Document ID: chunk:federal_register_of_legislation:F2024C01258:clause:4_4:p17
Version: federal_register_of_legislation:F2024C01258
Segment Type: clause
Provision Reference: sch 4 cl 4 (pt 17/75)
Character Range: 89863–92691

the authorisation.
Note 1: For paragraph (d), authorisations to disclose CDR data expire at the latest 12 months after they are given: see paragraph 4.26(1)(e).
Note 2: The consumer dashboard could contain other information too, for example, the written notice referred to in rules 7.10 (which deals with quality of CDR data under privacy safeguard 11, section 56EN of the Act) and 7.15 (which deals with correction requests under privacy safeguard 13, section 56EP of the Act).
 (3A) Paragraph (3)(h) applies on and after 1 July 2024.
 (4) A data holder does not contravene paragraph (1)(e) if the data holder takes reasonable steps to ensure that the online service complies with the paragraph.

Secondary users
 (5) If the CDR consumer is a secondary user for an account, the data holder must also provide the account holder with an online service that:
 (a) for each authorisation to disclose CDR data given by the secondary user—contains the details specified in subrule (3); and
 (b) allows the account holder, at any time, to withdraw the secondary user instruction; and
 (c) as part of the process of withdrawing a secondary user instruction, displays a message, in accordance with the data standards, about the consequences of proceeding with withdrawing a secondary user instruction; and
 (d) is simple and straightforward to use, and is no more complicated to use than the processes for giving the authorisation or instruction; and
 (e) is prominently displayed and readily accessible to the account holder.
Note: This subrule is a civil penalty provision (see rule 9.8).
 (6) A data holder does not contravene paragraph (5)(d) if the data holder takes reasonable steps to ensure that the online service complies with the paragraph.
 (7) If the data holder provides a consumer dashboard for the account holder, the service mentioned in subrule (5) must be included in the consumer dashboard.
Note: This subrule is a civil penalty provision (see rule 9.8).

Subdivision 1.4.4—Other obligations of accredited persons

1.16  Obligations relating to outsourcing arrangements

OSPs of accredited person
 (1) If an accredited person is the OSP chain principal of one or more direct or indirect OSPs, it must ensure that each direct and indirect OSP complies with its requirements under the relevant CDR outsourcing arrangement.
 (2) The accredited person breaches this subrule if a direct OSP or indirect OSP of the accredited person fails to comply with a required provision of the relevant CDR outsourcing arrangement.
Note: This subrule is a civil penalty provision (see rule 9.8).

OSPs of CDR representative of accredited person
 (3) If an accredited person is the CDR representative principal in a CDR representative arrangement under which it permits the CDR representative to engage direct or indirect OSPs, it must