Document ID: chunk:federal_register_of_legislation:F2024C01258:clause:4_4:p34
Version: federal_register_of_legislation:F2024C01258
Segment Type: clause
Provision Reference: sch 4 cl 4 (pt 34/75)
Character Range: 132048–134711

rule 9.8).

4.6  Disclosing consumer data in response to a consumer data request
 (1) This rule applies if:
 (a) a data holder has received a consumer data request made under rule 4.4 for disclosure of CDR data; and
 (b) the CDR consumer on whose behalf the request was made has given the data holder a current authorisation to disclose some or all of that CDR data.
 (2) The data holder may, subject to rule 4.6A, disclose, to the person who made the request, any of the requested voluntary consumer data that it is authorised to disclose.
Note 1: See rule 1.7 for the meaning of "voluntary consumer data".  See also:
                  for the banking sector—clause 3.2 of Schedule 3;
                  for the energy sector—clause 3.2 of Schedule 4.
Note 2: For requests that relate to joint accounts, additional requirements need to be met in order for the data holder to be authorised to disclose requested CDR data that relates to the joint account: see Part 4A.
 (3) It must do so:
 (a) through its accredited person request service; and
 (b) in accordance with the data standards.
Note: This subrule is a civil penalty provision (see rule 9.8).
 (4) The data holder must, subject to rule 4.6A and rule 4.7, disclose, to the person who made the request, the requested required consumer data that it is authorised to disclose:
 (a) through its accredited person request service; and
 (b) in accordance with the data standards.
Note 1:  See rule 1.7 for the meaning of "required consumer data".  See also:
                  for the banking sector—clause 3.2 of Schedule 3;
                  for the energy sector—clause 3.2 of Schedule 4.
Note 2: For requests that relate to joint accounts, additional requirements need to be met in order for the data holder to be authorised to disclose requested CDR data that relates to the joint account: see Part 4A.
Note 3: A fee cannot be charged for the disclosure of required consumer data: see section 56BU of the Act.
Note 4: Rule 7.4 (which deals with privacy safeguard 5, paragraph 56EH(a) of the Act) requires the accredited person to update its consumer dashboard for the CDR consumer on whose behalf the request was made to indicate the CDR data that was collected.
Note 5: Rule 7.9 (which deals with privacy safeguard 10, paragraph 56EM(1)(a) of the Act) requires the data holder to update its consumer dashboard for the CDR consumer on whose behalf the request was made to indicate the CDR data that was disclosed.
Note 6: This subrule is a civil penalty provision (see rule 9.8).

4.6A  Disclosure of CDR data relating to account not permitted if not approved by account holder
  Despite subrules 4.6(2)