Customer and Product Data Bill

I present a legislative statement on the Customer and Product Data Bill.

DEPUTY SPEAKER: That legislative statement is published under the authority of the House and can be found on the Parliament website.

Hon ANDREW BAYLY: I move, That the Customer and Product Data Bill be now read a second time.

It is with great pleasure I stand tonight. I had my fourth meeting with approximately 60 fintechs—those are financial technology companies—who are keenly following the progress of this bill. I met them last Friday, and, no doubt, they’re watching this. I said that, hopefully, we were going to get to this bill this week, and what a pleasure to be standing tonight to present this bill for the second reading.

First of all, I’d like to thank members of the Economic Development, Science and Innovation Committee for their hard work in considering this bill. I would particularly like to acknowledge the chair, Dr Parmjeet Parmar, for her oversight throughout the process. The committee has reported the bill back to the House recommending some amendments, which I support and will speak to shortly.

I’d also like to thank all the submitters who took the time to provide comments to the committee, especially alongside the consultations around the banking and electricity sectors that will be under the supervision of this bill. The committee received 40 written submissions and heard oral evidence from 15 submitters. Many of these submitters were in support, and there were no submitters who were clearly opposed to the bill. It is clear that many are eager about the wide-ranging benefits of unlocking consumer and product data, and, of course, that is one of the key recommendations put forward by the Commerce Commission.

I’m excited about the role that this bill can play in our economic growth. This bill will unlock the untapped potential of customer and product data, boosting innovation and driving competition in certain sectors.

Since the bill was introduced, the Commerce Commission has completed its retail banking study. It has made a number of recommendations to the Government to accelerate and coordinate progress on open banking. There were three key areas of the recommendation from the Commerce Commission: one was around potential changes that the Reserve Bank could do, the second big chunk was around unleashing the opportunities from open banking, and then there were, third, a number of other specific recommendations, totalling 14, which the Government is committed to doing. Open banking is seen as being critical to improving competition in retail banking, giving consumers better and cheaper options. Progressing this bill is the first step in satisfying this recommendation.

Right now, businesses that hold customer and product data don’t have an incentive to invest in better sharing data, and this means it’s difficult for fintechs—financial technology companies—to negotiate contracts with those businesses that hold the data, limiting innovation and growth in our economy. There are also inefficiencies and security issues with some current methods for sharing customer and product data. An example which many people won’t realise is the risk that comes from what is called screen scraping, where customers are required to provide their login details to a third party, which is risky to those customers. Without legislative change, the use of data-sharing arrangements will continue to be limited, and security and privacy concerns are likely to grow.

Unlocking data means unlocking the potential for accurate, personalised services to be tailored to your needs, and puts you in the driver’s seat and lets you share data in a useful way with businesses that you trust. You have the choice, but it means that you can share that data for good purposes. This doesn’t just benefit everyday Kiwis; it also benefits businesses, who will be able to gain access to new products and services to help them to increase productivity and concentrate on growing their businesses. As a way of example, specifically in the banking sector, open data arrangements in Australia mean that you can get access to a loan within 10 minutes because a competing bank can go and access all your data and use systems to interrogate that and already know all the details they need to know about your income, your rent payments, your expenses—they can automatically download that and instantly be able to offer you a deal. That’s the type of stuff we’re wanting to see come into New Zealand.

This bill strikes a careful balance, limiting regulatory intervention to what is necessary. Government is involved in setting the rules for exchanging the data, but is not involved in the actual data exchange or storage. As I’ve said to the fintech industry and the banks, we want to create an environment where the system is run for industry and managed by the industry, but with an overall context of rules set by the Government. I’m excited to see the bill break down barriers for innovation, particularly for fintechs, enabling them to deliver new data-driven products and services to New Zealanders.

