Document ID: chunk:federal_register_of_legislation:F2021L01392:clause:2_10:p1
Version: federal_register_of_legislation:F2021L01392
Segment Type: clause
Provision Reference: sch 2 cl 10 (pt 1/4)
Character Range: 23046–25635

10  After rule 4.3
Insert:

4.3A Request for CDR principal to seek to collect CDR data on behalf of CDR representative
 (1) This rule applies if:
 (a) a CDR consumer requests a CDR representative to provide goods or services to the CDR consumer or to another person; and
 (b) the CDR representative needs to:
 (i) request its CDR principal to collect the CDR consumer's CDR data from a CDR participant under these rules; and
 (ii) use it in order to provide those goods or services.
 (2) The CDR representative may, in accordance with Division 4.3, ask the CDR consumer to give:
 (a) a collection consent for the CDR principal to collect their CDR data from the CDR participant; and
 (b) a use consent for:
 (i) the CDR principal to disclose that data to the CDR representative; and
 (ii) for the CDR representative to use it in order to provide those goods or services.
Note 1: In order to provide goods or services in accordance with the CDR consumer's request, it might be necessary for the accredited person to request CDR data from more than 1 CDR participant.
Note 2: The CDR data may be collected and used only in accordance with the data minimisation principle: see rule 1.8.
 (3) If a CDR consumer has given a collection consent requested under subrule (2) in relation to CDR data, and whether or not the CDR data has yet been collected, the CDR representative may also ask the consumer to give a disclosure consent in relation to the CDR data.
Note 1: In order to provide goods or services in accordance with the CDR consumer's request, it might be necessary for the accredited person to request CDR data from more than 1 CDR participant.
Note 2: The CDR data may be collected and used only in accordance with the data minimisation principle: see rule 1.8.
 (4) In giving the consents, the CDR consumer gives the CDR principal a valid request to seek to collect that CDR data from the CDR participant.
Note: If an accredited person seeks to collect CDR data under this Part without a valid request, it will contravene privacy safeguard 3 (a civil penalty provision under the Act): see section 56EF of the Act.
 (5) The request ceases to be valid if the collection consent is withdrawn.
Note: So long as the use consent is not also withdrawn, the CDR principal could continue to disclose CDR data it had already collected to the CDR representative, and the CDR representative could use it in order to provide the requested goods or services. However, the notification requirement of rule 4.18A would apply.

4.3B Consumer data requests by accredited persons to CDR representatives