Competition and Consumer (Consumer Data Right) Rules 2020

made under section 56BA of the

Competition and Consumer Act 2010

Compilation No. 8

Compilation date: 22 July 2023

Includes amendments up to: F2023L01027

Registered: 18 August 2023

About this compilation

This compilation

This is a compilation of the Competition and Consumer (Consumer Data Right) Rules 2020 that shows the text of the law as amended and in force on 22 July 2023 (the compilation date).

The notes at the end of this compilation (the endnotes) include information about amending laws and the amendment history of provisions of the compiled law.

Uncommenced amendments

The effect of uncommenced amendments is not shown in the text of the compiled law. Any uncommenced amendments affecting the law are accessible on the Register (www.legislation.gov.au). The details of amendments made up to, but not commenced at, the compilation date are underlined in the endnotes. For more information on any uncommenced amendments, see the Register for the compiled law.

Application, saving and transitional provisions for provisions and amendments

If the operation of a provision or amendment of the compiled law is affected by an application, saving or transitional provision that is not included in this compilation, details are included in the endnotes.

Editorial changes

For more information about any editorial changes made in this compilation, see the endnotes.

Modifications

If the compiled law is modified by another law, the compiled law operates as modified but the modification does not amend the text of the law. Accordingly, this compilation does not show the text of the compiled law as modified. For more information on any modifications, see the Register for the compiled law.

Self‑repealing provisions

If a provision of the compiled law has been repealed in accordance with a provision of the law, details are included in the endnotes.

Contents

Part 1—Preliminary

Division 1.1—Preliminary

1.1 Name

1.3 Authority

Division 1.2—Simplified outline and overview of these rules

1.4 Simplified outline of these rules

1.5 What these rules are about

1.6 Overview of these rules

Division 1.3—Interpretation

1.7 Definitions

1.8 Data minimisation principle

1.9 Fit and proper person criteria

1.10 Meaning of direct OSP, indirect OSP and related terms

1.10AA Meaning of CDR representative and related terms

1.10A Types of consents

1.10B Meaning of eligible

1.10C Trusted advisers

1.10D Meaning of sponsorship arrangement, sponsor and affiliate

Division 1.4—General provisions relating to data holders and to accredited persons

Subdivision 1.4.1—Preliminary

1.11 Simplified outline of Division

Subdivision 1.4.2—Services for making requests under these rules

1.12 Product data request service

1.13 Consumer data request service

Subdivision 1.4.3—Services for managing consumer data requests made by accredited persons

1.14 Consumer dashboard—accredited person

1.15 Consumer dashboard—data holder

Subdivision 1.4.4—Other obligations of accredited persons

1.16 Obligations relating to outsourcing arrangements

1.16A Obligations relating to CDR representative arrangements

Subdivision 1.4.5—Deletion and de‑identification of CDR data

1.17 CDR data de‑identification process

1.17A Identification of otherwise redundant data that is not to be deleted

1.18 CDR data deletion process

Division 1.5—Application of rules in relation to SR data

1.19 Eligible CDR consumers in relation to secondary data holders

1.20 Consumer data request service—primary data holders and secondary data holders

1.21 Consumer dashboard—SR data request

1.22 SR data request by a CDR consumer

1.23 SR data request by an accredited person

1.24 SR data disclosed to primary data holder not to be used for other purposes

1.25 Dealing with unsolicited SR data

1.26 Dispute resolution—primary data holders and secondary data holders

Part 2—Product data requests

2.1 Simplified outline of this Part

2.2 Making product data requests—flowchart

2.3 Product data requests

2.4 Disclosing product data in response to product data request

2.5 Refusal to disclose required product data in response to product data request

2.6 Use of data disclosed pursuant to product data request

Part 3—Consumer data requests made by eligible CDR consumers

Division 3.1—Preliminary

3.1 Simplified outline of this Part

3.2 How an eligible CDR consumer makes a consumer data request—flowchart

Division 3.2—Consumer data requests made by CDR consumers

3.3 Consumer data requests made by CDR consumers

3.4 Disclosing consumer data in response to a valid consumer data request

3.5 Refusal to disclose required consumer data in response to consumer data request

Part 4—Consumer data requests made by accredited persons

Division 4.1—Preliminary

4.1 Simplified outline of this Part

Division 4.2—Consumer data requests made by accredited persons to CDR participants

Subdivision 4.2.1—Preliminary

4.2 Consumer data requests made by accredited persons to CDR participants—flowchart

Subdivision 4.2.2—Requests to seek to collect CDR data from CDR participants

4.3 Request for accredited person to seek to collect CDR data

4.3A Request for CDR representative principal to seek to collect CDR data on behalf of CDR representative

4.3B Consumer data requests by accredited persons to CDR representatives

Subdivision 4.2.3—Consumer data requests by accredited persons to data holders

4.4 Consumer data request by accredited person to data holder

4.5 Data holder must ask eligible CDR consumer to authorise disclosure

4.6 Disclosing consumer data in response to a consumer data request

4.6A Disclosure of CDR data relating to account not permitted if not approved by account holder

4.7 Refusal to disclose required consumer data in response to consumer data request

Subdivision 4.2.4—Consumer data requests by accredited persons to accredited data recipients

4.7A Consumer data request by accredited person to accredited data recipient

4.7B Accredited data recipient may ask eligible CDR consumer for AP disclosure consent

Division 4.3—Giving and amending consents—accredited persons

Subdivision 4.3.1—Preliminary

4.8 Purpose of Division

4.9 Object

Subdivision 4.3.2—Giving consents

4.10 Requirements relating to accredited person’s processes for seeking consent

4.11 Asking CDR consumer to give consent

4.12 Restrictions on seeking consent

Subdivision 4.3.2A—Amending consents

4.12A Amendment of consent

4.12B Inviting CDR consumer to amend consent

4.12C Process for amending consents

Subdivision 4.3.2B—Withdrawing consents

4.13 Withdrawal of consents

Subdivision 4.3.2C—Duration of consent

4.14 Duration of consent

Subdivision 4.3.3—Information relating to de‑identification of CDR data

4.15 Additional information relating to de‑identification of CDR data

Subdivision 4.3.4—Election to delete redundant data

4.16 Election to delete redundant data

4.17 Information relating to redundant data

Subdivision 4.3.5—Notification requirements

4.18 CDR receipts

4.18AA Notification of data holder or accredited data recipient if collection consent expires

4.18A Notification of CDR consumer if collection consent expires

4.18B Notification if collection consent or AP disclosure consent expires

4.18C Notification of data holder or accredited data recipient if collection consent is amended

4.19 Updating consumer dashboard

4.20 Ongoing notification requirement—collection consents and use consents

4.20A Application of Subdivision to sponsor and affiliate

Division 4.3A—Giving and amending consents—CDR representatives

Subdivision 4.3A.1—Preliminary

4.20B Purpose of Division

4.20C Object

Subdivision 4.3A.2—Giving consents

4.20D Requirements relating to CDR representative’s processes for seeking consent

4.20E Asking CDR consumer to give consent

4.20F Restrictions on seeking consent

Subdivision 4.3A.3—Amending consents

4.20G Amendment of consent

4.20H Inviting CDR consumer to amend consent

4.20I Process for amending consent

Subdivision 4.3A.4—Withdrawing consents

4.20J Withdrawal of consents

Subdivision 4.3A.5—Duration of consent

4.20K Duration of consent

Subdivision 4.3A.6—Information relating to de‑identification of CDR data

4.20L Additional information relating to de‑identification of CDR data

Subdivision 4.3A.7—Election to delete redundant data

4.20M Election to delete redundant data

4.20N Information relating to redundant data

Subdivision 4.3A.8—Notification requirements

4.20O CDR receipts

4.20P Notification of data holder or accredited data recipient if collection consent expires

