Treasury Consumer Data Right Rules Update: Trusted Advisers & Joint Accounts

This joint submission from the Financial Rights Legal Centre, Consumer Action Law Centre, the Public Interest Advocacy Centre, the Australian Privacy Foundation and the Australian Communications Consumer Action Network addresses our ongoing concerns with the intention to introduce rules with respect to:

• “trusted advisers”
• CDR insights; and
• joint accounts.

We are strongly opposed to these proposed rules amendments. Many of these concerns have been outlined in previous submissions on the matter however we raise the following additional points: the proposed consumer protections/risk mitigations are entirely inadequate to address the real concerns raised by consumer representatives; and independent Privacy Impact Assessment processes are either incomplete or non-existent and have not been conducted early enough to influence the project design.

With specific reference to the proposed joint account rules we further note that :

• vulnerable consumers are unable to avail themselves of the minimal protections under the CDR Rules;
• the FinTech’s sector’s claim that an opt-out consent model is safer for victims of financial abuse is wrong and is self-interested;
• a right to transfer data is fundamentally different to the current bundle of rights to transact under a joint account;
• designing CDR Rules to merely reflect current unsafe and insecure data sharing capabilities does not fulfil the promise of the CDR to provide a safe and secure data environment for consumers;
• it is unclear whether all joint account holders will have the ability to delete or de-identify data shared after the fact.

With these three new proposals CDR now bears almost no relationship to the original promise. The effect of these recommendations is one of incremental privacy intrusion and scope creep such that it is becoming increasingly unsafe to use and consumer representatives may be in no other position but to advise consumers – particularly vulnerable consumers – to opt out of the CDR with respect to any interactions relating to joint accounts, “trusted advisers” and CDR insights.