Document ID: chunk:federal_register_of_legislation:F2024C01258:clause:4_11:p20
Version: federal_register_of_legislation:F2024C01258
Segment Type: clause
Provision Reference: sch 4 cl 11 (pt 20/36)
Character Range: 294991–297617

the accredited person to whom the CDR data was disclosed; and
 (b) states the date of the disclosure; and
 (c) identifies the CDR data that was incorrect in the sense referred to in paragraph 56EN(3)(b) of the Act; and
 (d) states that:
 (i) the CDR consumer can request the CDR participant to disclose the corrected CDR data to the accredited person; and
 (ii) if such a request is made, the corrected CDR data will be so disclosed.
Note 1: For paragraph (d), see subsection 56EN(4) of the Act.
Note 2: The written notice could be given through the CDR participant's consumer dashboard (see rule 1.14 and rule 1.15).
Note 3: See rule 1.16 for how this rule applies in the case of a CDR outsourcing arrangement in which a provider collects CDR data on behalf of an OSP principal.
 (2) A single notice may deal with one or more such disclosures.
 (3) The notice must be provided:
 (a) as soon as practicable; and
 (b) in any event—within 5 business days;
  after the CDR participant becomes aware of the matter referred to in paragraph 56EN(3)(b) of the Act.

7.10A  Rule relating to privacy safeguard 11—quality of data—CDR representative
 (1) A CDR representative principal breaches this subrule if its CDR representative fails to comply with subsection 56EN(2) of the Act in relation to service data of a CDR consumer as if it were an accredited person.
Note 1: See rule 1.10AA for the definition of "service data" in relation to a CDR representative arrangement.
Note 2: This subrule is a civil penalty provision (see rule 9.8).
 (2) For subrule (1), it is irrelevant whether the action of the CDR representative in relation to the service data is in accordance with the CDR representative arrangement.

7.11  Rule relating to privacy safeguard 12—security of CDR data
 (1) For subsection 56EO(1) of the Act, the steps are set out in Schedule 2.
Note: Broadly speaking, the steps are for an accredited data recipient of CDR data to:
 define and implement security governance in relation to CDR data; and
 define the boundaries of the CDR data environment; and
 have and maintain an information security capability; and
 implement a formal controls assessment program; and
 manage and report security incidents.
 (2) For this rule, where an accredited data recipient is an OSP chain principal, a failure by a direct or indirect OSP to comply with Schedule 2 in relation to service data is taken to be a failure by the accredited data recipient.
 (3) For this rule, where an accredited data recipient is a CDR representative principal, a failure by:
 (a) the CDR representative; or
 (b) any direct or indirect OSP of the