Can you please let me know if the CX Guidelines will be updated to provide an example Consent Flow which caters for joint accounts?

My understanding is that we have the option of ensuring that both owners of a joint account consent for data to be shared before we release any data from that joint account. The current example of the Consent flow only deals with retrieving a single consent, will there be some examples of how we would potentially retrieve two consents (one from each owner of the joint account) as part of the Consent flow?

The CX guidelines have prioritised the requirements in the rules where:

No specific CX Guidelines exist for the optional ‘2 to authorise’ election preference. The expectation has been that the approval from the other joint account owner will occur outside the authorisation flow.

A CX consultation occurred on aspects of the joint account election and authorisation experience. This proposal consulted on additional requirements relating to how joints are dealt with in the authorisation flow, including the ‘2 to authorise’ preference. The proposals outlined in this paper depend on rules amendments and as such any final decision proposals – including updated CX Standards and Guidelines – will be delayed until rules consultation can occur.

3.3. Number of consumer data requests received from accredited persons on behalf of eligible CDR consumers

Does this relates to number of customer consent requests received via the online channel?

Does this include successful and unsuccessful requests? (e.g. what if the customer doesn’t get through the authentication process – should this be counted)

Question on item 2.7 - We assume the reference to ‘CDR participants’ refers to other Data Holders and ADRs in the CDR eco-system. However, internal complaints handling systems and processes are developed to accommodate complaints received from customers of the bank. Is the expectation that DHs would extend existing complaints handling processes to parties other than customers? If so, This could potentially have a large impact to existing process

Will there be further clarity on how CDR participants are expected to deal with complains made by other CDR participants?

v1.3.0 covers what the rules currently require for the November timeline, based on the following items and assumptions:

A CX consultation occurred on aspects of the joint account election and authorisation experience [https://github.com/ConsumerDataStandardsAustralia/standards/issues/106]. This proposal consulted on additional requirements relating to how joints are dealt with in the authorisation flow, including the ‘2 to authorise’ preference. The proposals outlined in this paper depend on rules amendments and as such any final decision proposals – including updated CX Standards and Guidelines – will be delayed until rules amendments are considered by the ACCC.

These proposals intend to build on, not replace, the mandatory requirements for joint accounts as outlined in the February rules. As such, they will look to consider '2 to authorise'. The timing and content of additional CX artefacts will depend on rules considerations and consultation.

This question is regarding the REPORTING - Copy of Rule 9.4 draft reporting forms for Data Holders and ADRs spreadsheet.

We understand that we will need to report on the number of product data requests received, once we go live with Get Products and Get Product Detail APIs in July 2020.

We do not expect a data holder to complete items 2.1-2.6 of the reporting form prior to the commencement of the data holder’s obligations relating to consumer data sharing. We do, however, expect data holders to report on the total number of complaints received from other CDR participants in relation to compliance with Part IVD of the Competition and Consumer Act 2010 (Cth), the CDR rules and the binding data standards insofar as those complaints relate to product data requests during the relevant reporting period (item 2.7 of the reporting form). Having said that, we do expect data holders to reasonably manage all complaints they receive, and note that the ACCC is able to consider complaints it receives from the public about PRD data.

We expect data holders to report on refusals to disclose CDR data and the CDR rules or data standards relied on to refuse to disclose that CDR data (items 4.1-4.2 of the reporting form). Item 4.3, which requests the data holder state the number of times it has relied upon the CDR rules or standards cited in response to item 4.2, is an optional reporting item. Under rule 2.5, a data holder may refuse to disclose required product data in response to a request in circumstances (if any) set out in the data standards. Examples of such circumstances in relation to product data are:

The ACCC and OAIC have published their joint Compliance and Enforcement policy for the Consumer Data Right. The purpose of the policy is to help consumers and CDR participants understand the approach that the ACCC and the OAIC will adopt to encourage compliance with CDR rules, legislation (including Privacy Safeguards) and Consumer Data Standards. The policy also sets out how the ACCC and OAIC will respond to breaches of the CDR regulatory framework. The policy can be found on the ACCC website.

We use a risk-based approach to monitoring and assessing compliance matters and taking enforcement action. We cannot pursue all matters that come to our attention. Our role is to focus on those circumstances that will, or have the potential to, cause significant harm to the CDR regime or result in widespread consumer detriment.

Interested parties should make any complaints about data accuracy or how product reference data is being shared directly to the data holder. Interested parties can also report their concerns to the ACCC and we will consider in accordance with our Compliance and Enforcement policy. Reports can be submitted to us directly at [email protected].

