIE in June last year on which we reported previously. The Bill – already in the pipeline under the previous government – has been picked up by the Commerce and Consumer Affairs Minister Andrew Bayly, and is seen as one of the levers available to government to facilitate open banking in New Zealand. 

Many (including the Commerce Commission in its recent market study into personal banking services) view open banking as a key tool to open up competition in the New Zealand banking market. While the Bill itself does not promote or regulate open banking, it will provide a legal framework within which incumbent ‘data holders’ will be required to make ‘designated customer data’ and ‘designated product data’ available to customers and ‘accredited requestors’, through an ‘electronic system’. If passed, the Bill will enable the Minister of Commerce and Consumer Affairs to designate individual markets, industries and sectors to which that framework will apply – with everyone’s expectation being that the banking sector will be first in line (Australia takes a similar sector-based approach, and has applied a consumer data right to the banking and energy sectors).

Regulations to do the heavy lifting on security and other key matters – more work required from regulators

Since the Bill only introduces a framework for designating markets, the details of how a particular market will be opened up to a consumer data right remain to be determined in regulations.

Those regulations will need to address matters such as:

• who will be designated a data holder, and in respect of which data.
• technical and performance’ requirements in respect of the electronic system a data holder is required to maintain.
• the security and identity verification measures that are used to ensure that requests for data are valid.

Under the Bill, a data holder can be held to have breached IPP 5 of the Privacy Act 2020 (thereby granting individuals a potential remedy for that breach) in cases where the data holder contravenes a ‘CPD storage and security requirement’, including requirements imposed in respect of the protection of data against loss or unauthorised use. These include specific verification requirements that the data holder must follow. However, we think that more work from regulators and industry is required to ensure that the scope for fraudulent requests is mitigated – especially as fraudsters resort to more sophisticated means of impersonation. It will be interesting to see the extent to which the regulations draw on work already undertaken by the API Centre.

More work from industry required as well

Accredited requestors themselves will also need to implement appropriate technological and security safeguards to ensure the protection of consumer data that is extracted from data holders. Where sensitive financial information may be requested from their banks and made available to participants in the open banking sector, consumers will want to seek appropriate assurances from the open banking participants that their data will be treated with a similar level of care as it is treated when held within the bank. As is the case now under existing privacy laws, any would-be participant in open banking should be ensuring that it is taking cybersecurity and privacy controls very seriously in the face of growing cybersecurity risks.

While the Bill doesn’t directly address what steps accredited requestors and other participants in open banking (or any other ‘open’ industry) must take, it does contemplate the issue of regulations to establish criteria for accreditation. We would expect those criteria to include some form of safeguards with respect to the technological and organisational safeguards an accredited requestor must have in place to ensure the protection of customer data, which criteria would supplement the existing framework to which an accredited requestor would be subject under the Privacy Act 2020.

Hefty fines

The Bill contemplates significant fines in the case of certain areas of non-compliance, including a potential fine of up to $2.5m for body corporates which fail to operate an electronic system when required to do so. This level of fine dwarfs the maximum fine available under the Privacy Act 2020, and is significantly higher than the maximum fines available under other consumer protection laws such as the Fair Trading Act 1986. Indeed, the potential maximum fines are more aligned with those available to regulators under the Commerce Act 1986 – reflecting perhaps the fact that the Bill is one designed primarily to open up competition in a sector, rather than one that purely focuses on access to data.

Potential extraterritorial application – overseas organisations take note

The Bill contemplates extraterritorial application – so it could, in theory have its application extended to an organisation located outside New Zealand, if that organisation carries on business in New Zealand in respect of any designated customer data or product data. Whether that is the case will depend on the designations themselves, and whether they are designed to extend to data held beyond our shores: while this is unlikely in the context of the potential designation of the banking sector, it may be relevant in connection with other sectors that are the subject of later designations where services are provided on a cross-border nature.

Overseas organisations who do business in New Zealand and who deal with customer data will need to watch this space (if they’re not already carefully watching a similar ‘opening’ up of markets in their own backyards).

What next?

The Bill is on the Order Paper awaiting its first reading. Since it is a government bill, we expect that first reading to be successful: after which, the Bill will be referred to Select Committee and public submissions will be invited. If and when passed, we expect that there may be a significant programme of work required to develop the regulations necessary or desirable to properly designate the banking sector – work that it may be optimistic to believe can be completed to hit the government’s target of getting open banking in place by 2026, but work that if done right will provide New Zealand consumers more choice, and open banking participants more opportunities to disrupt the banking sector.

If you have any questions about the Bill, reach out to our consumer, data and privacy experts Hayley Miller and Campbell Featherstone, or our open banking experts Liz Lim and Wook Jin Lee.