4.20Q Notification of consumer if collection consent expires

4.20R Notification if collection consent or AP disclosure consent expires

4.20S Notification if collection consent is amended

4.20T Updating consumer dashboard

4.20U Ongoing notification requirement—collection consents and use consents

Division 4.4—Authorisations to disclose CDR data

4.21 Purpose of Division

4.22 Requirements relating to data holder’s processes for seeking authorisation

4.22A Inviting CDR consumer to amend a current authorisation

4.23 Asking CDR consumer to give authorisation to disclose CDR data or inviting CDR consumer to amend a current authorisation

4.24 Restrictions when asking CDR consumer to authorise disclosure of CDR data

4.25 Withdrawal of authorisation to disclose CDR data

4.26 Duration of authorisation to disclose CDR data

4.26A Notifications of expired authorisations

4.27 Updating consumer dashboard

4.28 Notification requirements for consumer data requests on behalf of secondary users

Part 4A—Joint accounts

Division 4A.1—Preliminary

4A.1 Purpose of Part

4A.2 Simplified outline of this Part

4A.3 Interpretation

Division 4A.2—Disclosure options

4A.4 Simplified outline of this Division

4A.5 Disclosure options for joint accounts

4A.6 Obligation to provide disclosure option management service

4A.7 Changing to a more restrictive disclosure option

4A.8 Obtaining agreement on change to a less restrictive disclosure option

Division 4A.3—Consumer data requests that relate to joint accounts

Subdivision 4A.3.1—Preliminary

4A.9 Application of Division

Subdivision 4A.3.2—How consumer data requests to data holders under Part 4 that relate to joint accounts are handled

4A.10 How data holder is to deal with a consumer data request

4A.11 Asking relevant account holders for approval to disclose joint account data

4A.12 Continuation and removal of approvals

4A.13 Consumer dashboard for joint account holders

4A.14 Notification requirements for consumer data requests on joint accounts

4A.15 Avoidance of harm

Part 5—Rules relating to accreditation etc.

Division 5.1—Preliminary

5.1 Simplified outline of this Part

Division 5.2—Rules relating to accreditation process

Subdivision 5.2.1A—Levels of accreditation

5.1A Levels of accreditation

5.1B Sponsored accreditation

Subdivision 5.2.1—Applying to be accredited person

5.2 Applying to be an accredited person

Subdivision 5.2.2—Consideration of application to be accredited person

5.3 Data Recipient Accreditor may request further information

5.4 Data Recipient Accreditor may consult

5.5 Criteria for accreditation

5.6 Accreditation decision―accreditation number

5.7 Accreditation decision—notifying accreditation applicant

5.8 When accreditation takes effect

5.9 Default conditions on accreditation

5.10 Other conditions on accreditation

5.11 Notification to accredited person relating to conditions

Subdivision 5.2.3—Obligations of accredited person

5.12 Obligations of accredited person

5.13 Accredited person must comply with conditions

5.14 Notification requirements

5.15 Provision of information to the Accreditation Registrar

Subdivision 5.2.4—Transfer, suspension, surrender and revocation of accreditation

5.16 Transfer of accreditation

5.17 Revocation, suspension, or surrender of accreditation

5.18 Revocation of accreditation—process

5.19 Suspension of accreditation—duration

5.20 General process for suspension of accreditation or extension of suspension

5.21 Process for urgent suspensions or extensions

5.22 When surrender, revocation or suspension takes effect

5.23 Consequences of surrender, suspension or revocation of accreditation

Division 5.3—Rules relating to Register of Accredited Persons

5.24 Maintaining the Register of Accredited Persons

5.25 Other information to be kept in association with Register of Accredited Persons

5.26 Amendment and correction of entries in Register of Accredited Persons and database

5.27 Publication or availability of specified information in the Register of Accredited Persons

5.28 Making information available to the Commission, the Information Commissioner and the Data Recipient Accreditor

5.29 Publication of specified information by the Commission

5.30 Other functions of Accreditation Registrar

5.31 Obligation to comply with Accreditation Registrar’s request

5.32 Automated decision‑making—Accreditation Registrar

5.33 Temporary restriction on use of the Register in relation to data holder

5.34 Temporary direction to refrain from processing consumer data requests

Part 6—Rules relating to dispute resolution

6.1 Requirement for data holders―internal dispute resolution

6.2 Requirement for data holders―external dispute resolution

Part 7—Rules relating to privacy safeguards

Division 7.1—Preliminary

7.1 Simplified outline of this Part

Division 7.2—Rules relating to privacy safeguards

Subdivision 7.2.1—Rules relating to consideration of CDR data privacy

7.2 Rule relating to privacy safeguard 1—open and transparent management of CDR data

7.3 Rule relating to privacy safeguard 2—anonymity and pseudonymity

7.3A Rule relating to privacy safeguard 4—destruction of unsolicited data—CDR representative

7.3B Rule relating to privacy safeguard 4—destruction of unsolicited data—outsourced service providers

Subdivision 7.2.2—Rules relating to collecting CDR data

7.4 Rule relating to privacy safeguard 5—notifying of the collection of CDR data

Subdivision 7.2.3—Rules relating to dealing with CDR data

7.5 Meaning of permitted use or disclosure and relates to direct marketing

7.5A Limitation to disclosures of CDR data under a disclosure consent

7.6 Use or disclosure of CDR data by accredited data recipients and related persons

7.7 Rule relating to privacy safeguard 6—use or disclosure of CDR data by accredited data recipients

7.8 Rule relating to privacy safeguard 7—use or disclosure of CDR data for direct marketing by accredited data recipients

7.8A Rule relating to privacy safeguards 8 and 9—failure by CDR representative to comply with safeguards

7.8B Rule relating to privacy safeguards 8 and 9—failure by direct or indirect OSP to comply with safeguards

7.9 Rule relating to privacy safeguard 10—notifying of the disclosure of CDR data

Subdivision 7.2.4—Rules relating to integrity and security of CDR data

7.10 Rule relating to privacy safeguard 11—quality of CDR data

7.10A Rule relating to privacy safeguard 11—quality of data—CDR representative

7.11 Rule relating to privacy safeguard 12—security of CDR data

7.12 Rule relating to privacy safeguard 12—de‑identification of redundant data

7.13 Rule relating to privacy safeguard 12—deletion of redundant data

Subdivision 7.2.5—Rules relating to correction of CDR data

7.14 No fee for responding to or actioning correction request

7.15 Rule relating to privacy safeguard 13—steps to be taken when responding to correction request

7.16 Rule relating to privacy safeguard 13—correction of data—CDR representative

Part 8—Rules relating to data standards

Division 8.1—Preliminary

8.1 Simplified outline of this Part

Division 8.2—Data Standards Advisory Committees

8.2 Establishment of Data Standards Advisory Committee

8.3 Functions of Data Standards Advisory Committee

8.4 Appointment to Data Standards Advisory Committee

8.5 Termination of appointment and resignation

8.6 Procedural directions

8.7 Observers

Division 8.3—Reviewing, developing and amending data standards

8.8 Notification when developing or amending data standards

8.9 Consultation when developing or amending data standards

8.10 Matters to have regard to when making or amending data standards

Division 8.4—Data standards that must be made

8.11 Data standards that must be made

Part 9—Other matters

Division 9.1—Preliminary

9.1 Simplified outline of this Part

Division 9.2—Review of decisions

9.2 Review of decisions by the Administrative Appeals Tribunal

Division 9.3—Reporting, record keeping and audit

Subdivision 9.3.1—Reporting and record keeping

9.3 Records to be kept and maintained

9.4 Reporting requirements

9.5 Requests from CDR consumers for copies of records

Subdivision 9.3.2—Audits

9.6 Audits by the Commission and the Information Commissioner

9.7 Audits by the Data Recipient Accreditor

Division 9.4—Civil penalty provisions

9.8 Civil penalty provisions

Schedule 1—Default conditions on accreditations

Part 1—Preliminary

1.1 Purpose of Schedule

Part 2—Default conditions on accreditations

2.1 Ongoing reporting obligation on accredited persons without streamlined accreditation

2.2 Conditions on sponsors and potential sponsors

Schedule 2—Steps for privacy safeguard 12—security of CDR data held by accredited data recipients

