Document ID: chunk:federal_register_of_legislation:F2024C01258:clause:4_11:p27
Version: federal_register_of_legislation:F2024C01258
Segment Type: clause
Provision Reference: sch 4 cl 11 (pt 27/36)
Character Range: 312599–315436

of the Act.

Division 9.2—Review of decisions

9.2  Review of decisions by the Administrative Appeals Tribunal
  Applications may be made to the Administrative Appeals Tribunal to review any of the following decisions:
 (a) a decision of the Data Recipient Accreditor under rule 5.10 to:
 (i) impose a condition on an accreditation; or
 (ii) vary a condition that has been imposed;
 (b) a decision of the Data Recipient Accreditor under rule 5.17 to:
 (i) suspend an accreditation; or
 (ii) extend a suspension; or
 (iii) revoke an accreditation.

Division 9.3—Reporting, record keeping and audit

Subdivision 9.3.1—Reporting and record keeping

9.3  Records to be kept and maintained

Records to be kept and maintained—data holder
 (1) A data holder must keep and maintain records that record and explain the following:
 (a) authorisations given by CDR consumers to disclose CDR data;
 (b) amendments to or withdrawals of authorisations to disclose CDR data;
 (c) notifications of withdrawals of consents to collect CDR data;
 (ca) where the data holder is a primary data holder—any requests for SR data made under subrule 1.23(4) and responses received under subrule 1.23(5) or (6);
 (cb) where the data holder is a secondary data holder:
 (i) any requests for SR data received under subrule 1.22(3) or 1.23(4) and responses given under subrule 1.22(4) or (5) or 1.23(5) or (6); and
 (ii) where the data holder has refused to disclose requested SR data—the reasons relied upon to refuse to disclose the SR data, including any rule or data standard;
 (d) disclosures of CDR data made in response to consumer data requests;
 (da) any written agreement of a kind referred to in subrule 2.4(5) the data holder has entered into;
 (e) instances where the data holder has refused to disclose requested CDR data and the rule or data standard relied upon to refuse to disclose the CDR data;
 (f) CDR complaint data;
 (fa) CDR consumer complaints;
 (g) the processes by which the data holder asks CDR consumers for their authorisation to disclose CDR data and for an amendment to their authorisation, including a video of each process.
  Civil penalty:
 (a) for an individual―$50,000; and
 (b) for a body corporate―$250,000.

Records to be kept and maintained—accredited data recipient
 (2) An accredited data recipient must keep and maintain records that record and explain the following:
 (a) all consents, including, if applicable, the uses of the CDR data that the CDR consumer has consented to under any use consents;
 (b) amendments to or withdrawals of consents by CDR consumers;
 (c) notifications of withdrawals of authorisations received from data holders;
 (d) CDR complaint data;
 (da) CDR consumer complaints;
 (e) collections of CDR data under these rules;
 (ea) disclosures of CDR data to accredited persons under these rules, and