Data portability: revival of Australia's Consumer Data Right

Data has taken on a new importance and value in the digital economy. Given the prominence of data collection and use in everyday life, it is inevitable that consumer data portability remains on the agenda. Whether it be the EU's Data Act (which applies in September 2025), Canada's Bill C-27 and the proposed Consumer Privacy Protection Act (perhaps not making its way through in 2025) or New Zealand's Customer and Product Data Bill (which was introduced in May 2024). At home, there is also now a renewed focus on perfecting Australia's Consumer Data Right (CDR).

What has happened with the Consumer Data Right

Government and private sector commissioned reviews and reports alike have highlighted the shortcomings of the CDR. The CDR is currently in effect in the banking and energy sectors. However, it is reported that there have been high compliance costs, unhelpful restrictions on using and holding CDR data, a lack of incentive for businesses to use CDR data, and perhaps most significantly, relatively limited consumer take up of the CDR.

The Australian Government announced a reset of the CDR in August 2024. The reset focuses on improving the current framework to reduce unnecessary costs and enable high-value use cases. One part of this was to amend the CDR rules to streamline the consent process for consumers – what is known as "action initiation". This enables consumers to direct accredited persons to send instructions to initiate actions on their behalf. These could be making a payment, opening or closing an account, switching providers and updating personal details across providers. This is seen as expanding the CDR from a data sharing scheme to a scheme that allows consumers to action on information they receive. The Australian Government has also advised the Data Standards Body of its expectation that future data standards changes align with the new direction for the CDR, and is exploring how the CDR can better support high priority use cases such as consumer finance and lending, small business accounting services and energy switching.

Expanding the Consumer Data Right

The Australian Government recently announced that it would expand the CDR to include non‑bank lending products; remove the requirement for data holders to share consumer or product data for niche products such as asset finance, consumer leases, reverse mortgages, margin loans and foreign currency amounts; significantly reduce the period of data to be held and shared from 7 years to 2 years; and ensure Buy Now, Pay Later products are covered by data sharing obligations. Some clear themes emerge from these proposed changes – definitely a reinvigorated application to consumer finance and lending, as well as reducing the cost burden (and potential cybersecurity risk) of holding data for extended periods of time.

More work to be done with screen scraping

What about screen scraping? The Australian Government has indicated that it is considering banning screen scraping. Screen scraping, also known as digital data capture, is a technology that collects displayed data to be used for a specific purpose. Screen scraping can involve prompting consumers to access their account information through a third-party service which then extracts the data shown "on screen". Screen scraping is a common alternative to the CDR, but it has inherent risks. Beyond cybersecurity concerns, it also presents challenges from a privacy and data protection perspective. The Office of the Australian Information Commissioner has flagged that regular exposure to screen scraping can also normalise poor privacy and data protection practices for consumers, which can increase their susceptibility to scams. A robust CDR is a much safer and more secure choice to screen scraping.