Part 1—Steps for privacy safeguard 12

1.1 Purpose of Part

1.2 Interpretation

1.3 Step 1—Define and implement security governance in relation to CDR data

1.4 Step 2—Define the boundaries of the CDR data environment

1.5 Step 3—Have and maintain an information security capability

1.6 Step 4—Implement a formal controls assessment program

1.7 Step 5—Manage and report security incidents

Part 2—Minimum information security controls

2.1 Purpose of Part

2.2 Information security controls

Schedule 3—Provisions relevant to the banking sector

Part 1—Preliminary

1.1 Simplified outline of this Schedule

1.2 Interpretation

1.3 Meaning of customer data, account data, transaction data and product specific data

1.4 Meaning of phase 1 product, phase 2 product and phase 3 product

1.5 Meaning of trial product

Part 2—Eligible CDR consumers—banking sector

2.1 Additional criteria for eligibility—banking sector

2.2 Meaning of account privileges—banking sector

2.3 Consumer dashboard—application of rule 1.15

Part 3—CDR data that may be accessed under these rules—banking sector

3.1A Application of Part

3.1 Meaning of required product data and voluntary product data—banking sector

3.2 Meaning of required consumer data and voluntary consumer data—banking sector

Part 5—Dispute resolution―banking sector

5.1 Meeting internal dispute resolution requirements―banking sector

5.2 Meeting external dispute resolution requirements―banking sector

Part 6—Staged application of these rules to the banking sector

Division 6.1—Preliminary

6.1 Interpretation

6.2 Meaning of initial data holder, accredited ADI, any other relevant ADI and accredited non‑ADI

Division 6.2—Staged application of rules

6.4 Staged application of rules―requirement to disclose CDR data

6.5 Authorisation to disclose CDR data before required to do so

6.6 Commencement table

6.7 Application of certain rules

Part 7—Other rules, and modifications of these rules, for the banking sector

7.1 Laws relevant to the management of CDR data—banking sector

7.2 Conditions for accredited person to be data holder

7.3 Streamlined accreditation—banking sector

7.4 Exemptions to accreditation criteria—banking sector

7.5 Grounds for revocation, suspension and surrender of accreditation—banking sector

Schedule 4—Provisions relevant to the energy sector

Part 1—Preliminary

1.1 Simplified outline of this Schedule

1.2 Interpretation

1.3 Meaning of terms for types of data

1.4 Meaning of retailer

Part 2—Eligible CDR consumers—energy sector

2.1 Additional criteria for eligibility—energy sector

2.2 Meaning of account privileges—energy sector

2.3 Consumer dashboard—application of rule 1.15

Part 3—CDR data that may be accessed under these rules—energy sector

3.1 Meaning of required product data and voluntary product data—energy sector

3.2 Meaning of required consumer data and voluntary consumer data—energy sector

Part 4—Roles of AEMO and the energy sector agencies

4.1 AER and the Victorian agency may act on each other’s behalf

4.2 Product data request service

4.3 Meaning of SR data and primary data holder—energy sector

4.4 SR data must be obtained from AEMO

4.5 Civil penalties do not apply

Part 5—Dispute resolution―energy sector

5.1 Meeting internal dispute resolution requirements—energy sector

5.2 Meeting external dispute resolution requirements—energy sector

Part 6—Privacy safeguards―energy sector

6.1 Responding to correction request (rule 7.15)

Part 7—Reporting and record keeping―energy sector

7.1 Reporting requirements (rule 9.4)

Part 8—Staged application of these rules to the energy sector

8.1 Interpretation

8.2 Meaning of initial retailer

8.3 Meaning of larger retailer

8.4 Product data requests under Part 2 of these rules

8.5 Consumer data requests under Part 3 of these rules

8.6 Consumer data requests under Part 4 of these rules

8.7 Authorisation to disclose CDR data before being required to do so

Part 9—Other rules, and modifications of these rules, for the energy sector

9.1 Laws relevant to the management of CDR data—energy sector

9.2 Conditions for accredited person to be data holder

9.3 Consultation by Data Recipient Accreditor (rule 5.4)

9.4 AEMO not to appear on Registrar’s database (rule 5.25)

9.5 Grounds for revocation, suspension and surrender of accreditation—energy sector

Endnotes

Endnote 1—About the endnotes

Endnote 2—Abbreviation key

Endnote 3—Legislation history

Endnote 4—Amendment history

Endnote 5—Editorial changes

Part 1—Preliminary

Division 1.1—Preliminary

1.1  Name

  This instrument is the Competition and Consumer (Consumer Data Right) Rules 2020.

1.3  Authority

  This instrument is made under section 56BA of the Competition and Consumer Act 2010.

Division 1.2—Simplified outline and overview of these rules

1.4  Simplified outline of these rules

1.5  What these rules are about

 (1) These rules set out details of how the consumer data right works.

 (2) These rules should be read in conjunction with the following:

 (a) the Competition and Consumer Act 2010 (the Act), and in particular, Part IVD of the Act, which sets out the general framework for how the consumer data right works;

 (b) designation instruments made under section 56AC of the Act;

 (c) guidelines made by the Information Commissioner under section 56EQ of the Act;

 (d) data standards made under section 56FA of the Act;

 (e) regulations made under section 172 of the Act.

1.6  Overview of these rules

Note: These rules cover a number of different sectors of the economy.  It is intended that they will be amended from time to time in the future to deal with additional sectors.

 (1) Part 1 of these rules deals with preliminary matters, such as:

 (a) definitions of terms that are used in these rules; and

 (b) the usage, in these rules, of certain terms that are defined in the Act.

  The other provisions of these rules should be read together with these definitions and other interpretive provisions. Part 1 also deals with services that must be provided by data holders and accredited persons that allow consumers to make and manage requests for CDR data.

 (2) Part 2 of these rules deals with product data requests, and should be read in conjunction with the relevant sector Schedule.

 (3) Part 3 of these rules deals with consumer data requests that are made by CDR consumers, and should be read in conjunction with the relevant sector Schedule. Only CDR consumers who are eligible to do so may make such requests. The eligibility criteria for each sector are set out in the relevant sector Schedule.

 (4) Part 4 of these rules deals with consumer data requests that involve accredited persons, and should be read in conjunction with the relevant sector Schedule.

 (5) Part 5 of these rules deals with how persons can become accredited persons. It also deals with ancillary matters, such as revocation and suspension of accreditation, obligations of accredited persons, and the Register of Accredited Persons. The rules set out in this Part should be read in conjunction with Division 3 of Part IVD of the Act.

 (6) Part 6 of these rules deals with dispute resolution.

 (7) Part 7 of these rules deals with rules relating to the privacy safeguards. The rules set out in this Part should be read in conjunction with Division 5 of Part IVD of the Act. Part 7 also sets out some additional civil penalty provisions that protect the privacy or confidentiality of CDR consumers’ CDR data.

 (8) Part 8 of these rules deals with data standards. The rules set out in this Part should be read in conjunction with Division 6 of Part IVD of the Act.

 (9) Part 9 of these rules deals with miscellaneous matters, such as review of decisions, reporting, record keeping and audit, and civil penalty provisions of the consumer data rules.

 (10) Schedule 1 to these rules deals with default conditions on accreditations.

 (11) Schedule 2 to these rules sets out detailed steps for privacy safeguard 12 (subsection 56EO(1) of the Act and rule 7.11 of these rules). These steps are also relevant to persons who hold CDR data (service data) under a CDR outsourcing arrangement, and are an element of the ongoing obligations of accredited persons (see paragraph 5.12(1)(a)).

