Document ID: chunk:federal_register_of_legislation:F2024C01258:clause:4_4:p31
Version: federal_register_of_legislation:F2024C01258
Segment Type: clause
Provision Reference: sch 4 cl 4 (pt 31/75)
Character Range: 124667–127378

CDR representative needs to:
 (i) request its CDR representative principal to collect the CDR consumer's CDR data from a CDR participant under these rules; and
 (ii) use it in order to provide those goods or services.
 (2) The CDR representative may, in accordance with Division 4.3A, ask the CDR consumer to give:
 (a) a collection consent for the CDR representative principal to collect the CDR consumer's CDR data from the CDR participant and disclose it to the CDR representative; and
 (b) a use consent for the CDR representative to use it in order to provide those goods or services.
Note 1: For a collection consent mentioned in paragraph (a), see subrule 1.10A(8).
 For consents mentioned in paragraph (b), see rule 1.10A as applied to a CDR representative under subrule 1.10A(5).
Note 2: In order to provide goods or services in accordance with the CDR consumer's request, it might be necessary for the CDR representative principal to request CDR data from more than 1 CDR participant.
Note 3: The CDR data may be collected and used only in accordance with the data minimisation principle: see rule 1.8.
 (3) The CDR representative may also ask a CDR consumer to give a disclosure consent in relation to CDR data, either:
            1.     at the same time the CDR representative asks the CDR consumer to give a collection consent under subrule (2) in relation to the CDR data; or
            2.     after the CDR consumer has given a collection consent requested under subrule (2) in relation to the CDR data whether or not the CDR data has yet been collected.
Note 1: Requests for collection consent, use consent and disclosure consent may be bundled together (see subrules 4.3A(2) and (3).
Note 2: The CDR data may be disclosed only in accordance with the data minimisation principle: see rule 1.8.
 (4) In giving the consents, the CDR consumer gives the CDR representative principal a valid request to seek to collect that CDR data from the CDR participant.
Note: If an accredited person seeks to collect CDR data under this Part without a valid request, it will contravene privacy safeguard 3 (a civil penalty provision under the Act): see section 56EF of the Act.
 (5) The request ceases to be valid if the collection consent is withdrawn.
Note: So long as the use consent is not also withdrawn, the CDR representative principal could continue to disclose CDR data it had already collected to the CDR representative, and the CDR representative could use it in order to provide the requested goods or services. However, the notification requirement of rule 4.20O would apply.

4.3B  Consumer data requests by accredited persons to CDR representatives
Note: Subrule (1) allows an accredited person