Document ID: chunk:federal_register_of_legislation:F2024L01409:clause:1_29
Version: federal_register_of_legislation:F2024L01409
Segment Type: clause
Provision Reference: sch 1 cl 29
Character Range: 9237–11921

29  Subclauses 7.2(1) and (2) of Schedule 3
Repeal the subclauses, substitute:
 (1) For the purposes of paragraph 56AJ(4)(c) of the Act, the following conditions are specified:
 (a) the accredited person is an ADI;
 (b) the accredited person has collected CDR data, or any data directly or indirectly derived from CDR data (together, the relevant CDR data), in accordance with a collection consent;
 (c) the accredited person reasonably believes that the relevant CDR data is relevant to its supply of a product to the CDR consumer, for that data;
 (d) either:
 (i) the conditions specified in subclause (2); or
 (ii) the conditions specified in subclause (2A).

   Conditions involving notification prior to first collection
 (2) For subparagraph (1)(d)(i), the conditions are:
 (a) either:
 (i) the accredited person is supplying the product to the CDR consumer; or
 (ii) the accredited person has received an application from the CDR consumer for the supply of the product to the CDR consumer, or is aware that the CDR consumer proposes to apply for the supply of the product; and
 (b) prior to the first collection of the relevant CDR data in accordance with the collection consent, the accredited person notified the CDR consumer that the accredited person would hold that data in accordance with the accredited person's usual data holding practices for consumer data.
Note:  If, prior to the first collection of the relevant CDR data, an accredited person has notified the CDR consumer in accordance with this subclause, the accredited person does not need to notify the CDR consumer again before collecting further data in accordance with the collection consent.

    Conditions involving request for consent
 (2A) For subparagraph (1)(d)(ii), the conditions are that:
 (a) the accredited person is supplying the product to the CDR consumer; and
 (b) the accredited person has requested the CDR consumer to consent to the accredited person changing from an accredited data recipient of the relevant CDR data to a data holder of the relevant CDR data; and
 (c) the accredited person has informed the CDR consumer:
 (i) that, if the consumer consents to that change, the privacy safeguards applicable to a data holder (rather than those applicable to an accredited data recipient) would apply to the accredited person in relation to the relevant CDR data; and
 (ii) of the manner in which the accredited person proposes to treat the relevant CDR data; and
 (iii) why the accredited person was entitled to request the consumer's consent to the change; and
 (iv) of the consequences of the consumer not giving their consent to the change; and
 (d) the CDR consumer has consented.