In response to Questions 1 and 2, the ACCC and OAIC have published their joint Compliance and Enforcement policy for the Consumer Data Right. The purpose of the policy is to help consumers and CDR participants understand the approach that the ACCC and the OAIC will adopt to encourage compliance with CDR rules, legislation (including Privacy Safeguards) and Consumer Data Standards. The policy also sets out how the ACCC and OAIC will respond to breaches of the CDR regulatory framework. The policy can be found on the ACCC website.

We use a risk-based approach to monitoring and assessing compliance matters and taking enforcement action. We cannot pursue all matters that come to our attention. Our role is to focus on those circumstances that will, or have the potential to, cause significant harm to the CDR regime or result in widespread consumer detriment.

Interested parties should make any complaints about data accuracy or how product reference data is being shared directly to the data holder. Interested parties can also report their concerns to the ACCC and we will consider in accordance with our Compliance and Enforcement policy. Reports can be submitted to us directly at [email protected].

In response to Questions 1 and 2, the ACCC and OAIC have published their joint Compliance and Enforcement policy for the Consumer Data Right. The purpose of the policy is to help consumers and CDR participants understand the approach that the ACCC and the OAIC will adopt to encourage compliance with CDR rules, legislation (including Privacy Safeguards) and Consumer Data Standards. The policy also sets out how the ACCC and OAIC will respond to breaches of the CDR regulatory framework. The policy can be found on the ACCC website.

We use a risk-based approach to monitoring and assessing compliance matters and taking enforcement action. We cannot pursue all matters that come to our attention. Our role is to focus on those circumstances that will, or have the potential to, cause significant harm to the CDR regime or result in widespread consumer detriment.

Interested parties should make any complaints about data accuracy or how product reference data is being shared directly to the data holder. Interested parties can also report their concerns to the ACCC and we will consider in accordance with our Compliance and Enforcement policy. Reports can be submitted to us directly at [email protected].

The ACCC is flexible as to the format used for responding to item 2.2, as long as the complaint type name is clearly specified and the number of complaints for each complaint type is also clear in the response provided. The suggested format of listing the complaint types in separate rows in one column and the corresponding complaint number in the following column is acceptable.

Item 4.2, which requires only a list of the relevant CDR rules or data standards relied upon by a data holder in refusing to disclose CDR data, is a mandatory reporting requirement under rule 9.4. However, item 4.3, which asks for more detail in the form of a breakdown of the number of times each of the relevant CDR rules or data standards was relied upon in refusing to disclose CDR data, is only an optional reporting item. This is the reason why the form currently separates these two reporting items. However, if a data holder was inclined to respond to item 4.3 in the format suggested in the example provided in the question (i.e. list of the relevant reason in one column and the corresponding number of times it was relied upon in the next column), that would be welcomed. In such a case, it is acceptable for the data holder to make a note in item 4.2 that the relevant response is covered in the response to item 4.3.

In the rules the definition is provided: recognised external dispute resolution scheme means a dispute resolution scheme that is recognised under section 56DA of the Act.

Section 56DA of the Act states (1) The Commission may, by notifiable instrument, recognise an 26 external dispute resolution scheme for the resolution of disputes: 27 (a) relating to the operation of the consumer data rules, or this 28 Part, in relation to one or more designated sectors;

Is there a specification/expectation around the recency of data available in the Get Metrics API for the ‘current’ periods? (currentDay, currentMonth.) Could it be up to the nearest 2 hours, 6 hours of aggregation?

2. The ‘number’ specification examples show only two decimal places; is a higher resolution expected or supported for the Get Metrics ‘availability’ and ‘performance’ percentage metrics?

Regarding the announcement on the CDR dates for non-major ADI’s moving out to July ’21, will the ACCC be releasing a new Phasing table to confirm obligation dates for:

If a non-major bank chooses to make their Product Reference Data API public on their website prior to the 1st of October (PRD phase 1 obligation date). Does the reporting period start from the date when the API is made public or does the reporting period only start from the 1st of October?

i.e. we launch our PRD API on our website on the 1st of July does that mean the reporting period is from the 01/07/2020 – 31/12/2020 (6 month period)

Regarding the pushed authorization request endpoint which needs to be exposed by DH. The RFC states that the endpoint needs to be protected with authentication

The standards documentation doesn't mention how this endpoint will be protected. We need to understand if there will be an access token issued though client credentials grant with client assertion JWT and then use this access token for calling pushed auth. request endpoint. If so, what would be the scope that would be used to get access token using client credentials grant?

Questions for ACCC around Product reference data timeline obligations -
• 1) Could you please clarify if Non-major ADIs can commence sharing PRD data for phase 1 products "prior to 1 July 2020" if ready?
• 2) And if yes, would this automatically trigger any changes to other swim lane obligations (for PRD phase 2 and/or Consumer data)?
• 3) Also, are we required to advise/inform the ACCC of the exact go-live date?