Document ID: chunk:federal_register_of_legislation:F2024C01258:clause:4_4:p6
Version: federal_register_of_legislation:F2024C01258
Segment Type: clause
Provision Reference: sch 4 cl 4 (pt 6/75)
Character Range: 62611–65373

of CDR data in accordance with rule 4.3A:
 (i) the CDR representative principal will:
 (A) make any appropriate consumer data request; and
 (B) disclose the relevant CDR data to the CDR representative; and
 (ii) the CDR representative will use or disclose the CDR data to provide the relevant goods or services to the CDR consumer; and
 (c) that specifies that the provisions referred to in paragraphs (a) and (b) do not operate until the details of the CDR representative have been entered on the Register of Accredited Persons; and
 (d) under which the CDR representative is required to comply with:
 (i) any rules that are expressed as applying to a CDR representative; and
 (ii) any consumer experience data standards that are expressed as applying to an accredited data recipient, as if the CDR representative were an accredited data recipient.
 (2) A CDR representative arrangement may provide for the CDR representative:
 (a) to seek any consent for the use or disclosure of service data that the CDR representative principal could seek in the same circumstances; and
 (b) to make any use or disclosure of service data that would be:
  (i) a permitted use or disclosure of the CDR data of the kind mentioned in paragraph 7.5(1)(j); or
 (ii) a permitted use or disclosure of the CDR data that relates to direct marketing of the kind mentioned in paragraph 7.5(3)(e).
 (3) A CDR representative arrangement must require the CDR representative:
 (a) not to enter into another CDR representative arrangement; and
 (b) not to engage a person as the provider in a CDR outsourcing arrangement in relation to service data except as provided in the CDR representative arrangement.
Note: Because a CDR representative cannot collect CDR data except through its CDR representative principal, it cannot engage the provider to collect CDR data.
 (4) A CDR representative arrangement must require the CDR representative to comply with the following requirements in relation to any service data:
 (a) in holding, using or disclosing the service data, the CDR representative must comply with the following as if it were the CDR representative principal:
 (i) section 56EE of the Act (privacy safeguard 2);
 (ii) section 56EG of the Act (privacy safeguard 4);
 (iia) section 56EI of the Act (privacy safeguard 6);
 (iib) section 56EJ of the Act (privacy safeguard 7);
 (iii) section 56EN of the Act, other than subsection (1) (privacy safeguard 11);
 (iv) section 56EO of the Act (privacy safeguard 12);
 (v) section 56EP of the Act, other than subsection (1) (privacy safeguard 13);
 (b) the CDR representative must take the steps in Schedule 2 to protect the service data as if it were the CDR representative principal;
 (c) the CDR representative must not use or disclose