Derived data exists in the Privacy Act 1988 and refers to any data that is not raw; for example, data that passes from one format to another.
The government has confirmed that the consumer data rights regime must be able to apply certain sets of data processed by the holder (derived) and not just data collected or observed by the holder (raw).
The Treasury Department’s reasoning is that if derived data were to be excluded, then data holders might be able to avoid their obligations to make the data available to consumers and protect consumers by deriving most, if not all, of the data they hold.
The Bill now reflects that raw transaction data and a wider range of derived data sets must be included, but provides a number of safeguards so that rights of access to derived data do not become too broad.
Rights of access to derived data will now only exist if the Minister specifies this data in the act of designation and sets limits on the scope of the requirements relating to derived data.
The Treasury Department rejected the idea that legislation should exclude value-added data and simply list specific value-added data to be included, because such an approach would require legislative changes each time consumers’ data rights is extended to a new sector.
As open banking is the first industry to use the consumer data right, some examples of in-scope derived data have been included, such as person or account identifiers and common classifications. such as transaction types.
The department also offered guidance on when data holders can charge fees for access to data and, generally, consumers should be able to exercise their data rights without fees.
This could change in the future if the Minister decides this should be the case, but only after seeking advice from the ACCC.
Some reasons may include whether consumers frequently access data where the marginal cost of disclosure is high or whether access to the data may impact the incentives of data holders to continue collecting and managing the data consumers.
The Bill has also been amended to reflect the adoption of the principle of reciprocity, so those who receive data under this right should also be required to respond to requests to disclose equivalent types of data they hold regarding the customer.
The aim is to develop the system for the benefit of consumers and to ensure a level playing field.
The second stage of the designation is currently on the Treasury website, and the government is inviting industry stakeholders to comment on the consultation until July 12.
