Customer and Product Data Bill

Members, the committee is considering the Customer and Product Data Bill. We come first to Part 1. This is the debate on clauses 3 to 13—“Preliminary provisions”—and Schedule 1. The question is that Part 1 stand part.

Thank you, Mr Chair. Notwithstanding that we are going to do this part by part during the committee of the whole House stage, I might make some introductory and overview comments. I’m very pleased to be here today for the committee stage of this Customer and Product Data Bill. Sometimes it has been referred to as an open-banking bill. It is an important bill not only for me as the new Minister of Commerce and Consumer Affairs but also for the Government and for consumers and technology companies that are going to be the ones who benefit most from this legislation once it is passed through this House.

Technology has changed dramatically in recent years, and it will continue to change. So this bill seeks to create a framework that will ensure that current arrangements are up to date and that future arrangements can be accommodated.

At this early stage, I want to, again—as my predecessor had already done but I want to, as the new Minister—thank the Economic Development, Science and Innovation Committee and everyone who made submissions on the bill for their work in getting it to this stage.

Just by way of background, the bill introduces a very long overdue consumer data right regime to New Zealand, to make customer and product data accessible for the benefit of New Zealanders. At present, businesses that hold customer and product data are not incentivised at all to invest in better data sharing or the infrastructure that goes with it, and/or any agreements to the sharing of that data. They hold that data incredibly tightly, and that’s been the historical position.

So this means that, actually, it’s very difficult for technology companies to negotiate contracts with those businesses that hold data, and that, in and of itself, limits innovation in our economy. There is also an area where inefficiencies and security issues with some current methods for sharing customer and product data mean that this is made difficult, and it’s unappealing and it’s risky for companies. Third parties under this legislation—the so-called fintechs—will need to be accredited to register customer data on behalf of a customer, and that will ensure that they have appropriate systems in place and that they’re able to handle data appropriately. The bill includes a range of penalties to deter, penalise, and discourage non-compliance, and it’ll be the Ministry of Business, Innovation and Employment that are the regulatory agency responsible for enforcing breaches, alongside, naturally, the Privacy Commissioner, who will continue to be responsible for breaches of the Privacy Act.

The select committee unanimously reported this bill back to the House, and recommended some amendments to the bill which I support as Minister. Some of the key amendments cover the areas relating to the adequacy of privacy protections, protections from liability, approving persons to develop standards, and accreditation criteria. Other amendments are smaller but important, and improve the bill also. I think the select committee’s made some excellent improvements and some suggestions to the bill, particularly with the removal of requirements around the use, modification, and disclosure of customer data where it has carefully balanced the views of prospective data holders such as banks, prospective accredited requestors such as financial technology companies, and customers.

At the appropriate time, I’d like to speak to the Amendment Paper that I’ve introduced, and I don’t think that’s probably appropriate at this stage, other than to say that the bill, if it’s to work as it’s intended, will, by way of that Amendment Paper, make minor and technical changes to the bill—for example, correcting the definition of a joint customer to refer to two or more customers rather than one. My changes are consistent with the existing policy reflected in the bill.

So, on that note, I’m pleased to put the bill over to the committee of the whole House for wider discussion and participation.

Labour members are very excited to excited to be up to a stage to be able to give this bill a thorough going over in the committee of the whole House stage. It is important that we get that opportunity because this bill has had a long history—a long history of many fathers. Congratulations to the Hon Scott Simpson for not only taking up his role as the Minister of Commerce and Consumer Affairs but also being the next steward of this bill, which, as he says, is incredibly important to enabling not only open banking but also the good use of consumer data within our entire digital economy. This is a cornerstone of New Zealand’s digital economy, and we have an opportunity here to be world leaders, to have the best settings for the use of consumer data, for fintechs, for innovators in this space, and it’s an exciting opportunity for anyone to be able to lead.

But it has that long list of fathers, and I would be remiss not to mention them. This bill was first under development under the Hon Dr David Clark and then the Hon Dr Duncan Webb. I also have the honour of being its only mother as having introduced it as a member’s bill in the 54th Parliament, and there have been some changes since then.

