Document ID: chunk:federal_register_of_legislation:F2020L01688:clause:1_69:p1
Version: federal_register_of_legislation:F2020L01688
Segment Type: clause
Provision Reference: sch 1 cl 69 (pt 1/2)
Character Range: 71413–74223

69  Subrules 9.3(1) and (2)
Repeal the subrules, substitute:

Records to be kept and maintained—data holder
 (1) A data holder must keep and maintain records that record and explain the following:
 (a) authorisations given by CDR consumers to disclose CDR data;
 (b) amendments to or withdrawals of authorisations to disclose CDR data;
 (c) notifications of withdrawals of consents to collect CDR data;
 (d) disclosures of CDR data made in response to consumer data requests;
 (da) any written agreement of a kind referred to in subrule 2.4(5) the data holder has entered into;
  (e) instances where the data holder has refused to disclose requested CDR data and the rule or data standard relied upon to refuse to disclose the CDR data;
 (f) CDR complaint data;
 (g) the processes by which the data holder asks CDR consumers for their authorisation to disclose CDR data and for an amendment to their authorisation, including a video of each process.
  Civil penalty:
 (a) for an individual―$50,000; and
 (b) for a body corporate―$250,000.

Records to be kept and maintained—accredited data recipient
 (2) An accredited data recipient must keep and maintain records that record and explain the following:
 (a) all consents, including, if applicable, the uses of the CDR data that the CDR consumer has consented to under any use consents;
 (b) amendments to or withdrawals of consents by CDR consumers;
 (c) notifications of withdrawals of authorisations received from data holders;
 (d) CDR complaint data;
 (e) collections of CDR data under these rules;
 (ea) disclosures of CDR data to accredited persons under these rules, and the accredited persons to which any CDR data was disclosed;
 (f) elections to delete and withdrawals of those elections;
 (g) the use of CDR data by the accredited data recipient;
 (h) the processes by which the accredited data recipient asks CDR consumers for their consent and for an amendment to their consent, including a video of each process;
 (i) if applicable:
 (i) arrangements that may result in CDR data being collected by or disclosed to outsourced service providers, including copies of agreements with outsourced service providers; and
 (ii) the use and management of CDR data by those providers;
 (j) if CDR data was de-identified in accordance with a consent referred to in paragraph 4.11(3)(e):
 (i) how the data was de‑identified; and
 (ii) how the accredited data recipient used the de‑identified data; and
 (iii) if the accredited data recipient disclosed (by sale or otherwise) the de‑identified data to another person as referred to in paragraph 4.15(b):
 (A) to whom the data was so disclosed; and
 (B) why the data was so disclosed;
 (iv) if the use is for general research―records of any additional benefit to be provided to the CDR consumer for consenting