Document ID: chunk:federal_register_of_legislation:F2024C01258:clause:4_11:p9
Version: federal_register_of_legislation:F2024C01258
Segment Type: clause
Provision Reference: sch 4 cl 11 (pt 9/36)
Character Range: 267858–270561

safeguards.
      This Part also sets out some additional civil penalty provisions that protect the privacy or confidentiality of CDR consumers' CDR data.

Division 7.2—Rules relating to privacy safeguards

Subdivision 7.2.1—Rules relating to consideration of CDR data privacy

7.2  Rule relating to privacy safeguard 1—open and transparent management of CDR data

Policy about the management of CDR data
 (1) For paragraph 56ED(3)(b) of the Act, the Information Commissioner may approve a form for a CDR policy.
 (2) For paragraph 56ED(3)(b) of the Act, the CDR entity's CDR policy must be in the form of a document that is distinct from any of the CDR entity's privacy policies.

Additional information for CDR policy
 (3) In addition to the information referred to in subsection 56ED(4) of the Act, the data holder's CDR policy must indicate:
 (a) whether it accepts requests for:
 (i) voluntary product data; or
 (ii) voluntary consumer data; and
 (b) if so:
 (i) whether it charges fees for disclosure of such data; and
 (ii) if it does―how information about those fees can be obtained.
 (4) In addition to the information referred to in subsection 56ED(5) of the Act, the CDR policy of an accredited person who is or who may become an accredited data recipient of CDR data must include the following:
 (a) a statement indicating the consequences to the CDR consumer if they withdraw a consent to collect and use CDR data;
 (b) a list of any other accredited persons with whom the accredited person has a sponsorship arrangement;
 (c) for each such arrangement—the nature of the services one party provides to the other party;
 (d) a list of the CDR representatives of the accredited person;
 (e) for each CDR representative—the nature of the goods and services that the CDR representative provides to customers using CDR data;
 (f) a list of the direct and indirect OSPs of the accredited person and of any CDR representative (whether based in Australia or based overseas, and whether or not any is an accredited person);
 (g) for each such service provider:
 (i) the nature of the services it provides;
 (ii) the CDR data or classes of CDR data that may be disclosed to it or collected by it;
 (h) if the accredited person wishes to undertake general research using the CDR data:
 (i) a description of the research to be conducted;
 (ii) a description of any additional benefit to be provided to the CDR consumer for consenting to the use;
 (i) if the accredited person, any CDR representative of the accredited person, or any direct or indirect OSP of either the accredited person or any of their CDR representatives, is likely to disclose CDR data of a kind referred to in subsection 56ED(5) of