Some of our questions will be designed to draw out the differences between those bills, because a lot of this work has been done and it is cross partisan. It enjoys cross-partisan support now, but there are some differences in this bill compared to the work that was undertaken by the Hon Dr David Clark and some of those things are around penalties and around how we deal with the system when things go wrong. That was quite hard to test out in the Economic Development, Science and Innovation Committee. You don’t get people who show up at the committee and tell you about how the penalties will work, because the regime is not in action and these penalty systems vary greatly around the world and so no one really has had any benefit of seeing how these things play out under our settings. The only place where there has been significant litigation around these rights is in the EU, but they have a very different penalty system than ours, and I will traverse some of that when we get to the right moment.

I also want to thank the officials who have tirelessly worked on this for many years. This is something that sectors, like banking, have pointed to as a real roadblock for their development in their introduction of open banking, so we’re very glad to have it to this place. None of us would be right in saying that it was easy. There have been many iterations of work that has been done on this. Thank you to everyone who has put in the work to make this a workable regime and a world-leading regime.

On Part 1, Labour members have a number of questions, but the first question I want to put to the Minister is around clause 3. Clause 3(1)(a) has a change in the scope of this bill. At various points of working through it and, indeed, through the select committee changes to this bill, there has been a huge amount of focus and attention on whether this should be about customers and, therefore, transactions, or whether it should be about people and the way that people can expect their digital data to be stored and used securely. In a digital economy, this is really important to get right because all of us will have varying degrees of interactions online that are not transactions but are with businesses. And New Zealanders can expect that the Government will play a role in this, whether it is just in the transactions and in the monitoring of the way that those transactions are conducted, or whether it will be in those broader digital interactions that are had for products that they might not perceive as products. The definition here has changed from “individuals” and “organisations”. That’s gone. It’s been replaced with “customers”.

The reframing of this bill as a customer product right from what Labour was developing as a consumer data right is a pretty large change in terms of what the scope of it is and what people can expect the Government to be creating here as a sort of framework going forward. But what does that mean? It means that, in applying it only to customers, it excludes this broader principle of personal data rights. That, I think, is probably a good change, but I want to test out with the Minister—when global best practice for this has been developed in jurisdictions like the EU, where the consumer data rights went hand in hand with development of the law on personal data rights and when the courts, at various levels of the EU system, considered what the personal rights legislative framework should be alongside it, in not stepping into that space and not guaranteeing that individuals have some form of legal recognition in this, are we creating a system where there’s just litigation to go—that we’re making the courts, actually, determine those rights? [Bell rung] Mr Chair?

CHAIRPERSON (Greg O’Connor): Arena Williams.

ARENA WILLIAMS: That’s an expensive process. It’s a long process. So I want to be sure with the Minister that when we’re taking out the explicit purpose there of establishing a framework for individuals, we’re not going to see ourselves back here needing to flesh out those rights.

There’s another point under this, at clause (2)(b), where the bill, actually, still has the original framing around “improving access to data about products in those sectors”, and that “about products” has this implicit other side that it’s products for people. Because, if you are using the consumer data, either in an aggregate way—where you might be analysing people’s data to, say, make risk assessments and to then provide better data to other consumers about the range of products that are on offer for them, which is still, you know, explicitly set out in the purpose here—then you are sort of implicitly creating these rights for other people who are not necessarily customers now. They might be prospective customers. They might be people who are engaged in the system in another way.

And I’ll remind the Minister, just before I sit down—I don’t want to extend this call—we’re very excited about the application of this beyond just banking. This was never intended to just be about open banking—and this will be very, very impactful, right now, with the issues of competition in the banking sector—but we cannot forget that this applies to telecommunications, this applies to healthcare, and this applies to energy. There is real opportunity for New Zealand to step out into those sectors, which, frankly, around the world, have not enjoyed the ability to take up consumer data rights, because they have not had the empowering provisions that we do now. So let’s not forget about them. Those are sectors where the customer relationships, the transactional relationships, that banking has are certainly not the same, and they are broader.

Honourable Minister—but, just beforehand, I advise members this is now committee of the whole House. I might be banging my head against the brick wall, but we try to encourage question and answer sessions. I allowed the member to go over into a second session, but it would be easier if we can establish that relationship here, and I will endeavour, while I’m in the Chair, to ensure that members get ample opportunity to keep that discussion going. So, rather than a series of speeches, we can have some discussion, but let’s try it, shall we?

