This instrument is the Competition and Consumer (Consumer Data Right) Amendment Rules (No. 1) 2020.

(1) Each provision of this instrument specified in column 1 of the table commences, or is taken to have commenced, in accordance with column 2 of the table. Any other statement in column 2 has effect according to its terms.

Commencement information
Column 1	Column 2	Column 3
Provisions	Commencement	Date/Details
1. The whole of this instrument	The day after this instrument is registered

Note: This table relates only to the provisions of this instrument as originally made. It will not be amended to deal with any later amendments of this instrument.

(2) Any information in column 3 of the table is not part of this instrument. Information may be inserted in this column, or information in it may be edited, in any published version of this instrument.

3 Authority

This instrument is made under section 56BA of the Competition and Consumer Act 2010.

4 Schedules

Each instrument that is specified in a Schedule to this instrument is amended or repealed as set out in the applicable items in the Schedule concerned, and any other item in a Schedule to this instrument has effect according to its terms.

Schedule 1—Amendments

Competition and Consumer (Consumer Data Right) Rules 2020

1 Rule 1.7 (note 1, list of terms defined in the Act)

Insert:

 Australian Consumer Law;

 Commission;

2 Subrule 1.7(1) (note 1 to the definition of CDR complaint data)

Repeal the note.

3 Subrule 1.7(1) (note 2 to the definition of CDR complaint data)

Omit “Note 2”, substitute “Note”.

4 Subrule 1.13(4)

Omit “An accredited person”, substitute “A data holder”.

5 After paragraph 3.5(1)(a)

Insert:

(aa) in relation to an account that is blocked or suspended; or

6 Subrules 4.7(1) and (2)

Repeal the subrules, substitute:

(1) Despite subrules 4.5(3) and 4.6(4), a data holder may refuse to ask for an authorisation in relation to the relevant CDR data, or refuse to disclose required consumer data in response to the request:

(a) if the data holder considers this to be necessary to prevent physical or financial harm or abuse; or

(b) if the data holder has reasonable grounds to believe that disclosure of some or all of that data would adversely impact the security, integrity or stability of:

(i) the Register of Accredited Persons; or

(ii) the data holder’s information and communication technology systems; or

(d) in circumstances (if any) set out in the data standards.

7 Subrule 4.7(3) (heading)

Repeal the heading.

8 Subrule 4.11(1) (note 2)

Omit “rules 7.11 and 7.12”, substitute “rules 7.12 and 7.13”.

9 Paragraphs 4.13(1)(a) and (b)

Repeal the paragraphs, substitute:

(a) by using the accredited person’s consumer dashboard; or

(b) by using a simple alternative method of communication to be made available by the accredited person for that purpose.

10 Paragraph 4.13(2)(a)

Omit “paragraph (1)(a)”, substitute “paragraph (1)(b)”.

11 Paragraph 4.14(1)(a)

Omit “paragraph 4.13(1)(a)”, substitute “paragraph 4.13(1)(b)”.

12 Subparagraph 4.14(1)(a)(ii)

Omit “written”.

13 Paragraph 4.14(1)(b)

Omit “paragraph 4.13(1)(b)”, substitute “paragraph 4.13(1)(a)”.

14 Paragraphs 4.25(1)(a) and (b)

Repeal the paragraphs, substitute:

(a) by using the data holder’s consumer dashboard; or

(b) by using a simple alternative method of communication to be made available by the data holder for that purpose.

15 Paragraph 4.25(2)(a)

Omit “paragraph (1)(a)”, substitute “paragraph (1)(b)”.

16 Paragraph 4.26(1)(a)

Omit “paragraph 4.25(1)(a)”, substitute “paragraph 4.25(1)(b)”.

17 Subparagraph 4.26(1)(a)(ii)

Omit “written”.

18 Paragraph 4.26(1)(b)

Omit “paragraph 4.25(1)(b)”, substitute “paragraph 4.25(1)(a)”.

19 Subrule 5.17(1) (table item 3, column headed “If:”)

Omit “that that”, substitute “that”.

20 Subrule 5.17(1) (table item 4, column headed “If:”, subparagraph (b)(i))

After “Register of Accredited Persons”, insert “or the associated database”.

21 Subrule 5.18(1)

Omit “registration”, substitute “accreditation”.

22 Rule 5.24, note 3 (first occurring)

Renumber as “Note 2”.

23 Paragraph 5.30(b)

After “facilitating any testing”, insert “by CDR participants”.

24 After paragraph 5.30(c)

Insert:

Example: The Accreditation Registrar could request data holders or accredited persons to undertake and complete testing where it is necessary or convenient for the Registrar to perform its functions under paragraph (b).

25 Clause 2.2 of Schedule 2 (table item 3, row relating to “Information asset lifecycle (as it relates to CDR data)”, column headed “Description of minimum controls”)

Omit “ADR”, substitute “accredited data recipient”.

26 Clause 1.3 of Schedule 3 (table item 2, column 2, subparagraph (b)(iii))

Repeal the subparagraph, substitute:

(iii) account balances; and

27 Subclause 2.1(2) of Schedule 3

Repeal the subclause, substitute:

(2) For the banking sector, in relation to a particular data holder at a particular time, a CDR consumer is eligible if, at that time, the CDR consumer:

(a) is an individual who is 18 years of age or older; and

(b) is the account holder for an account with the data holder that:

(i) is open; and

(ii) is set up in such a way that it can be accessed online.

28 Subclause 3.2(1) of Schedule 3

After “required consumer data”, insert “,”.

29 Subparagraph 3.2(1)(b)(ii) of Schedule 3

Omit “1 CDR consumer”, substitute “a CDR consumer who is an individual”.

30 Sub‑subparagraph 3.2(1)(b)(ii)(B) of Schedule 3

Omit “if the person is an individual―”.

31 Subparagraph 3.2(1)(b)(iv) of Schedule 3

After “uses”, insert “and that relates to any such account”.

32 Sub-subparagraph 3.2(3)(a)(i)(A) of Schedule 3

Omit “person”, substitute “individual”.

33 Subparagraph 3.2(3)(a)(iii) of Schedule 3

Repeal the subparagraph.

34 Subparagraph 3.2(3)(a)(v) of Schedule 3

Omit “or”, substitute “and”.

35 Subrule 3.2(3) of Schedule 3 (note)

Repeal the note.