Document ID: chunk:federal_register_of_legislation:F2024C01258:clause:4_11:p16
Version: federal_register_of_legislation:F2024C01258
Segment Type: clause
Provision Reference: sch 4 cl 11 (pt 16/36)
Character Range: 285230–287915

disclosure of a CDR insight under an insight disclosure consent is not a permitted use or disclosure if the CDR insight includes or reveals sensitive information within the meaning of the Privacy Act 1988.
 (5) Despite paragraph 7.5(1)(e), disclosure of CDR data in accordance with a business consumer disclosure consent is not a permitted use or disclosure until earlier of the following:
 (a) if the Data Standards Chair makes data standards about the matters referred to in both of subparagraphs 8.11(1)(a)(iv) and subparagraph 8.11(1)(c)(vi) before 1 December 2023—the day on which the last of those standards is made;
 (b) 1 December 2023.

7.6  Use or disclosure of CDR data by accredited data recipients and related persons
 (1) Subject to the Act and these rules, an accredited data recipient that has collected CDR data under a consumer data request under Part 4 made on behalf of a CDR consumer must not use or disclose it, or CDR data directly or indirectly derived from it, other than for a permitted use or disclosure (whether or not one that relates to direct marketing).
Note: This subrule is a civil penalty provision (see rule 9.8).
 (2) For this rule:
 (a) any use or disclosure of service data by a direct or indirect OSP of:
 (i) an accredited data recipient; or
 (ii) a CDR representative of the accredited data recipient;
  is taken to have been by the accredited data recipient; and
 (b) it is irrelevant whether the use or disclosure is in accordance with the relevant CDR outsourcing arrangement.
Note: See rule 1.10AA for the definition of "service data" in relation to a direct or indirect OSP.
 (3) For this rule, any CDR data collected by an accredited person at the request of an affiliate is taken also to have been collected by the affiliate.
 (4) For this rule:
 (a) any use or disclosure of service data by a CDR representative is taken to have been by the CDR representative principal; and
 (b) it is irrelevant whether the use or disclosure is in accordance with the CDR representative arrangement.
Note: See rule 1.10AA for the definition of "service data" in relation to a CDR representative arrangement.
 (5) For this rule:
 (a) any collection of service data by a direct or indirect OSP of an accredited person is taken to have been by the accredited person; and
 (b) it is irrelevant whether the collection is in accordance with the relevant CDR outsourcing arrangement.
Note: See rule 1.10AA for the definition of "service data" in relation to a CDR outsourcing arrangement.

7.7  Rule relating to privacy safeguard 6—use or disclosure of CDR data by accredited data recipients
Note: Paragraph 56EI(1)(b) of the Act provides that an accredited