Thank you, Mr Chair, I appreciate your direction. Look, I want to engage positively and spontaneously with members as they ask questions, so I’m looking forward to that conversation.

The member Arena Williams makes a good point about the long gestation period of this piece of legislation. It’s often said that success has a thousand fathers—and sometimes mothers—failure but one, so I’m delighted to hear that the Opposition is still supportive of it, because I think it’s clear that this is going to be a good piece of legislation.

The bill provides a framework. One of the aspects about New Zealand being relatively late to the game in terms of this type of legislation is that we can learn from aspects in other jurisdictions that haven’t worked quite as well, and we can, hopefully, not replicate or repeat those errors, because we do want it to work appropriately here. So this piece of legislation provides a framework. The actual specific detail for individual sectors—the first will be banking, then we’re going to go to electricity, and then there are a range of other sectors that we can consider along the way, but those specifics will come in secondary legislation provided by regulations. Now, those will vary depending on the sector. That flexibility is important. The scope that the member referred to has changed, but I think for good reason, and for those reasons alone, in that it’s designed to be sufficiently robust in terms of its overarching framework to then enable the regulations for each sector to be appropriate and targeted and responsive to that particular sector.

I want to just make a point about clause 3(2)(b) about products, because a central aspect to the bill is about allowing customers, whether they are individuals or businesses, to benefit from the sharing of data. So the wording has been changed, but the purpose of the bill is to establish a framework to realise the value of that data for the benefit of customers, whether they be individuals and/or businesses. So I hope that that goes some way to reassure the member on that question.

Thank you, Mr Chair. Thank you to the Minister of Commerce and Consumer Affairs for that helpful answer. It leads me to my next question, which is: what is the impact on non-customers of the change to clause 3(1)(a), and then no subsequent change to clause 3(2)(a)?

Thank you, Mr Chair. Following on from the great introduction by my colleague Arena Williams—and I hear the Minister of Commerce and Consumer Affairs’ point about establishing a regulatory framework in order to allow businesses that this might be opened up to into the future, which is what, as my colleague’s explained, we’re excited about, beyond the banking sector.

I wonder, then, if that’s the case, with respect to in clause 3(2)(c), where it says there, “requiring certain safeguards, controls, standards, and functionality in connection with those data services.” if it is (1) the intention of the Minister to continually come back and update that regulatory framework through omnibus bills, through further legislation, or whether it’s just simple regulatory change that can be done at another level; or (2) as my colleague’s already mentioned, when we look towards what the penalties will be eventually, whether or not that will continue to need to be updated, reiterated, and of course debated in the House, given the scope of what the Minister’s answer was with respect to opening up to other parts, other sectors, other businesses.

One of the big things that Kiwis know, and, I dare say, people right across the world, is that their data is key—data is everything—and, in particular, their own data. When we look towards how we can secure that data but, more importantly, how we can secure the public’s confidence in the security and the use of that data, I want to make sure that they have that confidence that we have a regulatory framework that is agile enough. So my question directly to the Minister is with respect to subclause (2)(c) in clause 3 there.

Other parts that are always interesting—and when you look through the interpretation clause in this particular bill, as you do at every bill, interpretations are exactly that. You read through them, and some of them are quite straightforward, but my question to the Minister is why we’ve removed “derived data” from there. While it might be quite a technical or straightforward thing, I think, to build the confidence that New Zealanders expect when we use data like this or when people access, use, and share data like this, it would be useful if “derived data” and the explanation of why that’s taken out is explained to the committee. Because, as I flip forward and see where it’s been taken out, and that is clause 33(3), it says, “In this Act, derived data means” this. And I just wonder why it’s been taken out. I think it’s fair, as I say, to talk about the confidence that New Zealanders expect in this exciting and new and timely bill to make sure that we get these things right so that confidence is, of course, in our communities with respect to this now.

Thank you, Mr Chair. I want to continue to focus on the purpose clause in Part 1. I was on the Economic Development, Science and Innovation Committee that considered this, and it’s a very interesting area, but I do worry that the public won’t necessarily have caught up quite yet with the purpose of the bill.