 (12) Schedule 3 to these rules contains details that are relevant to the banking sector. Schedule 3:

 (a) sets out the specific CDR data in respect of which requests under these rules may be made; and

 (b) sets out the circumstances in which CDR consumers are eligible in relation to requests for banking sector CDR data that relates to themselves; and

 (c) deals with the progressive application of these rules to the banking sector.

 (13) Schedule 4 to these rules contains details that are relevant to the energy sector. Schedule 4:

 (a) sets out the specific CDR data in respect of which requests under these rules may be made; and

 (b) sets out the circumstances in which CDR consumers are eligible in relation to requests for energy sector CDR data that relates to themselves; and

 (c) sets out some modifications of the general rules that apply in the energy sector because certain types of data are collected or held by agencies specified in its designation instrument rather than the retailers with which the CDR consumers have accounts; and

 (d) deals with the progressive application of these rules to the energy sector.

Division 1.3—Interpretation

1.7  Definitions

Note 1: A number of expressions used in this instrument are defined in the Act, including the following:

 Accreditation Registrar;

 accredited data recipient;

 accredited person;

 Australian Consumer Law;

 Australian Energy Regulator;

 binding data standard;

 CDR consumer;

 CDR data;

 CDR participant;

 collects;

 Commission;

 court/tribunal order;

 data holder;

 Data Recipient Accreditor;

 data standard;

 Data Standards Body;

 Data Standards Chair;

 designated sector;

 directly or indirectly derived;

 privacy safeguards;

 Regulatory Powers Act.

Note 2: Information Commissioner has the same meaning as in the Act: see section 3A of the Australian Information Commissioner Act 2010 and paragraph 13(1)(b) of the Legislation Act 2003.

 (1) In this instrument:

ABN has the meaning given by the A New Tax System (Australian Business Number) Act 1999.

account privileges, in relation to:

 (a) an account with a data holder; and

 (b) a particular designated sector;

  has the meaning set out in a Schedule to these rules that relates to that sector.

accreditation applicant means a person who has applied to be an accredited person under rule 5.2.

accreditation number of an accredited person has the meaning given by rule 5.6.

accredited data recipient has a meaning affected by subrule (2).

Note: The term “accredited data recipient” is defined in the Act: see section 56AK of the Act. Subrule (2) deals with the usage of this term in these rules.

accredited person request service has the meaning given by subrule 1.13(3).

Act means the Competition and Consumer Act 2010.

addresses for service means both of the following:

 (a) a physical address for service in Australia;

 (b) an electronic address for service.

ADI (short for authorised deposit‑taking institution) has the meaning given by the Banking Act 1959.

affiliate has the meaning given by rule 1.10D.

AP disclosure consent has the meaning given by rule 1.10A.

associated person, of another person, means any of the following:

 (a) a person who:

 (i) makes or participates in making, or would (if the other person were an accredited person) make or participate in making, decisions that affect the management of CDR data by the other person; or

 (ii) has, or would have (if the other person were an accredited person), the capacity to significantly affect the other person’s management of CDR data;

 (b) if the other person is a body corporate—a person who:

 (i) is an associate (within the meaning of the Corporations Act 2001) of the other person; or

 (ii) is an associated entity (within the meaning of the Corporations Act 2001) of the other person.

authorisation to disclose CDR data means:

 (a) an authorisation given by a CDR consumer under Part 4 to a data holder; or

 (b) such an authorisation as amended in accordance with these rules.

business consumer disclosure consent has the meaning given by rule 1.10A.

business consumer statement has the meaning given by rule 1.10A.

category, of consents, has the meaning given by rule 1.10A.

CDR business consumer has the meaning given by rule 1.10A.

CDR complaint data, in relation to a CDR participant, means the following:

 (a) the number of CDR consumer complaints received by the CDR participant;

 (b) the number of such complaints for each complaint type into which the CDR participant categorises complaints in accordance with its complaints handling process;

 (c) the number of such complaints resolved;

 (d) the average number of days taken to resolve CDR consumer complaints through internal dispute resolution;

 (e) the number of CDR consumer complaints referred to a recognised external dispute resolution scheme;

 (f) the number of CDR consumer complaints resolved by external dispute resolution;

 (g) in relation to a CDR participant that is a data holder―the number of CDR product data complaints received.

Note:  Complaints covered by paragraph (g) are not “CDR consumer complaints”.

CDR consumer has a meaning affected by subrule (2).

Note: The term “CDR consumer” is defined in the Act: see subsection 56AI(3) of the Act. Subrule (2) deals with the usage of this term in these rules.

CDR consumer complaint means any expression of dissatisfaction made by a CDR consumer to or about a CDR participant, or a CDR representative of a CDR participant:

 (a) that relates to:

 (i) that person’s obligations under or compliance with:

 (A) Part IVD of the Act; or

 (B) these rules; or

 (C) binding data standards; or

 (ii) the provision to the CDR consumer, by that person, of the goods or services in respect of which the consumer granted consent under Part 4; and

 (b) for which a response or resolution could reasonably be expected.

Note: Complaints of a kind referred to in sub‑subparagraph (a)(i)(B) include a complaint relating to the participant’s obligations under, or compliance with, rules dealing with the handling of CDR consumer complaints.

CDR data de‑identification process has the meaning given by rule 1.17.

CDR data deletion process has the meaning given by rule 1.18.

CDR insight, in relation to an insight disclosure consent, means the CDR data subject to the consent.

CDR logo means a logo or symbol, including one whose use requires a licence or authorisation from a person other than the Commonwealth, approved by the Commission for the purposes of this definition.

CDR outsourcing arrangement has the meaning given by rule 1.10.

CDR participant has a meaning affected by subrule (2).

Note: The term “CDR participant” is defined in the Act: see subsection 56AL(1) of the Act. Subrule (2) deals with the usage of this term in these rules.

CDR policy means a policy that a CDR participant has and maintains in compliance with subsection 56ED(3) of the Act.

CDR product data complaint means an expression of dissatisfaction made to a data holder about its required product data or its voluntary product data for which a response or resolution could reasonably be expected.

CDR representative has the meaning given by rule 1.10AA.

CDR representative arrangement has the meaning given by rule 1.10AA.

CDR representative principal has the meaning given by rule 1.10AA.

co‑approval option has the meaning given by rule 4A.5.

collection consent has the meaning given by rule 1.10A.

consent means:

 (a) a collection consent, a use consent or a disclosure consent; or

 (b) such a consent as amended in accordance with these rules.

consumer dashboard:

 (a) in relation to an accredited person—has the meaning given by rule 1.14; and

 (b) in relation to a data holder—has the meaning given by rules 1.15 and 4A.13.

consumer data request:

 (a) by a CDR consumer—has the meaning given by rule 3.3; and

 (b) by an accredited person on behalf of a CDR consumer—has the meaning given by rule 4.4 or rule 4.7A.

Note: The different types of consumer data request are summarised in the following table:

current:

 (a) a consent is current if it has not expired in accordance with rule 4.14 or 4.20K; and

 (b) an authorisation to disclose particular CDR data is current if it has not expired in accordance with rule 4.26.

Note: For paragraph (a), there are the following 3 kinds of consent:

 collection consents;

 use consents;

 disclosure consents.

data holder has a meaning affected by subrule (2).

Note: The term “data holder” is defined in the Act: see subsection 56AJ of the Act. Subrule (2) deals with the usage of this term in these rules.

data minimisation principle has the meaning given by rule 1.8.

Data Standards Advisory Committee has the meaning given by rule 8.2.

de‑identification consent has the meaning given by rule 1.10A.

direct marketing consent has the meaning given by rule 1.10A.

direct or indirect OSP means a direct OSP or an indirect OSP.

direct OSP has the meaning given by rule 1.10.

direct request service has the meaning given by subrule 1.13(2).

disclosure consent has the meaning given by rule 1.10A.

disclosure option has the meaning given by rule 4A.5.

disclosure option management service has the meaning given by rule 4A.6.

eligible, in relation to a particular designated sector, has the meaning given by rule 1.10B.

