Part 1: Access to Customer Data and Business Data Data regulations Section 2: Power to make provision in connection with customer data
Section 2 provides the principal regulation-making power in relation to customer data.
	Subsection (1) enables the Secretary of State or the Treasury to make regulations requiring data holders to provide customer data either directly to a customer (paragraph (a)) or to a person of a specified description who is authorised by the customer to receive the data (an "authorised person"), at the request of the customer or the authorised person (paragraph (b)).
	It is intended that data regulations will most likely require the provision of customer data to an authorised person (under paragraph (b)) rather than directly to the customer (under paragraph (a)) since the authorised person will be best able to make use of the data on the customer’s behalf (for instance, in the provision of innovative services such as account management services via a visual dashboard of accounts, displayed on a smartphone application). However, the regulation-making powers have been kept broad to allow regulations to provide for direct provision of data to customers in the future.
	Subsection (2) defines, in relation to customer data, a "third party recipient". A third party recipient is a person of a description specified (see further "specified" in section 25(1)) under subsection (1)(b) who a customer is able to authorise. The concept of a third party recipient is distinct from that of an authorised person: this is because regulations may impose requirements (such to have appropriate IT systems or to pay fees or a levy) on persons of the specified description. That may be the case where a person is "accredited" as a third party recipient by a decision-maker under section 6, but might not necessarily be authorised by a customer at any particular time. Section 3(2)(b) and (c) illustrates possible means by which the regulations may restrict the persons customers may authorise to act on their behalf.
	Subsection (3)(a) provides for the making of regulations which enable or require data holders to produce, collect or retain customer data or arrange for that to be done. The purpose of this power is to ensure that data holders have specific data to hand in order to ensure that Smart Data schemes can operate consistently and effectively.
	Subsection (3)(b) provides for the making of regulations which enable or require data holders to make changes to customer data if requested by the customer or an authorised person. This power is intended, in particular, to provide customers with rights to rectify data beyond the right to rectification in Article 16 of the UK GDPR which is limited to personal data and therefore does not cover customer data where a customer is not an individual.
	Subsection (4) enables the making of regulations which provide for an authorised person to be able take, on the customer’s behalf, action that the customer could take in relation to the goods, services or digital content supplied or provided by the data holder. The intention is that this power might, for instance, be used to allow the authorised person to access and use the goods, services, or digital content in question (for instance, to make a payment from the customer’s account) or transact with the trader (for instance, to negotiate an improved deal) on the customer’s behalf.
	Subsection (5) requires that in deciding whether to make regulations under section 2, the Secretary of State or the Treasury must (among other things) consider the likely effect of the regulations on customers, data holders, small and micro businesses, and on innovation in the supply of goods and products and competition. The concepts of small and micro-business are defined in section 25(1) by reference to the Small Business, Enterprise and Employment Act 2015.