Document ID: chunk:federal_register_of_legislation:F2024C01258:clause:4_11:p29
Version: federal_register_of_legislation:F2024C01258
Segment Type: clause
Provision Reference: sch 4 cl 11 (pt 29/36)
Character Range: 317671–320412

so disclosed; and
 (B) why the data was so disclosed;
 (iv) if the use is for general research―records of any additional benefit to be provided to the CDR consumer for consenting to the use;
 (k) records that are required to be made for the purposes of the CDR data de‑identification process when applied as part of privacy safeguard 12;
 (l) records of any matters that are required to be retained under Schedule 2 to these rules;
 (m) any terms and conditions on which the accredited data recipient offers goods or services where the accredited data recipient collects or uses, or discloses to an accredited person, CDR data in order to provide the good or service.
Note: For paragraph (k), see section 56EO of the Act and rule 7.12.
  Civil penalty:
 (a) for an individual―$50,000; and
 (b) for a body corporate―$250,000.

Records to be kept and maintained—CDR representative principal
 (2A) An accredited data recipient that is a CDR representative principal must keep and maintain records that record and explain the following in relation to each CDR representative:
 (a) the CDR representative arrangement;
 (b) the management of data by the CDR representative;
 (c) steps taken to ensure that the CDR representative complies with their requirements under the arrangement;
 (d) all consents obtained by the CDR representative, including, if applicable, the uses of the CDR data that the CDR consumer has consented to under any use consents;
 (e) amendments to or withdrawals of consents by CDR consumers;
 (f) notifications of withdrawals of authorisations received from data holders;
 (g) CDR complaint data;
 (ga) CDR consumer complaints;
 (h) collections of CDR data under these rules;
 (ha) disclosures of CDR data to accredited persons under these rules, and the accredited persons to which any CDR data was disclosed;
 (hb) disclosures of CDR data to trusted advisers, and trusted advisers to whom CDR data was disclosed;
 (hc) any steps taken for the purposes of subrule 1.10C(3) to confirm that a trusted adviser is a member of a class of trusted advisers;
 (hd) disclosures of CDR insights, including a copy of each CDR insight disclosed, to whom it was disclosed and when;
 (i) elections to delete and withdrawals of those elections;
 (j) the use of CDR data by the CDR representative;
 (k) the processes by which the CDR representative asks CDR consumers for their consent and for an amendment to their consent, including a video of each process;
 (ka) if applicable:
 (i) any CDR outsourcing arrangement to which the CDR representative, or a direct or indirect OSP of the CDR representative, is a party; and
 (ii) the use and management by each direct or indirect OSP of CDR data collected by it or provided to it under the