1. When an ADI receives CDR data from an external source it becomes a Data Holder of that data (Sec 56AJ(4), and explanatory notes 1.88).

This question has two elements to address:

1. If an ADI receives designated CDR data, through any means other than the CDR, the ADI is a data holder of that data (‘first case’ reciprocity 56AJ(1)).
2. If an ADI is accredited, and receives CDR data via the CDR regime, the ADI will become a data holder only if the conditions in 56AJ(4) and Clause 7.2 of Schedule 3 are met (‘third case’ reciprocity 56AJ(4)).

Once the ADI is a data holder in respect of the data, the ADI is required to share that data in response to a valid request (whether under the direct to consumer mechanism or with an ADR).

The timeline for direct to consumer functionality is still under consideration, and there is currently no requirement for DHs to provide functionality that facilitates consumer data requests made by CDR consumers.

During the course of the meeting, a follow up question was asked about correction obligations where 3rd case reciprocity has occurred. For example, if DH1 has become a data holder under third case reciprocity with respect to data originally received from DH2, what are their obligations for corrections (e.g., how can they correct data they weren’t responsible for creating)?

It is necessary to consider if Privacy Safeguard 13 (correction at the request of a consumer) applies. If Privacy Safeguard 13 applies, it is necessary to consider rule 7.15 of the CDR Rules, which outlines the steps to be taken when responding to correction requests.

If Privacy Safeguard 13 does apply because DH1 has previously disclosed that data previously received from DH2, then in response to a request to correct from a consumer, DH1 must either:

3. correct the data if DH1 has the necessary information to correct or include a statement with the data, even though they were not the originating source of the data. For example, if data received from DH2 had an incorrect address for a consumer, and the consumer asks DH1 to correct that data, DH1 may be able to correct if the consumer presents them with a proof of address.

4. give notice to the consumer why a correction or amending statement is not necessary or appropriate in the circumstances. For example, this may include if DH1 is unable to interrogate the data because they are not privy to why the record was made in the first place. In these circumstances, it is recommended that DH1 advise the consumer to contact DH2 to make that correction.

At this stage there is no intention to provide CX Standards or Guidelines relating to direct consumer access. DP089 proposed the following:

The DSB is currently recommending that only technical standards for the direct request service be defined and that the consumer experience is left to the competitive space for the data holders to determine.

The consultation was closed with the following note:

As this standard is heavily influenced by policy considerations the final recommendation will only be made after inter-agency consultation has also been conducted.

CX work relating to direct consumer access will depend on this recommendation and the proposed compliance dates.

Question regarding the term “publicly offered” (clause 1.4 of Schedule 3 to the CDR Rules)

Has any guidance been provided by the ACCC regarding what is intended by the term “publicly offered?” Clarification is sought as to how this term should be interpreted.

Should CDR data holders have regard to whether a product is considered “wholesale” or “retail” when determining if a product is in scope? If so, which definition of “wholesale” or “retail” should be relied upon? Where is this further information provided by the ACCC? We need to be able to evidence our decisions for inclusion/exclusions of products. Some of our product departments are adamant that their products are not intended to be included in CDR, however when interpreting the CDR Rules there is no justification for exclusion.