If we have a look at clause 3(1)(b), which talks about the way that the purpose is to promote competition and innovation for the long-term benefit of the customer, I just wondered if you could explain for the benefit of the public what that long-term benefit that they’re missing out on at the moment is and why it would be that something like this would free up innovation and competition. How has it been used uncompetitively to stop competition in the market? I appreciate that we have talked a lot about that in terms of something like banking, and perhaps the public are more familiar—and that’s a good place to start: I’d love to talk about an example like that where people have come across those impediments in an area.

But I also would love to be more specific about some of those areas that you see as the next targets. My friend Arena Williams has talked about the issue over telecoms in healthcare. In an area like that, what would the Minister of Commerce and Consumer Affairs see as being the low-hanging fruit that would come next, and in what areas—in something like healthcare, for example? I don’t think that’s something that the New Zealand public would necessarily look at and see as one that would be impacted by this, so I’d be really grateful for an explanation of where you see the potential growth being.

I’d also just like to pick up on my friend’s question about clause 3(2)(c) and the issues there around the safeguards in place here. That was touched upon a little bit, but what sort of safeguards are there in this legislation, and why is it necessary to have them? What’s the balancing act that’s been brought to bear in this legislation? Thank you, Minister.

Thank you, Mr Chair; some good contributions there from the last three contributors. I’ll work backwards, if I might.

The broader picture that Helen White has just sort of painted for us is really at the nub of what this legislation is all about. It’s the potential opportunities for unexplored, as yet sometimes unimagined, benefits to New Zealand consumers. Because we haven’t had a regime where data is open and available, there are many opportunities that can be explored that most New Zealanders will not even yet have contemplated. And I think that’s the really exciting part about this legislation—the vista that lies before us all.

Just think about, for instance, some of the ability to use personal banking data in a way that means that live real-time on your phone, on your device, information about your personal budgeting information that currently isn’t available other than made by maybe Propellerhead people presenting and creating their own spreadsheet and what have you—some people do that, I know, but most of us don’t. So the ability to actually have access to that I think is phenomenal. But it’s not just in banking; it’s in a whole range of other areas, as the member has indicated, and is limited literally by our own imagination and limited also by the wit, skill, and ability of the enterprises that want to take advantage of it for our benefit.

Now, there are issues, of course, around security. There are issues, of course, around reliability. And there will always be a range of considerations that any consumer has to take into account in terms of what they see as, essentially, features and benefits of what’s on offer to them. So, look, we could go on for a very long period of time, and I’m sure the Chair will lose patience, because he is a man of vast imagination. But I do want to just say that at present—

CHAIRPERSON (Greg O’Connor): If little patience, is what you’re saying.

Hon SCOTT SIMPSON: If little patience. But, at present, businesses that hold customer and product data, they’re just simply not incentivised to release that data. Some of us of a certain age think of banks, for instance, that hold information incredibly tightly. Now, that information, that data, is actually my data as a customer of that bank. It’s actually not the bank’s data; it’s my data. And how I choose to use that data in association with another entity is actually something that I think opens up a huge opportunity for us all. So I’m excited by that.

That’s the type of thing that we’re missing out on at the moment. I had an opportunity a week or so ago to go and address a group of fintech operators. They literally speak a different language to most of us, because they operate a version in their technology world that someone of my age and generation finds, frankly, quite hard to comprehend, but a teenager just gets it in a nanosecond.

Arena Williams: Stop them lobbying me!

Hon SCOTT SIMPSON: Ha, ha! So there you go on that one.

The Hon Peeni Henare asked whether the legislation will need to be updated as technology and change occurs or whether it will be by the regulation. One of the things that I think we’ve learnt from international experience is actually that it’s the broad framework of the legislation that we want to be stable and secure. It needs to be robust enough to ensure that security and certainty can be provided to consumers and customers, and that data actually does have some protection. But, by the same token, it needs to be flexible, nimble enough, and nuanced enough to enable the regulations to be adjusted should they need to be with the changing of technology. And heaven knows that technology is changing at a pace that means almost certainly that over a period of time those regulations will need to be tweaked. But I think that having that mechanism of framework in the legislation, sector-specific regulation that can—as necessary and required—be adjusted, is very good.

