The Consumer Data Right (CDR) is an economy-wide reform which gives individuals the right to share data between service providers of their choosing. It was rolled out into the banking sector in 2017, known as “open banking”. A phased rollout in the energy sector started in November 2022 and will continue over the following 12 months.

Energy Retailers with more than 10,000 electricity small customers (business or residential), are designated data holders in the CDR energy ecosystem. It is mandatory for them to meet rigorous regulatory and privacy obligations and data security requirements. They must be a registered, onboarded and active data holder in the CDR ecosystem by 1 November 2023. Following this, large retailers have six months to implement the ability to handle complex data requests (deadline 1 May 2024).

Data holders have three main roles under the CDR:

1. Provide the necessary CDR infrastructure to enable requests for the consumer data;
2. Securely transfer, with a customer’s authorisation, a consumer’s data in a machine-readable format when they receive a valid request; and
3. Manage a consumer’s authorisation to disclose CDR data, including any amendments or withdrawals.

The systems, processes, procedures, and policies that form an energy retailer’s CDR solution must be established and tested, before commencing the CDR data holder registration, onboarding and activation process with the ACCC. This onboarding process takes three to four months.

Energy retailers are accountable for complying with these new obligations. This is the case whether you are building your CDR solution in-house or using a third party to meet certain requirements. Ultimately, each energy retailer needs to understand their compliance obligations and business requirements so they can hold their third-party providers accountable for delivering solutions that meet the regulatory and business requirements.

At a high level, here are the key steps to becoming a registered data holder:

1. New CDR obligations: Retailers  must know and understand the detailed CDR, privacy and data standards obligations so they can determine how they apply to their business.
2. Determine business requirements: Once a retailer understands their obligations, they can define their business requirements and determine which requirements to meet internally or to work with a third party to deliver.
3. Business readiness: With business requirements defined and responsibility allocated internally and with third parties as required, work begins on developing, delivering, and testing a compliant CDR solution to integrate into the CDR ecosystem.
4. Registration: It is now time to commence the registration process in the Participant Portal as a data holder. The Portal is also where CDR participants update and manage their information and view the CDR Register of Accredited Persons.
5. Onboarding & conformance testing: The next step is to complete the onboarding process, including acceptance of relevant licence agreements and successful completion of the CDR Conformance Test Suite, confirming CDR solution is compliant with the CDR’s standards and rules.
6. Activation: Once the retailer meets the onboarding requirements and passes conformance testing, the ACCC will activate them in the CDR Register and in the CDR ecosystem.

The expediency and success of the registration-to-activation process are dependent on how well the retailer has understood the complex CDR obligations and translated and executed the consequential business requirements into a practical and compliant CDR solution. It’s all in the preparation.

The CDR is a dual-regulator model, with the ACCC and Office of the Australian Information Commission (OAIC) responsible for jointly monitoring compliance. The ACCC focuses on competition implications, while the OAIC oversees the protection of privacy and confidentiality. Both regulators use a risk-based approach to monitor and assess compliance matters and take enforcement action.

The Commonwealth Treasury leads CDR policy development and is responsible for the CDR Rules and advice to government on which sectors the CDR should apply to in the future.

Within Treasury, the Data Standards Body (DSB) develops the Data Standards that prescribe the technical requirements for how data is shared under the CDR.

• The Competition and Consumer Act 2010 (CCA), Privacy Act 1988 and the Australian Information Commissioner Act 2010 – with the core provisions in Part IVD of the CCA.
• Designation instruments made under the legislation, including the Consumer Data Right (Energy Sector) Designation 2020 (the Energy Sector Designation), which designates the energy sector as subject to the CDR laws relevant to the management of CDR data in relation to the energy sector.
• The Competition and Consumer (Consumer Data Right) Rules 2020 made under the legislation (CDR Rules).
• The Competition and Consumer Regulations 2010 made under the legislation (CC Regulations) – with the application of privacy safeguards in the energy sector specified in regulation 28RA.
• Consumer Data Standards (Standards) made under the CDR Rules, which include Technical and Consumer Experience Standards (CX Standards). The CX Standards contain technical requirements for what data holders need to do in their consumer-facing interactions.