Document ID: chunk:federal_register_of_legislation:F2024C01258:clause:4_11:p13
Version: federal_register_of_legislation:F2024C01258
Segment Type: clause
Provision Reference: sch 4 cl 11 (pt 13/36)
Character Range: 277744–280513

collected.
 (2) Where the CDR data was collected by a sponsor on behalf of an affiliate:
 (a) the sponsor is not required to provide the consumer dashboard; and
Note: The affiliate, as an accredited person that makes the consumer request through the sponsor, is required to provide the consumer dashboard under subrule 1.14(1).
 (b) the sponsor and the affiliate may choose which of them will be responsible for updating the consumer's dashboard in accordance with subrule (1); and
 (c) the dashboard must also indicate that the CDR data was collected by the sponsor on behalf of the affiliate.
Note 1: See also paragraph 1.14(3)(ha).
Note 2: See subrule 1.16(5) for how this rule applies where the CDR data is collected by an accredited person acting as a direct or indirect OSP to the accredited data recipient.

Subdivision 7.2.3—Rules relating to dealing with CDR data

7.5  Meaning of permitted use or disclosure and relates to direct marketing

Permitted uses or disclosures that do not relate to direct marketing
 (1) For these rules, for an accredited data recipient that has collected CDR data under a consumer data request under Part 4 on behalf of a CDR consumer, each of the following is a permitted use or disclosure:
 (a) using the CDR consumer's CDR data to provide goods or services requested by the CDR consumer (the existing goods or services):
 (i) in compliance with the data minimisation principle; and
 (ii) in accordance with a current use consent from the CDR consumer, other than a direct marketing consent;
 (b) in accordance with a current de‑identification consent, de‑identifying the CDR consumer's CDR data in accordance with the CDR data de‑identification process and:
 (i) using the de‑identified data for general research; or
 (ii) disclosing (including by selling) the de‑identified data;
 (c) directly or indirectly deriving CDR data from the collected CDR data in order to use the data in accordance with paragraph (a) or (b);
 (d) for the purpose of providing the existing goods or services—disclosing, to the CDR consumer, any of their CDR data;
 (e) subject to rule 7.5A, disclosing the CDR consumer's CDR data in accordance with a current disclosure consent;
 (f) disclosing the CDR consumer's CDR data to:
 (i) a direct or indirect OSP of the accredited data recipient; or
 (ii) the other party in a sponsorship arrangement;
  where the disclosure is made:
 (iii) for the purpose of doing the things referred to in paragraphs (a) to (e); and
 (iv) to the extent reasonably needed to do those things;
 (g) disclosing (by sale or otherwise), to any person, CDR data that has been de‑identified in accordance with the CDR data de‑identification process on becoming redundant data;
 (h) where the accredited data recipient collected