So what does the bill do? The bill provides a framework that can be applied to different sectors such as banking and electricity. It will be rolled out on a sector-by-sector basis through regulations and it is likely in time to also include telcos and the insurance sectors. Once applied to a sector, consumers will be able to unlock a range of products and services. Customers will no longer need to wade through months’ worth of statements when shopping around for a cheaper electricity plan or a mortgage. For example, you will no longer need to give away your online banking details to use more affordable payment options or to be able to use budgeting and saving apps to make the most of your hard-earned money. The bill provides a safe environment in which customers—including both individuals and businesses—can get the most out of their data.

I would now like to speak to some of the key changes. The first one relates to the adequacy of privacy protections. The committee heard various views from the submitters regarding privacy protections in the bill. Fintechs have said that the bill should not impose any additional restrictions for sharing customer data, both within the original form and in a modified form. They told the committee this would add legal and practical complexities and costs and would discourage take-up. Similar concerns have been raised in Australia, where they applied strict requirements which have reduced benefits and low uptake. The committee has unanimously recommended the removal of regulation-making powers restricting accredited requestors’ use, modification, or disclosure of customer data and derived data. I support this change.

Second, the protection from liability: the committee has unanimously recommended the addition of a new defence of providing data in good faith upon request. This change addresses possible scenarios where by complying with their obligations of the bill, data holders become inadvertently exposed to liability—for example, where an accredited requester is hacked and the person who has done the hacking requests customer data. I agree with this recommendation. I consider that data holders who are complying or purporting to comply with their obligations in good faith should not be held liable.

Another area the committee has unanimously recommended is a new power that enables the chief executive of the Ministry of Business, Innovation and Employment to delegate certain regulatory responsibilities such as the development of standards. This clarifies the intention to continue an industry-led approach—particularly in banking—so that the organisation with the right capacity can drive this work forward. I fully endorse this recommendation by the committee, and I would like to acknowledge that the banking sector has made significant progress in developing standards for open banking. This change to the bill provides the opportunity to continue this momentum for banking and other sectors.

Another area is the accreditation criteria. I support the committee’s changes to the accreditation criteria. Accredited requestors should be required to meet minimum criteria for security, regardless of the sector. More detailed requirements for each sector can be prescribed through regulations. An important part of promoting trust is ensuring that those receiving data have appropriate security systems in place and can handle data appropriately. This is what this change does. I expect this will build trust in the regime.

In conclusion, the committee has recommended some excellent improvements to the bill, and I thank the committee for their efforts. I believe the bill will be more effective for all participants. Progressing this bill is important and it shows how serious the Government is in driving open banking and, ultimately, competition, and unlocking the benefit for all New Zealanders. I commend the bill to the House.

The question is that the motion be agreed to.

Madam Speaker, thank you for the opportunity to speak to this great piece of legislation. Before I begin, I have a round of thanks. A round of thanks to the select committee that has really put in the work to understand the technical changes which were required of it, and a thankyou to the submitters, who really took the time to prepare—often assisted by external counsel and external advisers—to produce a very helpful and useful submission to the committee on those technical aspects, and to the Minister and his officials for taking on board the feedback that came through from not only the fintech industry but also privacy advocates and digital and data experts. These are really good changes that the Minister has committed to tonight, and I want to thank everyone involved in this piece of work.

I also want to thank the version of this bill which came to the House first. It was developed by the Hon Dr David Clark, who is very passionate about customer data and putting consumers in the driver’s seat when it comes to the use of their data. Thanks also to the Hon Dr Duncan Webb, who first developed the penalties regimes and the regime around protection of data within the bill, and then it was submitted by me in this Parliament as a member’s bill. It has passed through many hands, but it is in a better place because of it because there have been many people who have worked on it to make this legislation the best it can be.

Open data systems are at the heart of digitising our economy. This is something we can all get excited about because the productivity gains that something like this promises are huge. The UK regime has been incredibly successful. It now has more than 7 million users, with 750,000 of them being small businesses using that to access a new customer base that was not getting these services before, and those are small businesses that are often developing up a service that larger organisations can then either buy up or build some capacity for—like banks in an open banking regime, which are now working with the fintechs to deliver better customer services to a whole group of users who have never had these systems before. This is great and this is something we need, but we need to learn the lessons from overseas jurisdictions.

