Giving New Zealanders greater control over their data could enable easier switching among providers and bring to market new products and services. That’s according to a discussion paper from the Ministry of Business Innovation and Employment (MBIE), seeking feedback on the introduction of a consumer data right (CDR).
Companies that have business operations in the European Union will be familiar with the concept, as it is baked into its General Data Protection Regulation (GDPR). It is the idea that a consumer can request the secure transfer of their data from one provider to the another in a machine-readable form. Data portability was, however, left out of the New Zealand Privacy Act that comes into effect later this year.
The CDR concept crosses three areas of law—privacy, consumer, and competition—and it may be preferable to have its own stand-alone act.
The MBIE document favours the approach taken by the Australian government, which introduced a CDR in 2019, and which it refers to as the ‘sectorial designation option’. A high-level framework is established in legislation, but rules are then created and applied to designated sectors. While this offers a tailored response that takes into account the particular requirements of sectors such as banking, insurance and electricity, it also means that other sectors may miss out on beefed-up privacy protections.
How a CDR could change IT systems
A CDR is likely to mean “extensive changes” to the IT systems of public and private organisations required to implement it. The MBIE notes that the Australian government forecast a cost of more than A$ 90 million to implement the CDR over five years.
Some of this cost would be offset by efficiency gains, as having a centralised accreditation body would reduce the need for third parties to have bilateral agreements with each data holder.
It is also likely to make data transfer more secure across the board, with the MBIE noting the current use of “screen scraping” in the financial services sector by some operators. This is when a consumer logs into an online account via a third party’s interface. The risk is that it doesn’t limit the use of the data, and it may also breach the bank’s terms and conditions.
Benefits of aligning with Australian consumer data right
The advantages of a trans-Tasman approach to data portability, and by extension open banking has been highlighted by both the Australian and New Zealand Productivity Commissions. “This includes making it easier for firms to obtain finance for trans-Tasman trade activities, broadening the market for emerging fintech firms and encouraging increased competition in trans-Tasman financial services,” the MBIE notes.
Bank of New Zealand (BNZ) Executive General Manager for Technology and Operations Russell Jones says that it would “lean very heavily” on the experience of its parent company National Australia Bank (NAB) in implementing a CDR locally. He says the bank has been meeting internally on what new product and services a CDR could enable and that an executive team from BNZ visited Scandinavia last year to look at developments there. Externally, the bank is engaging with the MBIE on its discussion document. “We have an executive that sits between BNZ and NAB and focusses on innovation and one of the things that this team is working on is looking at open banking generally or consumer data rights specifically,” Jones says.
Banking and energy sectors first in line for a CDR?
In Australia, the banking and energy sectors are the first to be designated under the new CDR legislation and its likely to be the case here in New Zealand too. The MBIE document outlines several benefits gained by consumers in both sectors, including the idea that a CDR in banking would enable the development of alternative contactless payment solutions.
The MBIE notes that there have been some sector-led initiatives in New Zealand to promote data portability, but “progress has been relatively slow and these initiatives do not appear to be delivering the full range of positive outcomes for consumers as yet.”
The banking industry has been developing industry API standards to enable data portability, but the implementation is described as limited, prompting Minister of Commerce and Consumer Affairs Kris Faafoi to write an open letter in December 2019 signalling concern about the slow progress.
Meanwhile the electricity sector has introduced a form or data portability which enables consumers to compare pricing plans.
Submissions to the discussion document close in October 2020, and the MBIE intends to provide advice to the next government on whether to proceed with a CDR by the end of the year. If it does go ahead, details such as who would pay to establish a regime—such as the Crown or via an industry levy—would then be up for discussion.