Document ID: chunk:federal_register_of_legislation:F2024C01258:clause:4_11:p35
Version: federal_register_of_legislation:F2024C01258
Segment Type: clause
Provision Reference: sch 4 cl 11 (pt 35/36)
Character Range: 332593–335345

receiving the request.
  Civil penalty:
 (a) for an individual―$50,000; and
 (b) for a body corporate―$250,000.
 (5) A data holder must not charge a fee for making or responding to a request under subrule (1).
  Civil penalty:
 (a) for an individual―$50,000; and
 (b) for a body corporate―$250,000.
 (6) An accredited data recipient must not charge a fee for making or responding to a request under subrule (2).
  Civil penalty:
 (a) for an individual―$50,000; and
 (b) for a body corporate―$250,000.

Subdivision 9.3.2—Audits

9.6  Audits by the Commission and the Information Commissioner
 (1) The Commission may, at any time, audit the compliance of any CDR participant with any or all of the following:
 (a) Part IVD of the Act, including Division 5 of Part IVD to the extent that it relates to these rules;
 (b) these rules;
 (c) the data standards.
 (2) The Information Commissioner may, at any time, audit the compliance of any CDR participant with any or all of the following:
 (a) the privacy safeguards (Division 5 of Part IVD of the Act);
 (b) these rules to the extent that they relate to:
 (i) the privacy safeguards (see in particular Part 7 of these rules); or
 (ii) the privacy and confidentiality of CDR data.
 (3) For the purposes of conducting an audit or otherwise monitoring the compliance of the CDR participant with the provisions mentioned in subrules (1) and (2), the Commission, or the Information Commissioner, may give a CDR participant a written notice that requests the CDR participant to produce, within the time specified in the notice:
 (a) copies of records that are required by this Division to be kept; or
 (b) information from such records.
 (4) The CDR participant must comply with a request under subrule (3).
Note: This subrule is a civil penalty provision (see rule 9.8).

9.7  Audits by the Data Recipient Accreditor
 (1) The Data Recipient Accreditor may, at any time, audit the compliance of an accredited data recipient with any or all of the following:
 (a) the obligations under rule 5.12;
 (b) any conditions imposed on their accreditation.
 (2) For the purposes of conducting an audit or otherwise monitoring the compliance of the accredited data recipient with the criteria and conditions mentioned in subrule (1), the Data Recipient Accreditor may give an accredited data recipient a written notice that requests the accredited data recipient to produce:
 (a) copies of records that are required by this Division to be kept; or
 (b) information from such records.
 (3) The accredited data recipient must comply with a request under subrule (2).
Note: This subrule is a civil penalty provision (see rule 9.8).
 (4) The Data Recipient Accreditor must provide a copy of any audit report to the Commission