Now, let me just quickly touch on the changes which the Minister has considered too, so that I can also flag for him some of the issues we need to traverse later in the process as this legislation works its way through. The Minister has said that he’ll be supporting the changes that the committee has made around the privacy protections. That is great. It’s great, and the Labour Party supports it, because while we have a real need for privacy protections around people’s data, where people are choosing to give over their data in exchange for a valuable service to them, that is something that the Government should facilitate.

As the Minister rightly pointed out, often they’re going through a regime which was quite unsafe, where they were, say, giving out their credit card details to the local gym because they needed to sign up and that was the most efficient way to do it, or they were using with Air New Zealand the POLi scraping app, which goes into their bank account and gets all of the details but it actually uses their password to get in. Those regimes are not as safe as something where the data is managed in a secure application programming interface in a way that, end to end, has a verification system for the users who have access to that information, and then ways to dispose of that information when it’s no longer relevant to the organisations.

This is much safer and it’s an improvement, and the benefit that New Zealand has is that we have a great privacy regime already. We have great law around the privacy that New Zealanders can expect, which some of the regimes around the world didn’t have. The Australians could not build on that good law that New Zealand has, and so we should be using it as an advantage to us to then digitise and to modernise the way that we can do business here. Build on the things we do well, don’t break it if it’s not fixed—that is the right approach.

The second change that the Minister alluded to was the addition of a new defence of providing data on good faith through an accredited requester. That, again, is a good change, because in a system where we’re relying on trust—and all of these systems rely on trust, especially the old system where you might have been giving over your credit card to your gym via your email—this kind of system should rely on those people who have in place the right kind of systems and professional people handling information to be able to act in good faith as good-faith actors, and the law should back them up to do that.

Government is saying here to industry, “We back you to get the right systems in place, and then to trade in a way where you can believe that other people are good actors, and to put in protections so that bad actors cannot access the information in a way. But if there is some small chance that they will get through the barriers that you have created—the sensible cyber-protections that you have in place—then we will back you to make right, but we will not create sanctions which punish you and disincentivise good innovation in this area.” That’s a good change.

The third change we need to understand a little bit more, and we just need to reassure New Zealanders on, is that there are the right kind of incentives in our broader network of decision makers here so that everyone is getting a fair crack at this good go. I’m thinking here about how, in the situation where the chief executive of the Ministry of Business, Innovation and Employment has the power to delegate decision-making power and standard-setting power, the administration and the governance arrangements around that need to be robust so that big players and little players have faith in the system.

I don’t want to see our small fintechs feeling like the rules are rigged against them, and that the rules are being set by the big banks and that the small fintechs don’t get a fair shot at really disrupting that sector. I think that’s what we all want. We just need to make sure that the small guys in this world, the Doshes, the Akahus—I don’t actually know how small Dosh is. But, look, the people who are really giving it a good go and sticking it to the Aussie-owned banks can really be certain that behind the scenes, they don’t have an ability to screw the scrum—that the rules aren’t being set by people whose incentive it is to make sure that the big banks are really entrenching their power in this scenario.

We want open banking to be disruptive. The Labour Party believes that the small guys in this field should be getting the best go that they can. We need to make sure that that’s the case later in this process, and we certainly wouldn’t be agreeing to anything where the little guy wasn’t getting stuck up for.

I also wanted to just touch on some of the concerns that we raised in our differing view. There is something that didn’t go far enough and we would love to see an improvement in this area, or at least a commitment to review it later, and that is around derived data.

New Zealand company Xero is one of our huge success stories on the world stage. We are incredibly proud of the work that Xero does, not only in our domestic market, and the productivity gains that their business has been able to realise for small businesses, but also on the world stage. This is one of our biggest, most successful businesses, and they came to the Economic Development, Science and Innovation Committee and they said, “Look, derived data—it’s not the way to go. That was a mistake that the Australian regime made and it had a chilling effect on the small players in the Australian market, and we do not see a place for derived data in this legislation.”

