Document ID: chunk:federal_register_of_legislation:F2024C01258:clause:4_4:p30
Version: federal_register_of_legislation:F2024C01258
Segment Type: clause
Provision Reference: sch 4 cl 4 (pt 30/75)
Character Range: 122297–124912

CDR data from more than 1 CDR participant.
Note 2: The CDR data may be collected and used only in accordance with the data minimisation principle: see rule 1.8.
 (2A) The accredited person may also ask a CDR consumer to give a disclosure consent in relation to CDR data, either:
            1.     at the same time the accredited person asks the CDR consumer to give a collection consent under subrule (2) in relation to the CDR data; or
            2.     after the CDR consumer has given a collection consent requested under subrule (2) in relation to the CDR data whether or not the CDR data has yet been collected.
Note 1: Requests for collection consent, use consent and disclosure consent may be bundled together (see subrules 4.3(2) and (2A).
Note 2: The CDR data may be disclosed only in accordance with the data minimisation principle: see rule 1.8.
 (2B) If the accredited person is an affiliate and the CDR data will be collected by a sponsor at its request:
 (a) the request for a collection consent must specify that fact; and
 (b) a consent for the affiliate to collect the CDR data is taken to be consent for the sponsor to so collect it.
 (3) In giving the consents, the CDR consumer gives the accredited person a valid request to seek to collect that CDR data from the CDR participant.
Note: If the accredited person seeks to collect CDR data under this Part without a valid request, it will contravene privacy safeguard 3 (a civil penalty provision under the Act): see section 56EF of the Act.
 (4) The request ceases to be valid if the collection consent is withdrawn.
Note: So long as the use consent is not also withdrawn, the accredited person could continue to use CDR data it had already collected in order to provide the requested goods or services. However, the notification requirement of rule 4.18A would apply.
 (5) If an accredited person asks for a CDR consumer's consents for the purpose of making a consumer data request under this Part, the accredited person must do so in accordance with Division 4.3.
Note: This subrule is a civil penalty provision (see rule 9.8).

4.3A  Request for CDR representative principal to seek to collect CDR data on behalf of CDR representative
 (1) This rule applies if:
 (a) a CDR consumer requests a CDR representative to provide goods or services to the CDR consumer or to another person; and
 (b) the CDR representative needs to:
 (i) request its CDR representative principal to collect the CDR consumer's CDR data from a CDR participant under these rules; and
 (ii) use it in order to provide those goods or services.
 (2) The CDR representative