Note: See also:

 for the banking sector—clause 2.1 of Schedule 3; and

 for the energy sector—clause 2.1 of Schedule 4.

fit and proper person criteria has the meaning given by rule 1.9.

foreign entity means a person who:

 (a) is not a body corporate established by or under a law of the Commonwealth, of a State or of a Territory; and

 (b) is neither an Australian citizen, nor a permanent resident (within the meaning of the Australian Citizenship Act 2007).

Note: See subsection 56CA(2) of the Act.

general research, in relation to an accredited data recipient, means research by the accredited data recipient:

 (a) using CDR data that has been de‑identified in accordance with the CDR data de‑identification process; and

 (b) that does not relate to the provision of goods or services to any particular CDR consumer.

goods includes products.

indirect OSP has the meaning given by rule 1.10.

insight disclosure consent has the meaning given by rule 1.10A.

joint account:

 (a) means a joint account with a data holder for which there are 2 or more joint account holders, each of which is an individual who:

 (i) so far as the data holder is aware, is acting in their own capacity and not on behalf of another person; and

 (ii) is eligible in relation to the data holder; but

 (b) does not include a partnership account with a data holder.

law relevant to the management of CDR data means any of the following:

 (a) the Act;

 (b) any regulation made for the purposes of the Act;

 (c) these rules;

 (d) the Corporations Act 2001 and the Corporations Regulations 2001;

 (e) the Privacy Act 1988;

 (f) in relation to a particular designated sector—any law that is specified for the purposes of this paragraph in a sector Schedule.

Note: In relation to paragraph (f):

 for the banking sector, see clause 7.1 of Schedule 3; and

 for the energy sector, see clause 9.1 of Schedule 4.

level, in relation to accreditation, has the meaning given by rule 5.1A.

local agent, in relation to a foreign entity, means a person who:

 (a) is appointed by the foreign entity; and

 (b) has addresses for service; and

 (c) is authorised to accept service of documents on behalf of the foreign entity.

meet the external dispute resolution requirements, for a particular designated sector, has the meaning set out in the relevant sector Schedule.

Note: For the meaning of the term:

 in the banking sector, see clause 5.2 of Schedule 3; and

 in the energy sector, see clause 5.2 of Schedule 4.

meet the internal dispute resolution requirements, for a particular designated sector, has the meaning set out in the relevant sector Schedule.

Note: For the meaning of the term:

 in the banking sector, see clause 5.1 of Schedule 3; and

 in the energy sector, see clause 5.1 of Schedule 4.

nominated representative has the meaning given by subparagraph 1.13(1)(c)(i) or subparagraph 1.13(1)(d)(i), as appropriate.

non‑disclosure option has the meaning given by rule 4A.5.

ordinary means of contacting an account holder by a data holder means:

 (a) if the data holder has agreed with the account holder on a particular means of contacting the account holder for the purposes of the relevant provision—that means; and

 (b) otherwise—the default means by which the data holder contacts the account holder in relation to the account.

OSP chain principal has the meaning given by rule 1.10.

partnership account, with a data holder, means an account with a data holder that is held by or on behalf of a partnership or the partners in a partnership.

permitted use or disclosure has the meaning given by rule 7.5.

pre‑approval option has the meaning given by rule 4A.5.

primary data holder, in relation to SR data and a particular designated sector, means the data holder specified in the sector Schedule as the primary data holder for the SR data.

product data request has the meaning given by rule 2.3.

product data request service has the meaning given by rule 1.12.

recognised external dispute resolution scheme means a dispute resolution scheme that is recognised under section 56DA of the Act.

redundant data has the meaning given by paragraph 56EO(2)(a) of the Act.

Register of Accredited Persons means the Register of Accredited Persons established under subsection 56CE(1) of the Act.

relates to direct marketing has the meaning given by rule 7.5.

requester, in relation to a product data request, means the person who made the request under rule 2.3.

required consumer data, in relation to a particular designated sector, has the meaning set out in the relevant sector Schedule.

Note: For the meaning of the term:

 in the banking sector, see clause 3.2 of Schedule 3; and

 in the energy sector, see clause 3.2 of Schedule 4.

required product data, in relation to a particular designated sector, has the meaning set out in the relevant sector Schedule.

Note: For the meaning of the term:

 in the banking sector, see clause 3.1 of Schedule 3; and

 in the energy sector, see clause 3.1 of Schedule 4.

restricted ADI means an ADI that has an authority under section 9 of the Banking Act 1959 to carry on a banking business in Australia for a limited time specified in accordance with section 9D of that Act.

secondary data holder, in relation to SR data and a particular designated sector, means the data holder specified in the sector Schedule as the secondary data holder for the SR data.

secondary user: a person is a secondary user for an account with a data holder in a particular designated sector if:

 (a) the person is an individual who is 18 years of age or older; and

 (b) the person has account privileges in relation to the account; and

 (c) the account holder or account holders:

 (i) are individuals each of whom is 18 years or older; and

 (ii) in accordance with the requirements for the account, have given the data holder an instruction to treat the person as a secondary user for the purposes of these rules.

secondary user instruction means an instruction given for the purposes of paragraph (c) of the definition of secondary user.

sector Schedule means a Schedule to these rules that deals with a particular designated sector.

service data:

 (a) in relation to a CDR outsourcing arrangement—has the meaning given by rule 1.10; and

 (b) in relation to a CDR representative arrangement— has the meaning given by rule 1.10AA.

sponsor has the meaning given by rule 1.10D.

sponsored accreditation means accreditation at the sponsored level mentioned in rule 5.1A.

Note: See also rules 1.10D and 5.1B.

sponsorship arrangement has the meaning given by rule 1.10D.

SR data (for shared responsibility data), in relation to a CDR consumer and a particular designated sector, has the meaning set out in the relevant sector Schedule.

Note: Where CDR data for which there is a CDR consumer in a designated sector is held by one data holder, but it would be more practical for consumer data requests for the data to be directed to, and actioned by, a different data holder with which the CDR consumer has a relationship, such CDR data may be specified as SR data in the sector Schedule.  Parts 3 and 4 then apply with the modifications set out in Division 1.5.

SR data request (for shared responsibility data request) means a consumer data request for CDR data that is, or that includes, SR data of the CDR consumer.

TA disclosure consent has the meaning given by rule 1.10A.

trial product, in relation to a particular designated sector, has the meaning set out in the relevant sector Schedule.

trusted adviser has the meaning given by rule 1.10C.

type of CDR data means a type of data that is identified in the data standards.

Note: See paragraph 8.11(1)(d).

unrestricted accreditation means accreditation at the unrestricted level mentioned in rule 5.1A.

use consent has the meaning given by rule 1.10A.

valid has the meaning given by subrule 3.3(3) or subrule 4.3(3) as appropriate.

voluntary consumer data, in relation to a particular designated sector, has the meaning set out in the relevant sector Schedule.

Note: For the meaning of the term:

 in the banking sector, see clause 3.2 of Schedule 3; and

 in the energy sector, see clause 3.2 of Schedule 4.

voluntary product data, in relation to a particular designated sector, has the meaning set out in the relevant sector Schedule.

Note: For the meaning of the term:

 in the banking sector, see clause 3.1 of Schedule 3; and

 in the energy sector, see clause 3.1 of Schedule 4.

 (2) The table has effect:

References to data holder

 (3) In these rules, depending on the context, a reference to a data holder is a reference to a data holder that would be required or that is authorised to disclose CDR data in response to a product data request or a consumer data request that is made in accordance with these rules.

Note: These rules will progressively apply to a broader range of data holders:

 for the banking sector, see Part 6 of Schedule 3;

 for the energy sector, see Part 8 of Schedule 4.

