Access to customer data and business data
Part 1 contains regulation-making powers and ancillary provisions to allow the Secretary of State or the Treasury, by regulations, to require suppliers of goods, services and digital content, and other persons who process the relevant data, to provide customers or their authorised representatives with access to data relating to that customer (customer data) and to publish or provide customers or other parties with contextual information relating to the goods, services or digital content provided by the supplier (business data). Part 1 intends to facilitate the secure sharing of data with authorised third parties, at the customer’s request and in "real time", and provision of data in this way is referred to as "Smart Data".
	The Part 1 powers are intended to be used to facilitate the long-term continuation of Open Banking and extend its benefits in an open finance scheme, both of which the Government committed to support in its manifesto. They also largely reflect clauses in Part 3 of the Data Protection and Digital Information Bill of the 2022-3 and 2023-4 sessions the objectives of which, further to a consultation in 2019, was to enact powers to introduce Smart Data schemes across the economy.
	The powers, where they are exercised, are intended to provide enhanced data portability rights beyond the right to data portability in Article 20 of the UK GDPR. The Government’s view is that the UK GDPR does not guarantee provision of customer data in "real time" or in a useful format, does not cover wider contextual data and does not apply where the customer is not an individual.
	These powers replace the regulation-making powers in sections 89-91 (supply of customer data) of the Enterprise and Regulatory Reform Act 2013 (ERRA 2013) which enable the Secretary of State to make regulations to require the suppliers of goods or services to provide customer data to a customer or to a person authorised by the customer at the customer’s or authorised person’s request. The ERRA 2013 powers were introduced as a backstop should it not be possible for suppliers to develop voluntary programmes for the release of customer data.
	The Government is of the view that the ERRA 2013 powers are no longer sufficient to enable effective Smart Data schemes. For instance, they do not cover wider business data; they do not allow the regulations to make provision by reference to specifications and technical requirements published by a specified person which is essential as IT and security standards will require frequent updating to function in a fast-paced IT environment; they do not contain powers to require the collection and retention of data which is necessary to ensure that suppliers have consistent data sets for disclosure; they do not contain powers to regulate the onward disclosure or use of data which might be necessary.
	Since 2013, the Government’s understanding of what is required for a successful "Smart Data scheme" has evolved in particular because of the Open Banking scheme, in which the Competition and Markets Authority, following a market study, ordered (under its competition powers) the nine biggest banking providers in the UK to open up data relating to personal and business current accounts. These banking providers were required to set up the Open Banking Implementation Entity to oversee the scheme and to develop standards for data sharing interfaces to be used in the scheme. The Open Banking scheme enables customers to share their bank and credit card transaction data securely with third parties who can provide them with applications and services, and over 12 million customers now use it.
	The Government has also had regard to the recent enactment of powers in Part 4 of the Pension Schemes Act 2021 (which amend the Pensions Act 2004 and the Financial Services and Markets Act 2000) for pensions dashboards, an electronic communications service which allows individuals to access information about their pensions in one place.