In terms of Arena Williams’ comment, I think I covered that, I thought, pretty well in my first response to her question.

Thank you, Mr Chair. Yeah, I’m following on the conversations on clause 3, on the purpose, but I wanted to connect them to the terms listed in clause 5, “Interpretation”. First of all, can I just say that I really support, and our party supports, the change in subclause (1)(a) of clause 3 to focus on customers rather than individuals. But I think, to me, there’s a couple of words in, particularly, clause 3 that I do want to dig into deeper. First of all, because we do have in clause 5 a list of terms that are kind of considered for interpretation, and in clause 3(1)(a) we have the language “certain data”, I wonder whether the Minister of Commerce and Consumer Affairs thought that that needed to be more granular or sort of not so open-ended, seeing as we do have other language in clause 5 that is up for interpretation.

The second question is on clause 3(1)(b), and I know that other members have touched a bit on the language of competition. I also wondered, in terms of outcomes, and I wanted to raise a question and a bit of a challenge around why it is that particularly that part of the bill doesn’t so much speak about outcomes for consumers, because the language is still about promoting things like competition and innovation, but the bill actually does not guarantee nor promote specific outcomes for customers. That, to me, I guess, makes the assumption that increased competition and innovation will organically lead to better outcomes, but I think, to me, without identifying some of the outcomes that are being promoted in this bill, I can’t see how a customer actually would be reassured that, for example—you know, banking’s been used as an example, and I totally acknowledge the Minister’s words and others that this bill will touch on a range of sectors.

What are the specific outcomes the Minister is seeking as a result of greater competition and innovation, and, if he thinks that there are some specific outcomes that should be part of the purpose of this bill, were these explored in terms of incorporating them in clause 3 and, subsequently, I guess, then being further defined in the interpretations in clause 5. I notice in clause 5, for example, we actually don’t define competition or innovation. I know that perhaps that may feel like those are common-sense words, but, equally, somebody could argue that a lot of the terms in clause 5, like data, may not need to be defined because those are also common terms that we use in an everyday life. I guess, for the clarity of the public and moving forward with this bill, I wonder whether he thought that, actually, the interpretation of innovation—particularly innovation—should actually be better defined, particularly around the outcomes that that may have for consumers.

To recap, I’m particularly focused on clause 3(1)(a) on definition of “certain data” and then clause 3(1)(b) around whether outcomes should have been incorporated. Thank you.

Thank you, Mr Chair. The reason I asked the Minister of Commerce and Consumer Affairs about whether non-customers are covered in the purpose clause of the bill is because, when we get to clause 4(4)—where it’s a really nice plain-language setting out of how the bill fits together—it points straight to the secondary legislation, which will be designed on the back of this bill. If non-customers are not part of the bill and they’re not part of the empowering provisions, then the secondary legislation cannot deal with non-customer data. If you are not a customer of the energy company and the energy company is seeking to offer a range of products to you or about people like you, it cannot be regulated by the secondary legislation that comes out of this bill. That is not the intention that Labour had when Labour designed this legislation to be very broad and empowering. What I want from the Minister is to take us through the change at clause 3 that strikes out “individuals” and strikes out “organisations” and what that will mean for the secondary legislation.

I’m going to come back to that in other parts, particularly penalties, because the penalty regime does seem to envision broader groups of people having access to some form of the information. And the Minister is completely right when he says, “It’s not the bank’s data; it’s my data. I should have the ability to say how that data is used.” He is completely right. That is exactly the regime that we have. And, in New Zealand, we have a really great opportunity to do more than the other countries we compare ourselves to in this space—the EU, the UK, Australia—because we have such broad legislation in some other parts of this. But if it doesn’t let us make secondary legislation about the second layer of this data—if a bank holds pieces of information about you that it uses to make risk assessments based on someone like you, we’re not dealing with that in this legislation as derived data. I think that’s a really good thing. But, then, how will we deal with it? Because the way that this bill was designed in a previous life would have seen that as being dealt with under organisations and individuals, people in the ecosystem who are not customers.

