Document ID: chunk:federal_register_of_legislation:F2021L01392:clause:2_4:p1
Version: federal_register_of_legislation:F2021L01392
Segment Type: clause
Provision Reference: sch 2 cl 4 (pt 1/2)
Character Range: 17435–20191

4  After rule 1.10
Insert:

1.10AA  Meaning of CDR representative and related terms
Note: From the point of view of a CDR consumer who is the customer of a CDR representative, the consumer deals with the CDR representative, as if it were an accredited person, and may not deal with the principal at all.  The consumer requests the goods or services from the CDR representative; the CDR representative identifies the CDR data that it needs in order to provide the goods and services; the consumer gives their consent to the CDR representative for the collection and use of the CDR data.  The consumer is informed that the CDR principal will do the actual collecting, but as a background detail.
 (1) For these rules, where two persons are the principal and the representative in a CDR representative arrangement, the representative is a CDR representative of the principal.
 (2) For these rules, a CDR representative arrangement is a written contract between a person with unrestricted accreditation (the principal) and a person without accreditation (the representative) under which:
 (a) where the representative has obtained the consent of a CDR consumer to the collection and use of CDR data in accordance with rule 4.3A:
 (i) the principal will:
 (A) make any appropriate consumer data request; and
 (B) disclose the relevant CDR data to the representative; and
 (ii) the representative will use the CDR data to provide the relevant goods or services to the CDR consumer; and
 (iii) the representative may disclose the CDR data in accordance with a disclosure consent; and
 (b) the representative must not enter into another CDR representative arrangement; and
 (c) the representative must not engage a person as the provider in a CDR outsourcing arrangement; and
 (d) the representative is required to comply with the following requirements in relation to any service data:
 (i) in holding, using or disclosing the service data, the representative must comply with:
 (A) section 52EE of the Act (privacy safeguard 2);
 (B) section 52EG of the Act (privacy safeguard 4);
 (C) subsection 56EN(2) of the Act (privacy safeguard 11);
 (D) section 56EO of the Act (privacy safeguard 12); and
 (E) subsection 56EP(2) of the Act (privacy safeguard 13);
  as if it were the principal;
 (ii) the representative must take the steps in Schedule 2 to protect the service data as if it were the principal; and
 (iii) the representative must not use or disclose the service data other than in accordance with a contract with the principal;
 (iv) the representative must, when so directed by the principal, do any of the following:
 (A) delete any service data that it holds in accordance with the CDR data deletion process;
 (B) provide, to the principal, records of