The committee made some amendments around that and tried to respond to the critique there, but it’s really important that the Minister of Commerce and Consumer Affairs can also give us some assurances that derived data is not going to be a concept which is showing up in the policy making and the secondary legislation, because I don’t think it’s a concept that belongs in the New Zealand framework.

Derived data, essentially, will mean, as a right, that secondary players who accept that data—like Xero or any sort of accounting software—will need to owe duties to the person giving over that data when they’ve already given the primary data holder the ability to use that data in the way that they have agreed to. We think that that’s a step too far. We think it would have a chilling effect, and we don’t think that that’s the right approach. When you’ve got big businesses like Xero coming in and saying, “Look, this is going to have a big effect, and in Australia it hasn’t worked.”, we need to listen to that.

Very briefly, I also wanted to touch on the potential of this for more sectors. We’re thinking about this in banking, and, yes, we really want this to be revolutionary in New Zealand’s banking sector, but the Minister talked about telcos and insurance. Those are certainly industries that we want to see some movement in, but there’s also a real question around how effective this might be in the electricity industry, where we have technology improving rapidly in terms of the kind of information that householders can have about their electricity use and the technology that meters will provide to the lines company and to the electricity provider.

There’s a real need here to move with the times and say that if the data that is collected not only by smart appliances but also by smart meters could be available to the consumer—and that would be a consumer data piece of information that they might have rights over—then what are the gains that consumers can feel? How do we make sure that consumers aren’t paying too much for their electricity and that they’re getting the best deal but also that New Zealand’s grid is as efficient as it possibly could be—because we can use that data in a way to maximise efficiency over the use in households and in businesses?

There’s a huge benefit here for New Zealand to use consumer data rights and to enable consumers to choose to use it for the benefit of not only their own family and their own households but of their community, as well. This is so exciting for the way that our economy is going. We are going to be a world leader in this, following on from a few jurisdictions—but there are not many with these kinds of rights—and we need to really build this out into as many sectors as we possibly can and create the right incentives for small businesses to innovate in this space. I’m really excited about it. Thank you.

Thank you, Madam Speaker. We also support the Customer and Product Data Bill. Like the previous speakers, I want to start by acknowledging, first and foremost, everyone who submitted on this bill, and, in fact, everyone who has been campaigning on changes in this space for actually quite some time, and I’ll get to that in a moment. I also wanted to reflect on the speech of Arena Williams, the member prior to me, because, to me, I think this is one of those bills where we do have an opportunity to build cross-party consensus on achieving outcomes that are good for people, and I do think it’s a shame to have a speech that I think is inviting the Government to be constructive still be met with barracking and, actually, heckles.

At the end of the day, I think what we can do here in this space is get the best outcome for consumers, and in this case, it’s people who require the services of, for example, the banking industry, an industry that has been under the spotlight for quite some time. If you look at the history of this bill, we can note that this bill started, basically, in 2020, and I also do want to acknowledge the Hon David Clark and the Hon Dr Duncan Webb for the work that they’ve done since then to get a draft ready. I also commend the member who spoke prior to me, Arena Williams, for taking this on as a member’s bill.

I do think members’ bills are opportunities to pick up work that previous Governments could have undertaken, but I remember last term, actually, the fact was that we had quite a few events that were attended to in a cross-party way, with people calling for things like open banking—right? This is one of those issues that actually has had longstanding campaigning and support for it. What this bill will do, in many ways, is it will set up a regime to ensure that—well, the intention is that consumers’ data will be adequately protected, but then the regime will ensure that consumers can understand and people across our communities can understand which entity is offering them a better deal, whether it’s a gym, whether it’s a bank, or whether it’s in the electricity sector. I think this will be important to continue putting scrutiny in some of the industries that I do think have not actually given a fair deal to many members of our communities.

When this bill was initially being discussed, we were discussing issues around the profits that the banking sector was making, and many people at the time were talking about the difficulties of understanding which banks would offer them a deal that would enable them to actually have more money in their pockets. For families that are struggling to get by on a week-to-week basis, being able to have a regime that allows them to, basically, share their data with another provider and then to understand in a much more crystal-clear way how much they will gain from another provider will incentivise some of those companies to actually up their game, and rather than raking in massive profits, potentially reinvest some of that into offering better deals to our communities.

