Consumer data right could empower Kiwis to have more control over their data

Consumers are one step closer to having more control over how their data is shared.

This week Consumer Affairs Minister David Clark announced that the Government has agreed to establish a consumer data right framework, which will specify how companies can share data with third parties with a consumer's consent.

Clark says that consumers need to be in the 'driver's seat' when it comes to their personal information.

Consumers must be able to control how their personal information is used by third parties. They also need to able to give informed consent to share any data, and only for the agreed reasons.

"If a person was seeking financial advice, they could ask their bank to share data, such as transaction information, with their chosen adviser.

Consumers will be able to use an opt-in system to agree to information sharing. They will also be able to amend or withdraw consent at any time.

Consumer consent comes in two parts:

• Read access – the ability for an accredited person to read consumer data
• Action initiation – the ability for an accredited person to carry out an action with the consent of a consumer. For example, a consumer could ask a third party payment provider to action a bank funds transfer from the consumer's bank account to a business's bank account when paying for a goods or services.

The framework has implications for businesses that use, or intend to use, data sharing agreements with other partners. Data sharing must be held in standardised formats and interfaces, and it must be secure.

"The businesses and services wishing to receive this data would also have to meet a number of safeguards to ensure the information could be handled safely and securely," says Clark.

The consumer data right will first feature an overarching framework with basic obligations for organisations in designated sectors. Each sector will have different obligations - for example, the banking and financial services sector will have obligations to data such as transactions and account information.

Security is also of major importance, as third party data recipients will need to be accredited and a range of information protection safeguards will be introduced.

The consumer data right will be rolled out sector by sector to make sure requirements work in the real world.

"It's also my intention that the consumer data right will work hand-in-hand with the Digital Identity Trust Framework announced earlier this year. It's that piece of work which sets out the rules for the delivery of digital identity services," adds Clark.

He says the consumer data right framework will be closely aligned with Australia's similar framework, which was rolled out in 2019.

The Government aims to make another round of policy decisions on the consumer data right framework later this year. A Bill is expected to be presented to Parliament in 2022.