Document ID: chunk:federal_register_of_legislation:F2017L00298:body:0:p19
Version: federal_register_of_legislation:F2017L00298
Segment Type: other
Provision Reference: 
Character Range: 46230–48948

customer data
 (2) The research entity:
 (a) must make arrangements with the IPND Manager for the supply of the fields of customer data to which the research authorisation applies as soon as practicable after receiving written confirmation from the ACMA under subsection 4.3(8); and
 (b) must notify the ACMA in writing of the date on which the entity first receives the customer data within 10 business days after the start of the authorisation.

Disclosure of customer data
 (3) The research entity must not disclose the customer data to any person other than:
 (a) the ACMA; or
 (b) the entity's personnel; or
 (c) if the entity is a research representative body – its members;
       unless the disclosure is authorised or required by or under law.
 (4) If the research entity is a research representative body, the entity must comply with the following:
 (a) the entity is only permitted to disclose the following fields of customer data, about a customer or a customer's business, to any of its members:
 (i) the public number of the customer or business;
 (ii) the postcode, and the State or Territory, included in the directory address of the customer or business;
 (b) the entity must ensure that, before any disclosure of the customer data to any of its members, there are adequate arrangements in place that:
 (i) meet the requirements of this section; and
 (ii) are legally enforceable as between the entity and its members;
 (c) the entity must take reasonable steps to ensure that its members comply with the required arrangements;
 (d) the entity must ensure that the required arrangements impose an obligation on each of its members to the effect that the member must not disclose the customer data to any person other than:
 (i) the ACMA; or
 (ii) the member's personnel;
           unless the disclosure is authorised or required by or under law.

Application of Privacy Act 1988
 (5) The research entity must, for at least the duration of the research authorisation, be one of the following:
 (a) an organisation within the meaning of the Privacy Act 1988;
 (b) an entity whose name is entered in the register of small business operators who have chosen to be treated as organisations within the meaning of the Privacy Act 1988, which is kept by the Information Commissioner in accordance with section 6EA of that Act.
Note: Subsection (5) ensures that the Privacy Act 1988 applies to the research entity, for at least the duration of the research authorisation, in relation to the handling of any personal information.
 (6) If the research entity is a research representative body, the entity must ensure that the required arrangements impose an obligation on each of its members to the effect that