Australian Competition and Consumer Commission issues four Consumer Data Right infringement notices to National Australia Bank with AUD 751,200 penalties for credit limit data disclosure failures

The Australian Competition and Consumer Commission (ACCC) issued four infringement notices to National Australia Bank Limited (NAB) for alleged contraventions of the Consumer Data Right (CDR) Rules, with NAB paying penalties totalling AUD 751,200. The notices relate to alleged failures to disclose, or accurately disclose, credit limit data in response to four separate requests made by different CDR-accredited providers on behalf of consumers. The ACCC emphasised that CDR data must be accurate, up to date, complete and in the required format, noting that inaccurate credit card limit information affected services provided by fintechs, including mortgage broking tools using CDR data. NAB’s payment is the highest amount paid for alleged CDR Rules contraventions to date; the bank cooperated with the investigation and rectified the data quality issues. At the time of the alleged conduct, each infringement notice carried a fixed penalty of AUD 187,800 for a listed corporation, rising to AUD 198,000 per notice from 7 November 2024. The ACCC reiterated that payment of an infringement notice penalty is not an admission of a contravention and that it may take enforcement action where it has reasonable grounds to believe CDR Rules have been breached. The regulator also flagged data quality as a continuing CDR conduct priority as the regime expands, citing participant reporting that more than 530,000 consumers used CDR products and services in the banking and energy sectors in the second half of 2024, alongside approximately 582 million consumer data requests.