Document ID: chunk:federal_register_of_legislation:F2024C01258:clause:4_11:p21
Version: federal_register_of_legislation:F2024C01258
Segment Type: clause
Provision Reference: sch 4 cl 11 (pt 21/36)
Character Range: 297387–300058

taken to be a failure by the accredited data recipient.
 (3) For this rule, where an accredited data recipient is a CDR representative principal, a failure by:
 (a) the CDR representative; or
 (b) any direct or indirect OSP of the CDR representative;
to comply with Schedule 2 in relation to service data is taken to be a failure by the CDR representative principal.

7.12  Rule relating to privacy safeguard 12—de‑identification of redundant data
 (1) For subsection 56EO(2) of the Act, this rule applies if:
 (a) the accredited data recipient, when it asked for consent to collect and use the CDR data, gave the CDR consumer the statement referred to in paragraph 4.17(1)(b) or (c); and
 (b) the CDR consumer has not elected, in accordance with rule 4.16, that their redundant data should be deleted; and
 (c) in the case of a statement referred to in paragraph 4.17(1)(c)―the accredited person thinks it appropriate in the circumstances to de‑identify rather than delete the redundant data.
Note 1: The CDR data de‑identification process is set out in rule 1.17.
Note 2: If this rule does not apply, rule 7.13 applies: see subrule 7.13(1).
 (2) The steps are:
 (a) to apply the CDR data de‑identification process to the redundant data; and
 (b) direct any direct OSP or CDR representative of the accredited data recipient (the recipient of the redundant data) that had been provided with a copy of the redundant data:
 (i) to delete the redundant data, as well as any CDR data that has been directly or indirectly derived from it, and notify the accredited data recipient of the deletion; and
 (ii) to, if the recipient of the redundant data has provided any such data to its own direct OSP (the further recipient), give the direction set out in this paragraph to the further recipient as if the further recipient were itself the recipient of the redundant data.
Note: If the redundant data cannot be de‑identified in accordance with the CDR data de‑identification process, it must be deleted in accordance with the CDR data deletion process: see subrule 1.17(4).
 (3) For this rule, where an accredited data recipient is a CDR representative principal, a failure by a CDR representative to comply with subsection 56EO(2) of the Act in relation to service data as if:
 (a) it were a CDR entity; and
 (b) the references in this rule to provisions in Division 4.3 were references to the corresponding provisions in Division 4.3A;
is taken to be a failure by the CDR representative principal.

7.13  Rule relating to privacy safeguard 12—deletion of redundant data
 (1) For subsection 56EO(2) of the Act, this rule applies if rule 7.12 does not apply.
 (2) The step is to