Document ID: chunk:federal_register_of_legislation:F2017L00298:body:0:p25
Version: federal_register_of_legislation:F2017L00298
Segment Type: other
Provision Reference: 
Character Range: 61142–63966

Identification of customer or customer's business by name
 (28) If:
          (a)    the fields of customer data to which the research authorisation applies do not include the name of a customer or a customer's business; and
          (b)    the research entity becomes aware that other information has been added to the customer data in breach of the relevant requirement in paragraph (7)(b); and
          (c)   as a result of the breach, a customer or a customer's business is identified by name as being the customer or the customer's business to which the customer data relates;
       the entity must, as soon as practicable:
          (d)    destroy the customer data and the other information that has been added to the customer data; or
          (e)    take other steps to ensure that the customer or the customer's business is no longer identified in the way mentioned in paragraph (c).
 (29) If the research entity is a research representative body, the entity must ensure that the required arrangements impose obligations on each of its members to the effect that if:
           (a)    the member becomes aware that other information has been added to the customer data in breach of the required arrangements; and
           (b)    as a result of the breach, a customer or a customer's business is identified by name as being the customer or the customer's business to which the customer data relates;
            the member must:
           (c)    comply with subsection (28) as if:
              (i)     it were a research entity; and
              (ii)   the breach were a breach of the relevant requirement in paragraph (7)(b); and
           (d)    notify the entity in writing of the breach, and the steps taken to ensure that the customer or the customer's business is no longer identified in the way mentioned in paragraph (b), as soon as practicable.
 (30) The requirement in subsection (28) or (29) is in addition to the requirement in subsection (36).
Note: Under subsection (36), if the research entity becomes aware of a breach of the kind mentioned in subsection (28) or (29), the entity must, as soon as practicable, notify the ACMA of the breach and take all reasonable steps to minimise the effects of the breach.

Conditions specified by the Minister
 (31) If the research entity is a research representative body, the entity must ensure that the required arrangements impose an obligation on each of its members to the effect that the member must comply with the conditions specified by the Minister in a legislative instrument under section 295P of the Act as if the member were a research entity.
Note: See Note 2 under the definition of relevant requirements in section 1.4.

Other conditions
 (32) The ACMA:
 (a) may specify in writing other conditions to which the research authorisation