Document ID: chunk:federal_register_of_legislation:F2024C01258:clause:4_4:p18
Version: federal_register_of_legislation:F2024C01258
Segment Type: clause
Provision Reference: sch 4 cl 4 (pt 18/75)
Character Range: 92437–95346

(see rule 9.8).

OSPs of CDR representative of accredited person
 (3) If an accredited person is the CDR representative principal in a CDR representative arrangement under which it permits the CDR representative to engage direct or indirect OSPs, it must ensure that each such direct and indirect OSP complies with its requirements under the relevant CDR outsourcing arrangement.
 (4) The accredited person breaches this subrule if a direct OSP or indirect OSP of the CDR representative fails to comply with a required provision of the relevant CDR outsourcing arrangement.
Note: This subrule is a civil penalty provision (see rule 9.8).

Accredited person acting as OSP for another accredited person
 (5) If an accredited person collects CDR data on behalf of another accredited person (the principal) as a direct or indirect OSP:
 (a) rules 7.4 and 7.9 apply only in relation to the principal; and
 (b) paragraph 7.10(1)(a) requires the principal to be identified.

Meaning of required provision
 (6) For this rule, a provision of a CDR outsourcing arrangement is a required provision if the arrangement would cease to be a CDR outsourcing arrangement under subrule 1.10(3) if the provision were removed.

1.16A  Obligations relating to CDR representative arrangements

Compliance with CDR representative arrangement
 (1) If an accredited person is the CDR representative principal in a CDR representative arrangement, it must ensure that the CDR representative complies with its requirements under the arrangement.
 (2) The accredited person breaches this subrule if the CDR representative:
 (a) fails to comply with a provision required to be included in the CDR representative arrangement by subrule 1.10AA(1), (3) or (4), or takes or omits to take action which would constitute a failure to comply with such a provision even if it is not included in the CDR representative arrangement; or
 (b) does one of the things referred to in subrule 1.10AA(2) in circumstances where the CDR representative arrangement does not provide for the CDR representative to do that thing.
Note: This subrule is a civil penalty provision (see rule 9.8).

Compliance with Division 4.3A
 (3) The accredited person must ensure that the CDR representative complies with Division 4.3A.
 (4) The accredited person breaches this subrule if the CDR representative fails to comply with a provision of Division 4.3A.
Note: This subrule is a civil penalty provision (see rule 9.8).

Subdivision 1.4.5—Deletion and de‑identification of CDR data

1.17  CDR data de‑identification process
 (1) This rule sets out the CDR data de‑identification process for particular CDR data (the relevant data).
Note: This process is applied by an accredited data recipient when de‑identifying CDR data in accordance with a consent from a CDR consumer (see Subdivision 4.3.3) and when de‑identifying redundant data for the purposes of privacy safeguard