References to a person’s CDR data

 (4) In these rules, a reference to a person’s CDR data is a reference to the CDR data for which that person is a CDR consumer.

References to accredited person

 (5) In these rules, unless the contrary intention appears, a reference to an accredited person making a consumer data request, collecting CDR data, obtaining consents, providing a consumer dashboard, or using or disclosing CDR data does not include a reference to an accredited person doing those things on behalf of an OSP principal in its capacity as a direct or indirect OSP of:

  (a) another accredited person; or

 (b) a CDR representative of itself or of another accredited person;

in accordance with the relevant CDR outsourcing arrangement.

1.8  Data minimisation principle

Note: The data minimisation principle is relevant when:

 a CDR consumer requests an accredited person or a CDR representative to provide goods or services to the CDR consumer or to another person; and

 the accredited person or CDR representative needs to access the CDR consumer’s CDR data in order to provide those goods or services.

 The data minimisation principle is also relevant when an accredited person or CDR representative uses CDR data to provide requested goods or services to a CDR consumer.

 The data minimisation principle limits the CDR data that can be collected, and also limits the uses that can be made of collected CDR data.

 (1) The collection of CDR data by an accredited person complies with the data minimisation principle if, when making a consumer data request on behalf of a CDR consumer, the accredited person does not seek to collect:

 (a) more CDR data than is reasonably needed; or

 (b) CDR data that relates to a longer time period than is reasonably needed;

in order for it, or a relevant CDR representative, to provide the goods or services requested by the CDR consumer.

 (2) The use of CDR data by an accredited person or a CDR representative complies with the data minimisation principle if, when providing the requested goods or services, or using collected CDR data for any other purpose consented to by the CDR consumer, it does not use the collected CDR data, or CDR data directly or indirectly derived from it, beyond what is reasonably needed in order to provide the requested goods or services or fulfil the other purpose.

1.9  Fit and proper person criteria

 (1) For these rules, the fit and proper person criteria, in relation to a person, are the following:

 (a) whether the person, or any associated person, has, within the previous 10 years, been convicted of:

 (i) a serious criminal offence; or

 (ii) an offence of dishonesty;

  against any law of the Commonwealth or of a State or a Territory, or a law of a foreign jurisdiction;

 (b) whether the person, or any associated person, has been found to have contravened:

 (i) a law relevant to the management of CDR data; or

 (ii) a similar law of a foreign jurisdiction;

 (c) whether the person, or any associated person, has been the subject of:

 (i) a determination under paragraph 52(1)(b) or any of paragraphs 52(1A)(a), (b), (c) or (d) of the Privacy Act 1988; or

 (ii) a finding or determination of a similar nature under a similar law of a foreign jurisdiction;

 (d) if the person is a body corporate—whether any of the directors (within the meaning of the Corporations Act 2001) of the person, or any associated person:

 (i) has been disqualified from managing corporations; or

 (ii) is subject to a banning order;

 (e) whether the person, or any associated person, has a history of insolvency or bankruptcy;

 (f) whether the person, or any associated person, has been the subject of a determination made under an external dispute resolution scheme that:

 (i) included a requirement to pay monetary compensation; and

 (ii) was, at the time the determination was made:

 (A) recognised under the Privacy Act 1988; or

 (B) a recognised external dispute resolution scheme;

 (g) any other relevant matter, including but not limited to the objects of Part IVD of the Act.

Note: The objects of Part IVD are set out in section 56AA of the Act.

 (2) In this rule:

banning order has the same meaning as in the Corporations Act 2001.

serious criminal offence means an offence for which, if the act or omission had taken place in the Jervis Bay Territory, a person would be liable, on first conviction, to imprisonment for a period of not less than 5 years.

Note: The Jervis Bay Territory is mentioned because it is a jurisdiction in which the Commonwealth has control over the criminal law.

1.10  Meaning of direct OSP, indirect OSP and related terms

Persons in a chain of outsourced service providers

 (1) In these rules, where a person who is an accredited person or a CDR representative is the principal in one or more CDR outsourcing arrangements:

 (a) the provider in each such arrangement is a direct OSP (for “direct outsourced service provider”) of the person; and

 (b) where a direct OSP of the person is also the principal in a further CDR outsourcing arrangement, the provider in the further arrangement is an indirect OSP of the person; and

 (c) where an indirect OSP of the person is also the principal in a further CDR outsourcing arrangement, the provider in the further arrangement is also an indirect OSP of the person; and

 (d) the person is the OSP chain principal of each direct and indirect OSP.

Note: Paragraph (c) can be applied repeatedly, so there may be a chain of indirect OSPs for each direct OSP.

 (2) Paragraph (1)(d) does not apply in relation to a person who is an accredited person or CDR representative that is a direct or indirect OSP of an OSP chain principal.

Content of a CDR outsourcing arrangement

 (3) In these rules, a CDR outsourcing arrangement is a written contract between a person (the OSP principal) and another person (the provider) under which:

 (a) the provider will do one or both of the following:

 (i) collect CDR data from a CDR participant in accordance with these rules on behalf of the OSP chain principal (for an OSP chain principal with unrestricted accreditation);

 (ii) use or disclose service data to provide specified goods or services to the OSP principal; and

 (b) the provider is required to comply with the following requirements in relation to any service data:

 (i) in holding, using or disclosing the service data, the provider must comply with the following as if it were the OSP principal:

  (A) the OSP principal’s CDR policy as it relates to deletion and de‑identification of CDR data and the treatment of redundant or de‑identified CDR data;

 (B) section 56EG of the Act (privacy safeguard 4);

 (C) section 56EI of the Act (privacy safeguard 6);

 (D) section 56EJ of the Act (privacy safeguard 7);

 (E) section 56EK of the Act (privacy safeguard 8);

 (F) section 56EL of the Act (privacy safeguard 9);

 (ii) the provider must take the steps in Schedule 2 to protect the service data as if it were an accredited data recipient;

 (iii) the provider must not disclose service data other than:

 (A) to another direct or indirect OSP of the OSP chain principal; or

 (B) to the OSP chain principal; or

 (C) in circumstances where the disclosure of the service data by the OSP chain principal would be permitted under these rules;

 (iv) the provider must not use or disclose the service data other than in accordance with a contract with the OSP principal; and

 (v) the provider must:

 (A) when directed by the OSP principal, do any of the things referred to in paragraphs (5)(a), (b), (c) or (d); and

 (B) when directed by the OSP chain principal, do any of the things referred to in paragraphs (5)(a), (b), (c) or (d); and

 (C) if the OSP chain principal is a CDR representative—when directed by the CDR representative principal of the OSP chain principal, do any of the things referred to in paragraphs (5)(b), (c) or (d);

 (vi) if the provider is the OSP principal in a further CDR outsourcing arrangement (the arrangement), it must ensure that the other person in the arrangement complies with the requirements of the arrangement, including in relation to service data of the other person that was disclosed to it by the OSP chain principal or another direct or indirect OSP of the OSP chain principal.

Note: See rule 1.18 for the definition of “CDR data deletion process”.

 (4) For subparagraph (3)(a)(ii), the provision of the specified goods or services must be:

 (a) where the OSP principal is the OSP chain principal—for the purpose of enabling the OSP chain principal to provide CDR consumers for the service data with the goods and services for the purposes of which a relevant consent to collect the service data, or the CDR data from which it               was directly or indirectly derived, was given; and

 (b) otherwise—for the purpose of enabling the OSP principal to provide the goods and services specified in the CDR outsourcing arrangement for which it is the provider.

 (5) For subparagraph (3)(b)(v), the things are the following:

 (a) provide that person with access to any service data that it holds;

 (b) in accordance with the CDR data deletion process, delete any service data that it holds and make the required records;

 (c) provide to that person any such required records;

 (d) direct any other person to which it has disclosed service data under a further CDR outsourcing arrangement to take corresponding steps.

