Document ID: chunk:federal_register_of_legislation:F2021L01392:clause:2_30
Version: federal_register_of_legislation:F2021L01392
Segment Type: clause
Provision Reference: sch 2 cl 30
Character Range: 38096–40403

30  After subrule 9.3(2)
Insert:

Records to be kept and maintained—CDR principal
 (2A) An accredited data recipient that is a CDR principal must keep and maintain records that record and explain the following in relation to each CDR representative:
 (a) the CDR representative arrangement;
 (b) the management of data by the CDR representative;
 (c) steps taken to ensure that the CDR representative complies with their requirements under the arrangement;
 (d) all consents obtained by the CDR representative, including, if applicable, the uses of the CDR data that the CDR consumer has consented to under any use consents;
 (e) amendments to or withdrawals of consents by CDR consumers;
 (f) notifications of withdrawals of authorisations received from data holders;
 (g) CDR complaint data;
 (h) collections of CDR data under these rules;
 (i) elections to delete and withdrawals of those elections;
 (j) the use of CDR data by the CDR representative;
 (k) the processes by which the CDR representative asks CDR consumers for their consent and for an amendment to their consent, including a video of each process;
 (l) if CDR data was de-identified in accordance with a consent referred to in paragraph 4.11(3)(e):
 (i) how the data was de‑identified; and
 (ii) how the CDR representative used the de‑identified data; and
 (iii) if the CDR representative disclosed (by sale or otherwise) the de‑identified data to another person as referred to in paragraph 4.15(b):
 (A) to whom the data was so disclosed; and
 (B) why the data was so disclosed;
 (iv) if the use is for general research―records of any additional benefit to be provided to the CDR consumer for consenting to the use;
 (m) records that are required to be made for the purposes of the CDR data de‑identification process when applied as part of privacy safeguard 12;
 (n) records of any matters that are required to be retained under Schedule 2 to these rules;
 (o) any terms and conditions on which the CDR representative offers goods or services where the CDR representative collects or uses, or discloses to an accredited person, CDR data in order to provide the good or service.
Note: For paragraph (k), see section 56EO of the Act and rule 7.12.
  Civil penalty:
 (a) for an individual―$50,000; and
 (b) for a body corporate―$250,000.