The government has started working on improvements to the Consumer Data Right, as it seeks to simplify the rules and improve the consumer experience. Treasury has released two consultation documents, one dealing with consent rules and other with operational enhancements. In June, the Minister for Financial Services Stephen Jones announced the government would pause the expansion of CDR into superannuation, insurance and telecommunications while it took steps to improve data quality and security, and increase awareness and take-up. Jones said: “We want to do the work to get it right, to minimise the risks and maximise the benefits and to have clear use cases identified so that public and private investment can be properly assessed.” Under the current CDR rules, consumer consents cannot be “bundled”. The rules include multiple types of consent, including consents to collect, use, disclose and de-identify data, and conduct direct marketing activities. A consumer will generally be required to agree to a number of consents before being provided with a service. The Statutory Review of the Consumer Data Right said complex consent processes may discourage participation in CDR.  The consultation paper proposes that bundling of all consent types necessary for the provision of a service be allowed. Bundling of direct marketing and de-identification consents would not be allowed. The rules would allow approved data recipients to provide consumers with the ability to withdraw individual consents via the consumer dashboard, even where the initial consents were bundled. The paper proposes that when action initiation is introduced into the CDR system, bunded consent could be extended to action instructions. Other proposals to streamline the consent process are to allow ADRs to indicate the datasets that are needed for a service to function, instead of requiring the consumer to actively select each dataset, and to allow the ADR to specify the consent duration that is reasonably required for the requested service to function. Proposed operational enhancements include amendments to “secondary user instruction management services”, the process for consumers to appoint a nominated representative and more comprehensive “avoidance of harm” provisions. Under current rules a data holder can refuse to share data where it considers refusal is necessary to prevent physical, psychological or financial harm or abuse. The data holder’s options are limited to sharing the data in full or not sharing data at all. The paper proposes a more flexible approach, so that data holders can choose how to comply with their obligations.