Document ID: chunk:federal_register_of_legislation:F2024C01258:clause:4_4:p3
Version: federal_register_of_legislation:F2024C01258
Segment Type: clause
Provision Reference: sch 4 cl 4 (pt 3/75)
Character Range: 55331–57947

rules, where a person who is an accredited person or a CDR representative is the principal in one or more CDR outsourcing arrangements:
 (a) the provider in each such arrangement is a direct OSP (for "direct outsourced service provider") of the person; and
 (b) where a direct OSP of the person is also the principal in a further CDR outsourcing arrangement, the provider in the further arrangement is an indirect OSP of the person; and
 (c) where an indirect OSP of the person is also the principal in a further CDR outsourcing arrangement, the provider in the further arrangement is also an indirect OSP of the person; and
 (d) the person is the OSP chain principal of each direct and indirect OSP.
Note: Paragraph (c) can be applied repeatedly, so there may be a chain of indirect OSPs for each direct OSP.
 (2) Paragraph (1)(d) does not apply in relation to a person who is an accredited person or CDR representative that is a direct or indirect OSP of an OSP chain principal.

Content of a CDR outsourcing arrangement
 (3) In these rules, a CDR outsourcing arrangement is a written contract between a person (the OSP principal) and another person (the provider) under which:
 (a) the provider will do one or both of the following:
 (i) collect CDR data from a CDR participant in accordance with these rules on behalf of the OSP chain principal (for an OSP chain principal with unrestricted accreditation);
 (ii) use or disclose service data to provide specified goods or services to the OSP principal; and
 (b) the provider is required to comply with the following requirements in relation to any service data:
 (i) in holding, using or disclosing the service data, the provider must comply with the following as if it were the OSP principal:
  (A) the OSP principal's CDR policy as it relates to deletion and de‑identification of CDR data and the treatment of redundant or de‑identified CDR data;
 (B) section 56EG of the Act (privacy safeguard 4);
 (C) section 56EI of the Act (privacy safeguard 6);
 (D) section 56EJ of the Act (privacy safeguard 7);
 (E) section 56EK of the Act (privacy safeguard 8);
 (F) section 56EL of the Act (privacy safeguard 9);
 (ii) the provider must take the steps in Schedule 2 to protect the service data as if it were an accredited data recipient;
 (iii) the provider must not disclose service data other than:
 (A) to another direct or indirect OSP of the OSP chain principal; or
 (B) to the OSP chain principal; or
 (C) in circumstances where the disclosure of the service data by the OSP chain principal would be permitted under these rules;
 (iv) the provider must not use