Document ID: chunk:federal_register_of_legislation:F2021L01392:clause:2_10:p3
Version: federal_register_of_legislation:F2021L01392
Segment Type: clause
Provision Reference: sch 2 cl 10 (pt 3/4)
Character Range: 28006–30562

the CDR principal's CDR policy;
 (f) replace references to an outsourced service provider of the accredited person with references to an outsourced service provider of the CDR principal;
 (g) replace subrule 4.11(1A) with the following:
  "(1A)  A CDR representative must not ask a CDR consumer to give a disclosure consent for disclosure of CDR data by the CDR representative unless the consumer has already given the collection and use consents required for the data to be collected by the CDR principal and disclosed to and used by CDR representative.";
 (h) omit paragraph 4.11(3)(b);
 (i) replace paragraph 4.11(3)(i) with the following:
  "(i) the fact that the person is a CDR representative and that the CDR data will be collected by its CDR principal at its request;
 (j) if the CDR representative is not located in Australia—the country in which it is located;
 (k) the CDR principal's name; and
 (l) the CDR principal's accreditation number; and
 (m) a link to the principal's CDR policy; and
 (n) a statement that the CDR consumer can obtain further information about such collections or disclosures from the CDR principal's CDR policy if desired.";
 (ia) omit subrule 4.14(1B);
 (j) replace subrules 4.14(1C) and (2) with the following:
  "(1C)  If a CDR principal becomes a data holder, rather than an accredited data recipient, of particular CDR data as a result of subsection 56AJ(4) of the Act, all of the CDR representative's consents given under these rules that relate to that CDR data expire.
  "(2)  If a CDR principal's accreditation is revoked or surrendered in accordance with rule 5.17, all of the consents of any CDR representative expire when the revocation or surrender takes effect.";
 (k) replace subrule 4.16(2) with the following:
  "(2) The CDR consumer may make the election:
 (a) by communicating it to the CDR principal or CDR representative in writing; or
 (b) by using the CDR principal's consumer dashboard.";
 (l) add the following rule to Subdivision 4.3.5:
  "4.20B  Application of Subdivision to CDR principal and CDR representative
  Where an accredited person who is a CDR principal is required under this Subdivision to give a notice to a CDR consumer in relation to a consumer data request made at the request of a CDR representative, the notice may be given through the CDR representative.".
 (2) The accredited person breaches this subrule if the CDR representative fails to comply with a provision of Division 4.3 as modified by subrule (1).
Note: This subrule is a civil penalty provision (see rule 9.8).