Document ID: chunk:federal_register_of_legislation:F2024C01258:clause:4_11:p18
Version: federal_register_of_legislation:F2024C01258
Segment Type: clause
Provision Reference: sch 4 cl 11 (pt 18/36)
Character Range: 290108–292760

CDR representative fails to comply with section 56EL of the Act in relation to service data of a CDR consumer as if it were an accredited data recipient of the service data.
Note 1: See rule 1.10AA for the definition of "service data" in relation to a CDR representative arrangement.
Note 2: This subrule is a civil penalty provision (see rule 9.8).

7.8B  Rule relating to privacy safeguards 8 and 9—failure by direct or indirect OSP to comply with safeguards

Privacy safeguard 8—overseas disclosure
 (1) An accredited person breaches this subrule if a direct or indirect OSP of:
 (a) the accredited person; or
 (b) a CDR representative of the accredited person;
fails to comply with section 56EK of the Act in relation to service data of a CDR consumer as if it were an accredited data recipient of the service data.
Note 1: See rule 1.10AA for the definition of "service data" in relation to a CDR representative arrangement.
Note 2: This subrule is a civil penalty provision (see rule 9.8).

Privacy safeguard 9—government related identifiers
 (2) An accredited person breaches this subrule if a direct or indirect OSP of:
 (a) the accredited person; or
 (b) a CDR representative of the accredited person;
fails to comply with section 56EL of the Act in relation to service data of a CDR consumer as if it were an accredited data recipient of the service data.
Note 1: See rule 1.10AA for the definition of "service data" in relation to a CDR representative arrangement.
Note 2: This subrule is a civil penalty provision (see rule 9.8).

7.9  Rule relating to privacy safeguard 10—notifying of the disclosure of CDR data
 (1) For subsection 56EM(1) of the Act, a data holder that discloses CDR data to an accredited person as a result of a consumer data request must, as soon as practicable, update each consumer dashboard that relates to the request to indicate:
 (a) what CDR data was disclosed; and
 (b) when the CDR data was disclosed; and
 (c) the accredited data recipient, identified in accordance with any entry on the Register of Accredited Persons specified as being for that purpose.
Note 1: For correction requests, see section 56EP of the Act (privacy safeguard 13) and Subdivision 7.2.5 of these rules.
Note 2: If a consumer data request is made that relates to a joint account, the other joint account holder's consumer dashboard may not be required to be similarly updated. See rule 4A.13.
Note 3:  See paragraph 1.15(3)(f).
Note 4: See subrule 1.16(5) for how this rule applies where the CDR data is collected by an accredited person acting as a direct or indirect OSP to the accredited data recipient.
 (2) For subsection 56EM(2)