With the risk of running out of time, let me take you to my questions on the interpretation clause: “deception”, here, is a change. It’s been defined using the Crimes Act definition, which is a very, very high standard. We’re talking about false representation via documents or conduct. We’re talking about the intent to deceive, and we’re talking about knowingly not providing material that was key to decisions. This is a really high standard. It is also failing to disclose key information when there was a duty to do so. But while that failure-to-disclose bit in the Crimes Act makes sense in a lot of criminal contexts when there is a duty to disclose, under this legislation there are not necessarily points at which you would disclose. There are no duties along the way. So I want to ask the Minister why that change was necessary and why “deception” has moved up to this “knowingly or recklessly” standard.

I also want to ask him about derived data. Look, we’re going to come back to this. Labour completely supports that. “Go for it!” is the message that people in the industry should be hearing from us. We want really effective use of this, and the strength of this will be industry leadership on this. But the removal of that means that, in other places in the legislation where it’s not dealing with the kind of information that comes from the consumer data, we need other protections in place. And I want the Minister to tell us about that.

I also just want to make the point that when we’re talking about analysis, risk assessments, personalised recommendations, those would have been covered by an idea like derived data. It’s good that it’s not in the legislation. But how does he envision then, say, the penalties applying to people who are using those? And we want them to keep doing that. This is, obviously, a regime that is designed for people to create an extra layer from the data that they derive from consumers, and consumers in most industries will really want that and want to empower that. I also want to ask him how the derived data provision came into the consultation when many in in the industry see that as something which was introduced late in the piece when they were dealing with the Ministry of Business, Innovation and Employment for many years. I just want him to explain that to us.

Thank you, Mr Chair. Again, some good questions. I just want to go back on a couple of matters. There was a question about the definition of “customer” and also “designated customer data”. I want to draw the committee’s attention to my Amendment Paper that is sitting on the Table. The intention in the Amendment Paper is to replace clause 8(1) to redefine a customer so that “Customer means a person that has acquired, acquires, or is seeking to acquire goods or services from a data holder.” I think that’s a tighter, more improved definition. Then in terms of “designated customer data”, the intention in the Amendment Paper is to identify this by replacing clause 8(3) on page 12 with the following: “Designated product data, in relation to a data holder and a provision of this Act, means product data that is specified, or belongs to a class specified, in the data holder’s designation regulations for the purposes of that provision.” So what we are attempting to do here is provide a sufficiently broad definition that, hopefully, will cover most, if not all, cases. Now, that’s a little bit tricky in terms of trying to get that right, but I think that the Amendment Paper redefinition is helpful.

I want to just comment quickly on the question of Ricardo Menéndez March relating to certain data. The intention there is that “certain data”, in inverted commas, covers customer data and product data. So it’s a two-way street. So it’s the product data and the customer data collectively.

There was a question earlier on about safeguards. I neglected to provide the committee with an assurance that one of the key features in terms of safeguards is the accreditation process that exists for the fintech entities. Now, there is an accreditation regime in the legislation. I think that’s a wise and good thing. So only accredited persons making requests will be accredited. Consent must be expressed and informed. So it’s not going to be an entity just sort of telling you what’s going to happen. The individual consumers and customers will have to express informed consent. And then there’s going to have to be some clarification of the application in terms of the Privacy Act. So that’s all part of this legislation and I think that the provisions of the Privacy Act are sufficiently robust to provide the certainty and security that citizens will be looking for.

There have been a couple of questions in relation to derived data. That is an area that occupied concern during the select committee process. There was quite a lot of debate about derived data and the potential that derived data would potentially impede the uptake and add complexity and costs to this new regime. Australia has a derived data process and the experience there we took into account in terms of drafting this legislation. In terms of the Australian experience—and I referred to this earlier on—one of our benefits of coming a little bit late to this legislation process is that it hasn’t worked particularly well in Australia. It’s been a negative experience. So the result at the Economic Development, Science and Innovation Committee, after, I think, careful deliberation and conversation, was that the committee voted unanimously to remove it. So I think that covers that.

I can see Dr Lawrence Xu-Nan is poised, ready for questions. We are getting close, so we’ll take the lunch break now. The House is suspended and will resume after question time.

Sitting suspended from 12.56 p.m. to 2 p.m.