Document ID: chunk:federal_register_of_legislation:F2024C01258:clause:4_4:p7
Version: federal_register_of_legislation:F2024C01258
Segment Type: clause
Provision Reference: sch 4 cl 4 (pt 7/75)
Character Range: 65133–67808

other than subsection (1) (privacy safeguard 13);
 (b) the CDR representative must take the steps in Schedule 2 to protect the service data as if it were the CDR representative principal;
 (c) the CDR representative must not use or disclose the service data other than in accordance with a contract with the CDR representative principal;
 (d) the CDR representative must not use or disclose the service data unless the use or disclosure would be:
 (i) a permitted use or disclosure of the CDR data of the kind mentioned in paragraph 7.5(1)(j); or
 (ii) a permitted use or disclosure of the CDR data that relates to direct marketing of the kind mentioned in paragraph 7.5(3)(e);
 (e) the CDR representative must, when so directed by the CDR representative principal:
 (i) do any of the following:
 (A) delete any service data that it holds in accordance with the CDR data deletion process;
 (B) provide, to the CDR representative principal, records of any deletion that are required to be made under the CDR data deletion process; and
 (ii) require its direct and indirect OSPs to do the same;
 (f) the CDR representative must adopt and comply with the CDR representative principal's CDR policy in relation to the service data;
 (g) the CDR representative must comply with sections 56EK and 56EL of the Act (privacy safeguards 8 and 9) as if it were an accredited data recipient.
Note 1: For paragraph (4)(c), the CDR representative principal may be a direct or indirect OSP of the CDR representative, either as a result of provisions in the written agreement that make it also an CDR outsourcing arrangement under rule 1.10, or under a separate CDR outsourcing arrangement.
Note 2: For paragraph (4)(d), the permitted uses or disclosures are those that would be permitted if the representative were an accredited data recipient that had collected the CDR data under the consumer data request.  They include disclosure to a direct or indirect OSP for the purposes of providing the relevant goods and services.
Note 3: For paragraph (4)(e), see rule 1.18 for the definition of "CDR data deletion process".
 (5) In these rules, service data, in relation to a CDR representative, consists of any CDR data that:
 (a) was disclosed to the CDR representative for the purposes of the CDR representative arrangement; or
 (b)  is directly or indirectly derived from such CDR data.

1.10A  Types of consents
 (1) For these rules:
 (a) a collection consent is a consent given by a CDR consumer under these rules for an accredited person to collect particular CDR data from a CDR participant for that CDR data; and
 (b) a use consent is a consent given by a CDR consumer under these rules