Document ID: chunk:federal_register_of_legislation:F2024C01258:clause:4_4:p4
Version: federal_register_of_legislation:F2024C01258
Segment Type: clause
Provision Reference: sch 4 cl 4 (pt 4/75)
Character Range: 57721–60345

of the OSP chain principal; or
 (B) to the OSP chain principal; or
 (C) in circumstances where the disclosure of the service data by the OSP chain principal would be permitted under these rules;
 (iv) the provider must not use or disclose the service data other than in accordance with a contract with the OSP principal; and
 (v) the provider must:
 (A) when directed by the OSP principal, do any of the things referred to in paragraphs (5)(a), (b), (c) or (d); and
 (B) when directed by the OSP chain principal, do any of the things referred to in paragraphs (5)(a), (b), (c) or (d); and
 (C) if the OSP chain principal is a CDR representative—when directed by the CDR representative principal of the OSP chain principal, do any of the things referred to in paragraphs (5)(b), (c) or (d);
 (vi) if the provider is the OSP principal in a further CDR outsourcing arrangement (the arrangement), it must ensure that the other person in the arrangement complies with the requirements of the arrangement, including in relation to service data of the other person that was disclosed to it by the OSP chain principal or another direct or indirect OSP of the OSP chain principal.
Note: See rule 1.18 for the definition of "CDR data deletion process".
 (4) For subparagraph (3)(a)(ii), the provision of the specified goods or services must be:
 (a) where the OSP principal is the OSP chain principal—for the purpose of enabling the OSP chain principal to provide CDR consumers for the service data with the goods and services for the purposes of which a relevant consent to collect the service data, or the CDR data from which it               was directly or indirectly derived, was given; and
 (b) otherwise—for the purpose of enabling the OSP principal to provide the goods and services specified in the CDR outsourcing arrangement for which it is the provider.
 (5) For subparagraph (3)(b)(v), the things are the following:
 (a) provide that person with access to any service data that it holds;
 (b) in accordance with the CDR data deletion process, delete any service data that it holds and make the required records;
 (c) provide to that person any such required records;
 (d) direct any other person to which it has disclosed service data under a further CDR outsourcing arrangement to take corresponding steps.

Service data
 (6) In these rules, service data, in relation to a person who is a direct or indirect OSP of an OSP chain principal, means any CDR data of a CDR consumer of the OSP chain principal held by the person that:
 (a) was disclosed to the person by the OSP chain principal for the purposes of the relevant