Document ID: chunk:federal_register_of_legislation:F2024C01258:clause:4_11:p11
Version: federal_register_of_legislation:F2024C01258
Segment Type: clause
Provision Reference: sch 4 cl 11 (pt 11/36)
Character Range: 272864–275521

may become an accredited data recipient of CDR data) must include the following information in relation to the CDR entity's internal dispute resolution processes:
 (a) where a CDR consumer complaint can be made;
 (b) how a CDR consumer complaint can be made;
 (c) when a CDR consumer complaint can be made;
 (d) when acknowledgement of a CDR consumer complaint can be expected;
 (e) what information is required to be provided by the complainant;
 (f) the CDR entity's process for handling CDR consumer complaints;
 (g) time periods associated with various stages in the CDR consumer complaint process;
 (h) options for redress;
 (i) options for review, both internally (if available) and externally.
Note: This subrule is a civil penalty provision (see rule 9.8).
 (7) If an accredited person is who is or who may become an accredited data recipient of CDR data proposes to store CDR data other than in Australia or an external territory, its CDR policy must specify any country in which they propose to store CDR data.
Note: This subrule is a civil penalty provision (see rule 9.8).

Availability of policy
 (8) For paragraph 56ED(7)(b) of the Act, the CDR entity must make its CDR policy readily available through each online service by means of which the CDR entity, or a CDR representative of the CDR entity, ordinarily deals with CDR consumers.
Note: This subrule is a civil penalty provision (see rule 9.8).
 (9) For subsection 56ED(8) of the Act, if a copy of the CDR entity's policy is requested by a CDR consumer, the CDR entity must give the CDR consumer a copy:
 (a) electronically; or
 (b) in hard copy;
  as directed by the consumer.
Note: This subrule is a civil penalty provision (see rule 9.8).

7.3  Rule relating to privacy safeguard 2—anonymity and pseudonymity
 (1) For subsection 56EE(3) of the Act, subsection 56EE(1) of the Act does not apply if:
 (a) the accredited person who is or may become an accredited data recipient of CDR data is required or authorised by law or by a court/tribunal order to deal with an identified CDR consumer in relation to particular CDR data; or
 (b) in relation to particular CDR data, it is impracticable for the accredited data recipient to deal with a CDR consumer that has not been identified.
 (2) A CDR representative principal breaches this subrule if its CDR representative fails to comply with section 56EE of the Act in relation to service data of a CDR consumer as if it were an accredited person.
Note 1: See rule 1.10AA for the definition of "service data" in relation to a CDR representative arrangement.
Note 2: This subrule is a civil penalty provision (see rule 9.8).
 (3) For subrule