I do commend the Minister of Commerce and Consumer Affairs for addressing also some of the concerns that arose at the select committee stage. We all support the comments from the Minister in relationship to what he’s indicated in regards to privacy protection, but the comments around derived data do leave us concerned as well, because, at the end of the day, particularly when we’re aligning ourselves with other regimes, like in Australia, for example, or the UK, I think we should learn from what didn’t work so well in other regimes. In many ways, in my time here, what I have noticed is that we’re more prone to aligning ourselves with, say, for example, what Australia and the UK are doing. Sometimes we do choose to innovate, but when it comes to the provisions in regards to derived data, there are some really good examples in Australia as to why, actually, we need to look at what hasn’t worked in Australia to ensure that we don’t end up setting people back in that regard.

I also want to sort of touch on the fact that the submitters who presented on this bill also came with incredible technical knowledge, and I know that many of them would have been drawing on international comparisons, which is why I think those additional provisions that were recommended by previous speakers still stand. At the end of the day, this is actually honouring particularly the smaller players, but it has sent a message that while the regime is welcome—and I know that Consumer New Zealand, for example, has been quite welcoming of this regime—we still note that the balance isn’t 100 percent struck there yet. We do look forward to the committee of the whole House stage, to support amendments that look to address some of the concerns raised at the select committee stage.

I also finally want to touch on the fact that when it comes to the way that we’ll engage for consumer data, I do encourage the Government to continue doing work, and, no doubt, I hope this will be in the Minister’s agenda to also look in a future-looking kind of way at what kind of new scams could arise as a result of this regime. We know that the way that our different demographics engage with these kinds of regimes will change, and, therefore, I do think communications campaigns that help reach to, for example, our senior citizens and ethnically diverse communities will be really important to the success of this bill, because at the end of the day, when we set up new regimes like this one, the communication to our communities of how they work is what helps pin the success of this kind of consumer product data bill.

For example, I note that a lot of the time, when our English as a second language communities are engaging with services to get a good deal, they may struggle to actually understand how it is that they can engage with a regime that allows for data sharing. This is why I hope there is some cross-ministerial work—particularly for the agencies that help deal with our ethnic communities—to ensure that the information that is contained in this bill is communicated to the public more broadly. That is something that we hope to impact around how the Minister foresees the implementation of this bill at a community level, because otherwise we’ll see disparities around who is actually reaping the rewards of something that we do think has merit.

We have supported this bill at first reading, and so far we feel comfortable supporting this, even though we do think it could be strengthened, but I think, at the end of the day, how the Government thinks this could be implemented—I don’t support simply leaving it to the market and assuming that the companies themselves will end up communicating to our broad range of demographics what this actually means for consumers. We have seen already in the past feedback, particularly in the banking sector, that for different demographics, part of the issues that have arisen from not having an open banking regime also come with the fact that for many communities—and I include disabled people here—engaging with many industries to get a good deal is really, really challenging and the information that can be accessed by them isn’t readily available. Particularly, for example, when we think about the privacy provisions and data-protection provisions, this is where those additional implementation tools will be critical to ensure that there aren’t inequities created as a result of this bill.

From an economic inequities point of view, we do recognise the benefits that this bill will bring. At the end of the day, having a regime that will allow people to understand, for example, whether the bank that they’re with is actually giving them the best deal possible will reap economic and equities rewards. In saying that, I do encourage the Government to look beyond this bill about what else they can do to ensure that people are getting a good deal when it comes to banking and when it comes to other types of services, including in the electricity sector, because I think while the bill does modernise and digitise our economy, it cannot be treated as a silver bullet to a cost of living crisis, and I would go even broader to say an inequality crisis.

We look forward to what the comprehensive reforms will be in relationship to the sectors that we have outlined. But, other than that, we hope to be able to continue supporting this bill and we look forward to the Minister presenting changes that will further strengthen this bill. With that, I commend this bill to the House.

Debate interrupted.