Document ID: chunk:federal_register_of_legislation:F2024C01258:clause:4_11:p10
Version: federal_register_of_legislation:F2024C01258
Segment Type: clause
Provision Reference: sch 4 cl 11 (pt 10/36)
Character Range: 270328–273113

person, any CDR representative of the accredited person, or any direct or indirect OSP of either the accredited person or any of their CDR representatives, is likely to disclose CDR data of a kind referred to in subsection 56ED(5) of the Act to a direct or indirect OSP that:
 (i) is based overseas; and
 (ii) is not an accredited person;
  —the countries in which such direct or indirect OSPs are likely to be based if it is practicable to specify those countries in the policy;
 (j) if applicable—the following information about de‑identification of CDR data that is not redundant data:
 (i) how the accredited person uses CDR data that has been de‑identified in accordance with the CDR data de‑identification process to provide goods or services to CDR consumers;
 (ii) the further information specified in subrule (5);
 (k) the following information about deletion of redundant CDR data:
 (i) when it deletes redundant data;
 (ii) how a CDR consumer may elect for this to happen;
 (iii) how it deletes redundant data;
 (l) if applicable—the following information about de‑identification of redundant CDR data:
 (i) if the de‑identified data is used by the accredited person—examples of how the accredited person ordinarily uses de‑identified data; and
 (ii) the further information specified in subrule (5);
 (m) the following information about the CDR consumer's election to delete their CDR data:
 (i) information about how the election operates and its effect;
 (ii) information about how CDR consumers can exercise the election.
Note 1: For paragraph (i), if the direct or indirect OSP is an accredited person who is based overseas, paragraph 56ED(5)(f) of the Act requires that accredited person to include similar information in the person's CDR policy.
Note 2:  This subrule is a civil penalty provision (see rule 9.8).
 (5) For subparagraphs (4)(j)(ii) and (l)(ii), the further information is:
 (a) how the accredited person who is or who may become an accredited data recipient of CDR data de‑identifies CDR data, including a description of techniques that it uses to de‑identify data; and
 (b) if the accredited person ordinarily discloses (by sale or otherwise) de‑identified data to one or more other persons:
 (i) that fact; and
 (ii) to what classes of person it ordinarily discloses such data; and
 (iii) why it so discloses such data.
 (6) In addition to the information referred to in paragraphs 56ED(4)(b) and (5)(d) of the Act, the CDR policy of the CDR entity (the data holder or accredited person who is or who may become an accredited data recipient of CDR data) must include the following information in relation to the CDR entity's internal dispute resolution processes:
 (a) where a CDR consumer complaint can be made;
 (b) how a CDR consumer complaint can