Service data

 (6) In these rules, service data, in relation to a person who is a direct or indirect OSP of an OSP chain principal, means any CDR data of a CDR consumer of the OSP chain principal held by the person that:

 (a) was disclosed to the person by the OSP chain principal for the purposes of the relevant CDR outsourcing arrangement; or

 (b) was collected from a CDR participant by the person on behalf of the OSP chain principal in accordance with the relevant CDR outsourcing arrangement; or

 (c) was disclosed to the person by another direct or indirect OSP of the OSP chain principal in accordance with the relevant CDR outsourcing arrangement for the other direct or indirect OSP; or

 (d) is directly or indirectly derived from such CDR data.

Note: Service data may be disclosed to other direct or indirect OSPs in accordance with provisions in the relevant CDR outsourcing arrangements.

 (7) For paragraph (6)(a), where an accredited person gives a direct or indirect OSP (the provider) permission to access or use CDR data collected by the provider on behalf of the OSP chain principal in accordance with subparagraph (3)(a)(i), the accredited person is taken to disclose the CDR data to the provider.

1.10AA  Meaning of CDR representative and related terms

Note: From the point of view of a CDR consumer who is the customer of a CDR representative, the consumer deals with the CDR representative, as if it were an accredited person, and might not deal with the CDR representative principal at all. The consumer requests the goods or services from the CDR representative; the CDR representative identifies the CDR data that it needs in order to provide the goods and services; the consumer gives their consent to the CDR representative for the collection and use of the CDR data. The consumer is informed that the CDR representative principal will do the actual collecting, but as a background detail.

 A CDR representative cannot deal with a person in their capacity as a CDR business consumer.

 (1) In these rules, a CDR representative arrangement is a written contract between a person with unrestricted accreditation (the CDR representative principal) and a person without accreditation (the CDR representative):

 (a) under which the CDR representative will offer goods and services to CDR consumers, but not in their capacity as CDR business consumers, for which it will need to use or disclose CDR data of the CDR consumer; and

 (b) under which, where the CDR representative has obtained the consent of a CDR consumer to the collection, use and disclosure of CDR data in accordance with rule 4.3A:

 (i) the CDR representative principal will:

 (A) make any appropriate consumer data request; and

 (B) disclose the relevant CDR data to the CDR representative; and

 (ii) the CDR representative will use or disclose the CDR data to provide the relevant goods or services to the CDR consumer; and

 (c) that specifies that the provisions referred to in paragraphs (a) and (b) do not operate until the details of the CDR representative have been entered on the Register of Accredited Persons; and

 (d) under which the CDR representative is required to comply with any rules that are expressed as applying to a CDR representative.

 (2) A CDR representative arrangement may provide for the CDR representative:

 (a) to seek any consent for the use or disclosure of service data that the CDR representative principal could seek in the same circumstances; and

 (b) to make any use or disclosure of service data that would be:

  (i) a permitted use or disclosure of the CDR data of the kind mentioned in paragraph 7.5(1)(j); or

 (ii) a permitted use or disclosure of the CDR data that relates to direct marketing of the kind mentioned in paragraph 7.5(3)(e).

 (3) A CDR representative arrangement must require the CDR representative:

 (a) not to enter into another CDR representative arrangement; and

 (b) not to engage a person as the provider in a CDR outsourcing arrangement in relation to service data except as provided in the CDR representative arrangement.

Note: Because a CDR representative cannot collect CDR data except through its CDR representative principal, it cannot engage the provider to collect CDR data.

 (4) A CDR representative arrangement must require the CDR representative to comply with the following requirements in relation to any service data:

 (a) in holding, using or disclosing the service data, the CDR representative must comply with the following as if it were the CDR representative principal:

 (i) section 56EE of the Act (privacy safeguard 2);

 (ii) section 56EG of the Act (privacy safeguard 4);

 (iia) section 56EI of the Act (privacy safeguard 6);

 (iib) section 56EJ of the Act (privacy safeguard 7);

 (iii) section 56EN of the Act, other than subsection (1) (privacy safeguard 11);

 (iv) section 56EO of the Act (privacy safeguard 12);

 (v) section 56EP of the Act, other than subsection (1) (privacy safeguard 13);

 (b) the CDR representative must take the steps in Schedule 2 to protect the service data as if it were the CDR representative principal;

 (c) the CDR representative must not use or disclose the service data other than in accordance with a contract with the CDR representative principal;

 (d) the CDR representative must not use or disclose the service data unless the use or disclosure would be:

 (i) a permitted use or disclosure of the CDR data of the kind mentioned in paragraph 7.5(1)(j); or

 (ii) a permitted use or disclosure of the CDR data that relates to direct marketing of the kind mentioned in paragraph 7.5(3)(e);

 (e) the CDR representative must, when so directed by the CDR representative principal:

 (i) do any of the following:

 (A) delete any service data that it holds in accordance with the CDR data deletion process;

 (B) provide, to the CDR representative principal, records of any deletion that are required to be made under the CDR data deletion process; and

 (ii) require its direct and indirect OSPs to do the same;

 (f) the CDR representative must adopt and comply with the CDR representative principal’s CDR policy in relation to the service data;

 (g) the CDR representative must comply with sections 56EK and 56EL of the Act (privacy safeguards 8 and 9) as if it were an accredited data recipient.

Note 1: For paragraph (4)(c), the CDR representative principal may be a direct or indirect OSP of the CDR representative, either as a result of provisions in the written agreement that make it also an CDR outsourcing arrangement under rule 1.10, or under a separate CDR outsourcing arrangement.

Note 2: For paragraph (4)(d), the permitted uses or disclosures are those that would be permitted if the representative were an accredited data recipient that had collected the CDR data under the consumer data request.  They include disclosure to a direct or indirect OSP for the purposes of providing the relevant goods and services.             

Note 3: For paragraph (4)(e), see rule 1.18 for the definition of “CDR data deletion process”.

 (5) In these rules, service data, in relation to a CDR representative, consists of any CDR data that:

 (a) was disclosed to the CDR representative for the purposes of the CDR representative arrangement; or

 (b)  is directly or indirectly derived from such CDR data.

1.10A  Types of consents

 (1) For these rules:

 (a) a collection consent is a consent given by a CDR consumer under these rules for an accredited person to collect particular CDR data from a CDR participant for that CDR data; and

 (b) a use consent is a consent given by a CDR consumer under these rules for an accredited data recipient of particular CDR data, or a CDR representative that holds the CDR data as service data, to use that CDR data in a particular way; and

 (c) a disclosure consent is a consent given by a CDR consumer under these rules for an accredited data recipient of particular CDR data, or a CDR representative that holds the CDR data as service data, to disclose that CDR data:

 (i) to an accredited person in response to a consumer data request (an AP disclosure consent); or

 (ii) to an accredited person for the purposes of direct marketing; or

 (iii) to a trusted adviser of the CDR consumer (a TA disclosure consent); or

 (iv) to a specified person in accordance with an insight disclosure consent; or

 (v) other than in the case of a CDR representative—to a specified person in accordance with a business consumer disclosure consent; and

 (d) a direct marketing consent is a consent given by a CDR consumer under these rules for an accredited data recipient of particular CDR data, or a CDR representative that holds the CDR data as service data, to use or disclose the CDR data for the purposes of direct marketing; and

 (e) a de‑identification consent is a consent given by a CDR consumer under these rules for an accredited data recipient of particular CDR data, or a CDR representative that holds the CDR data as service data, to de‑identify some or all of the collected CDR data and do either or both of the following:

 (i) use the de‑identified data for general research;

 (ii) disclose (including by selling) the de‑identified data.

