Document ID: chunk:federal_register_of_legislation:F2024C01258:clause:4_11:p30
Version: federal_register_of_legislation:F2024C01258
Segment Type: clause
Provision Reference: sch 4 cl 11 (pt 30/36)
Character Range: 320202–322895

the CDR representative, or a direct or indirect OSP of the CDR representative, is a party; and
 (ii) the use and management by each direct or indirect OSP of CDR data collected by it or provided to it under the relevant CDR outsourcing arrangement; and
 (iii) the steps that:
 (A) the CDR representative principal; and
 (B) the CDR representative;
  have taken to ensure that each direct or indirect OSP of the CDR representative complies with the requirements of the relevant CDR outsourcing arrangement, including how their direct OSPs ensure compliance by indirect OSPs;
 (l) if CDR data was de‑identified in accordance with a consent referred to in paragraph 4.20E(3)(i):
 (i) how the data was de‑identified; and
 (ii) how the CDR representative used the de‑identified data; and
 (iii) if the CDR representative disclosed (by sale or otherwise) the de‑identified data to another person as referred to in paragraph 4.20L(b):
 (A) to whom the data was so disclosed; and
 (B) why the data was so disclosed;
 (iv) if the use is for general research―records of any additional benefit to be provided to the CDR consumer for consenting to the use;
 (m) records that are required to be made for the purposes of the CDR data de‑identification process when applied as part of privacy safeguard 12;
 (n) records of any matters that are required to be retained under Schedule 2 to these rules;
 (o) any terms and conditions on which the CDR representative offers goods or services where the CDR representative collects or uses, or discloses to an accredited person, CDR data in order to provide the good or service.
Note: For paragraph (m), see section 56EO of the Act and rule 7.12.
  Civil penalty:
 (a) for an individual―$50,000; and
 (b) for a body corporate―$250,000.

Specificity of records
 (3) Each record referred to in this rule must include the date and time when the record was made and, if applicable, the date and time when the event described by the record occurred.

Translation of records
 (4) Where a record referred to in this rule is kept in a language other than English, an English translation of the record must be made available within a reasonable time to a person who:
 (a) is entitled to inspect the records under Subdivision 9.3.2; and
 (b) asks for the English translation.

Period for retention of records
 (5) Each record referred to in this rule must be kept for a period of 6 years beginning on the day the record was created.
  Civil penalty:
 (a) for an individual―$50,000; and
 (b) for a body corporate―$250,000.

9.4  Reporting requirements

Reports that must be prepared—data holder
 (1) A data holder must prepare a report for each reporting period that:
 (a) is