Document ID: chunk:federal_register_of_legislation:F2024C01258:clause:4_4:p27
Version: federal_register_of_legislation:F2024C01258
Segment Type: clause
Provision Reference: sch 4 cl 4 (pt 27/75)
Character Range: 114740–117459

a request is a consumer data request made by a CDR consumer.
Note: A fee cannot be charged for the disclosure of required consumer data: see section 56BU of the Act.
 (3) A consumer data request made under this Part is valid if it is made by a CDR consumer who is eligible to make the request.
Note:  See rule 1.7 for the meaning of "eligible".  See also:
                  for the banking sector—clause 2.1 of Schedule 3;
                  for the energy sector—clause 2.1 of Schedule 4.

3.4  Disclosing consumer data in response to a valid consumer data request
 (1) This rule applies if a data holder has received a request that it reasonably believes to be a valid consumer data request made under this Part, for disclosure of CDR data of which it is the data holder.
 (2) The data holder may disclose any requested voluntary consumer data to the CDR consumer who made the request.
Note: See rule 1.7 for the meaning of "voluntary consumer data".  See also:
                  for the banking sector—clause 3.2 of Schedule 3;
                  for the energy sector—clause 3.2 of Schedule 4.
 (3) The data holder must, subject to rule 3.5, disclose any requested required consumer data to the CDR consumer who made the request:
 (a) through its direct request service; and
 (b) in accordance with the data standards.
Note 1: See rule 1.7 for the meaning of "required consumer data".  See also:
                  for the banking sector—clause 3.2 of Schedule 3;
                  for the energy sector—clause 3.2 of Schedule 4.
Note 2: For a request that relates to a joint account, see rules 4A.10 and 4A.15 for additional circumstances in which data relating to the joint account might not be disclosed under these rules.
Note 3: This subrule is a civil penalty provision (see rule 9.8).
Note 4: A fee cannot be charged for the disclosure of required consumer data: see section 56BU of the Act.

3.5  Refusal to disclose required consumer data in response to consumer data request
 (1) Despite subrule 3.4(3), the data holder may refuse to disclose required consumer data in response to the request:
 (a) if the data holder considers this to be necessary to prevent physical, psychological or financial harm or abuse; or
 (aa) in relation to an account that is blocked or suspended; or
 (b) in circumstances (if any) set out in the data standards.
 (2) The data holder must inform the CDR consumer of such a refusal in accordance with the data standards.
  Civil penalty:
 (a) for an individual―$50,000; and
 (b) for a body corporate―$250,000.

Part 4—Consumer data requests made by accredited persons

Division 4.1—Preliminary

4.1  Simplified outline of this Part

      This Part deals with consumer data