Document ID: chunk:federal_register_of_legislation:F2024C01258:clause:4_11:p28
Version: federal_register_of_legislation:F2024C01258
Segment Type: clause
Provision Reference: sch 4 cl 11 (pt 28/36)
Character Range: 315163–317895

CDR consumers;
 (c) notifications of withdrawals of authorisations received from data holders;
 (d) CDR complaint data;
 (da) CDR consumer complaints;
 (e) collections of CDR data under these rules;
 (ea) disclosures of CDR data to accredited persons under these rules, and the accredited persons to which any CDR data was disclosed;
 (eb) disclosures of CDR data to trusted advisers, and trusted advisers to whom CDR data was disclosed;
 (ec) any steps taken for the purposes of subrule 1.10C(3) to confirm that a trusted adviser is a member of a class of trusted advisers;
 (ed) disclosures of CDR insights, including a copy of each CDR insight disclosed, to whom it was disclosed and when;
 (ee) the number of business consumer statements received;
 (ef) disclosures of CDR data under a business consumer disclosure consent, and persons to whom the CDR data was disclosed;
 (eg) any steps taken for the purposes of subrule 1.10A(9) to confirm that a CDR consumer is a CDR business consumer;
 (f) elections to delete and withdrawals of those elections;
 (g) the use of CDR data by the accredited data recipient;
 (h) the processes by which the accredited data recipient asks CDR consumers for their consent and for an amendment to their consent, including a video of each process;
 (i) if applicable:
 (i) any sponsorship arrangement to which the accredited data recipient is a party; and
 (ii) the use and management by the other party to each such arrangement of CDR data collected by it or provided to it under the arrangement;
 (ia) if applicable:
 (i) any CDR outsourcing arrangement to which the accredited data recipient, or a direct or indirect OSP of the accredited data recipient, is a party; and
 (ii) the use and management by each direct or indirect OSP of CDR data collected by it or provided to it under the relevant CDR outsourcing arrangement; and
 (iii) the steps that the accredited data recipient has taken to ensure that each direct or indirect OSP complies with the requirements of the relevant CDR outsourcing arrangement, including how their direct OSPs ensure compliance by indirect OSPs;
 (j) if CDR data was de‑identified in accordance with a consent referred to in paragraph 4.11(3)(e):
 (i) how the data was de‑identified; and
 (ii) how the accredited data recipient used the de‑identified data; and
 (iii) if the accredited data recipient disclosed (by sale or otherwise) the de‑identified data to another person as referred to in paragraph 4.15(b):
 (A) to whom the data was so disclosed; and
 (B) why the data was so disclosed;
 (iv) if the use is for general research―records of any additional benefit to be provided to the CDR consumer for consenting to the use;
 (k) records that are required to