Document ID: chunk:federal_register_of_legislation:F2024C01258:clause:4_4:p35
Version: federal_register_of_legislation:F2024C01258
Segment Type: clause
Provision Reference: sch 4 cl 4 (pt 35/75)
Character Range: 134472–137201

made to indicate the CDR data that was disclosed.
Note 6: This subrule is a civil penalty provision (see rule 9.8).

4.6A  Disclosure of CDR data relating to account not permitted if not approved by account holder
  Despite subrules 4.6(2) and (4), the data holder must not disclose requested CDR data that relates to a particular account to the person who made the request if:
 (a) both of the following are satisfied:
 (i) the request was made on behalf of a secondary user of the account;
 (ii) the account holder has indicated, through their consumer dashboard, that they no longer approve CDR data relating to that account being disclosed to that accredited person in response to consumer data requests made by that secondary user; or
 (b) a provision of these rules provides that the requested CDR data must not be disclosed.
Note:  For paragraph (b)—for example, see subrules 4A.10(5) and (6) in relation to joint accounts.

4.7  Refusal to disclose required consumer data in response to consumer data request
 (1) Despite subrules 4.5(3), 4.6(4) and 4.22A(1), a data holder may refuse to ask for an authorisation in relation to the relevant CDR data, to invite a CDR consumer to amend the authorisation, or to disclose required consumer data in response to the request:
 (a) if the data holder considers this to be necessary to prevent physical, psychological or financial harm or abuse; or
 (b) if the data holder has reasonable grounds to believe that disclosure of some or all of that data would adversely impact the security, integrity or stability of:
 (i) the Register of Accredited Persons; or
 (ii) the data holder's information and communication technology systems; or
 (c) in relation to an account that is blocked or suspended; or
 (d) in circumstances (if any) set out in the data standards; or
 (e) if the disclosure of some or all of that CDR data would not be permitted because of another provision of these rules.
 (3) The data holder must inform the accredited person of such a refusal in accordance with the data standards.
  Civil penalty:
 (a) for an individual―$50,000; and
 (b) for a body corporate―$250,000.

Subdivision 4.2.4—Consumer data requests by accredited persons to accredited data recipients

4.7A  Consumer data request by accredited person to accredited data recipient
 (1) If:
 (a) a CDR consumer has given an accredited person a request under rule 4.3 or 4.3A to seek to collect CDR data from an accredited data recipient; and
 (b) the request is valid;
  the accredited person may request the accredited data recipient to disclose, to the accredited person, some or all of the CDR data that:
 (c) is the subject of the relevant collection consent, use consent and disclosure consent;