Document ID: chunk:federal_register_of_legislation:F2024C01258:clause:4_4:p55
Version: federal_register_of_legislation:F2024C01258
Segment Type: clause
Provision Reference: sch 4 cl 4 (pt 55/75)
Character Range: 184741–187606

data that was de‑identified in accordance with the CDR data de‑identification process before the collected data from which it was derived became redundant.

4.20N  Information relating to redundant data
 (1) For subparagraph 4.20E(3)(n)(i), the CDR representative must state whether they have a general policy, when collected CDR data becomes redundant data, of:
 (a) deleting the redundant data; or
 (b) de‑identifying the redundant data; or
 (c) deciding, when the CDR data becomes redundant data, whether to delete it or de‑identify it.
 (2) A CDR representative that gives the statement referred to in paragraph (1)(b) or (c) must also state:
 (a) that, if it de‑identifies the redundant data:
 (i) it would apply the CDR data de‑identification process; and
 (ii) it would be able to use or, if applicable, disclose (by sale or otherwise) the de‑identified redundant data without seeking further consent from the CDR consumer; and
 (b) what de‑identification of CDR data in accordance with the CDR data de‑identification process means; and
 (c) if applicable, examples of how it could use the redundant data once de‑identified.
Note:  For the CDR data de‑identification process, see rule 1.17.

Subdivision 4.3A.8—Notification requirements

4.20O  CDR receipts
  A CDR representative must give the CDR consumer a notice that complies with the data standards as soon as practicable after:
 (a) the CDR consumer gives the CDR representative a collection consent, a use consent or a disclosure consent; or
 (b) the CDR consumer amends such a consent in accordance with this Division; or
 (c) the CDR consumer withdraws such a consent in accordance with rule 4.20J.
Note: A failure to do this could make the CDR representative principal liable for a civil penalty (see rule 1.16A).

4.20P  Notification of data holder or accredited data recipient if collection consent expires
 (1) This rule applies if:
 (a) an accredited person has made a consumer data request on behalf of a CDR representative to a CDR participant based on a collection consent given under this Division relating to particular CDR data and a particular CDR participant; and
 (b) the request has not been completely resolved; and
 (c) the consent expires for any reason.
 (2) The accredited person must notify:
 (a) if the CDR participant is a data holder―the data holder, in accordance with the data standards, that the consent has expired; and
 (b) if the CDR participant is an accredited data recipient―the accredited data recipient as soon as practicable that the consent has expired.
Note: This subrule is a civil penalty provision (see rule 9.8).

4.20Q  Notification of consumer if collection consent expires
 (1) This rule applies if, in relation to particular goods or services a CDR representative is providing as referred to in subrule 4.3A(1):
 (a) the collection consent expires; but