 (2) For these rules, each of the following is a category of consents:

 (a) collection consents;

 (b) use consents relating to the goods or services requested by the CDR consumer;

 (c) direct marketing consents;

 (d) de‑identification consents;

 (e) AP disclosure consents;

 (f) TA disclosure consents;

 (g) insight disclosure consents;

 (h)  business consumer disclosure consents.

Insight disclosure consents

 (3) For these rules, an insight disclosure consent in relation to particular CDR data of a CDR consumer held by an accredited data recipient, or a CDR representative that holds the CDR data as service data, is a disclosure consent given by the CDR consumer under these rules that:

 (a) authorises the accredited data recipient or CDR representative to disclose the CDR data to a specified person for one or more of the following purposes:

 (i) verifying the consumer’s identity;

 (ii) verifying the consumer’s account balance;

 (iii) verifying the details of credits to or debits from the consumer’s accounts; but

 (b) where the CDR data relates to more than one transaction—does not authorise the accredited data recipient or CDR representative to disclose an amount or date in relation to any individual transaction.

 (4) An accredited person must not make:

 (a) the giving of an insight disclosure consent; or

 (b) the specification of a particular person for the purposes of paragraph (3)(a);

a condition for supply of the goods or services requested by the CDR consumer.

Note: This subrule is a civil penalty provision (see rule 9.8).

 (5) A CDR representative must not make:

 (a) the giving of an insight disclosure consent; or

 (b) the specification of a particular person for the purposes of paragraph (3)(a);

a condition for supply of the goods or services requested by the CDR consumer.

 (6) A CDR representative principal contravenes this subrule if its CDR representative makes:

 (a) the giving of an insight disclosure consent; or

 (b) the specification of a particular person for the purposes of paragraph (3)(a);

a condition for supply of the goods or services requested by the CDR consumer.

Note: This subrule is a civil penalty provision (see rule 9.8).

 (7) To avoid doubt, paragraphs (4)(a), (5)(a) and (6)(a) do not apply where the only good or service that is requested by the CDR consumer is for CDR data to be collected from a data holder and CDR insights disclosed in accordance with the insight disclosure consent.

Consents in relation to CDR representatives

 (8) For an accredited person with a CDR representative, a consent given by a CDR consumer under these rules to the CDR representative for the accredited person to collect particular CDR data from a CDR participant for that CDR data and disclose it to the CDR representative is also a collection consent.

CDR business consumers

 (9) For these rules, a CDR consumer is taken to be a CDR business consumer in relation to a consumer data request to be made by an accredited person if the accredited person has taken reasonable steps to confirm that:

 (a) the CDR consumer is not an individual; or

 (b) the CDR consumer has an active ABN.

 (10) For these rules, a business consumer statement is a statement made by a CDR business consumer that:

 (a) is given in relation to a consent in one of the following categories:

 (i) use consents relating to the goods or services requested by the CDR business consumer;

 (ii) TA disclosure consents;

 (iii) insight disclosure consents;

 (iv) business consumer disclosure consents; and

 (b) certifies that the consent is given for the purpose of enabling the accredited person to provide goods or services to the CDR business consumer in its capacity as a business (and not as an individual).

Note: Only an accredited person is able to deal with a CDR consumer in the CDR consumer’s capacity as a CDR business consumer, and is hence able to invite a CDR consumer to provide a business consumer statement.

 (11) For these rules, a business consumer disclosure consent in relation to particular CDR data of a CDR business consumer held by an accredited data recipient is a disclosure consent given by the CDR business consumer under these rules that:

 (a) authorises the accredited data recipient to disclose the CDR data to a specified person; and

  (b) includes a business consumer statement.

 (12) An accredited person must not make:

 (a) the giving of a business consumer disclosure consent; or

 (b) the giving of a business consumer statement; or

 (c) the specification of a particular person for the purposes of paragraph (11)(a);

a condition for supply of the goods or services requested by the CDR business consumer.

Note: This subrule is a civil penalty provision (see rule 9.8).

 (13) To avoid doubt, paragraphs (12)(a) and (b) do not apply where the only good or service that is requested by the CDR business consumer is for CDR data to be collected from a data holder and provided to a specified person.

 (14)  An accredited person may not deal with a person in their capacity as a CDR business consumer before the earlier of the following:

 (a) if the Data Standards Chair makes data standards about the matters referred to in both of subparagraphs 8.11(1)(a)(iv) and subparagraph 8.11(1)(c)(vi) before 1 December 2023—the day on which the last of those standards is made;

 (b) 1 December 2023.

Note: This subrule is a civil penalty provision (see rule 9.8).

1.10B  Meaning of eligible

Note: Sector Schedules may add additional criteria for eligibility.  See also:

 for the banking sector—clause 2.1 of Schedule 3;

 for the energy sector—clause 2.1 of Schedule 4.

 (1) A CDR consumer is eligible, in relation to a particular data holder at a particular time, if, at that time:

 (a) the CDR consumer is either:

 (i) an individual who is 18 years of age or older; or

 (ii) a person who is not an individual; and

 (b) the CDR consumer is an account holder or a secondary user for an account with the data holder that is open; and

 (c) any additional criteria set by the relevant sector Schedule for this subrule are met.

 (2) A CDR consumer is also eligible, in relation to a particular data holder at a particular time, if, at that time:

 (a) the CDR consumer is a partner in a partnership for which there is a partnership account with the data holder; and

 (b) the account is open; and

 (c) any additional criteria set by the relevant sector Schedule for this subrule are met.

1.10C  Trusted advisers

 (1) An accredited person or CDR representative may invite a CDR consumer to nominate one or more persons as trusted advisers of the CDR consumer for the purposes of this rule.

 (2) A trusted adviser must belong to one of the following classes:

 (a) qualified accountants within the meaning of the Corporations Act 2001;

 (b) persons who are admitted to the legal profession (however described) and hold a current practising certificate under a law of a State or Territory that regulates the legal profession;

 (c) registered tax agents, BAS agents and tax (financial) advisers within the meaning of the Tax Agent Services Act 2009;

 (d) financial counselling agencies within the meaning of the ASIC Corporations (Financial Counselling Agencies) Instrument 2017/792;

 (e) relevant providers within the meaning of the Corporations Act 2001 other than:

 (i) provisional relevant providers under section 910A of that Act; and

 (ii) limited‑service time‑sharing advisers under section 910A of that Act;

 (f) mortgage brokers within the meaning of the National Consumer Credit Protection Act 2009.

 (3) Where the accredited person or CDR representative has taken reasonable steps to confirm that a person nominated as a trusted adviser was, and remains, a member of a class mentioned in subrule (2), the person is taken to be a member of that class for the purposes of this rule.

 (4) The accredited person or CDR representative must not make:

 (a) the nomination of a trusted adviser; or

 (b) the nomination of a particular person as a trusted adviser; or

 (c) the giving of a TA disclosure consent;

  a condition for supply of the goods or services requested by the CDR consumer.

 (5) To avoid doubt, paragraphs (4)(a) and (c) do not apply where the only good or service that is requested by the CDR consumer is for CDR data to be collected from a data holder and provided to a trusted adviser.

1.10D  Meaning of sponsorship arrangement, sponsor and affiliate

 (1) A sponsorship arrangement is a written contract between a person with unrestricted accreditation (the sponsor) and another person (the affiliate), under which:

 (a) the sponsor agrees to disclose to the affiliate, in response to a consumer data request made by the affiliate in accordance with subrule 5.1B(2), CDR data that it holds as an accredited data recipient; and

 (b) the affiliate undertakes to provide the sponsor with such information and access to its operations as is needed for the sponsor to fulfil its obligations as a sponsor.

Note: A person does not need to have sponsored accreditation to enter into a sponsorship arrangement as an affiliate, but will need it to make the consumer data requests mentioned in paragraph (a)

 (2) A sponsorship arrangement may also provide for the sponsor to:

 (a) make consumer data requests at the request of the affiliate; or

 (b) use or disclose CDR data at the request of the affiliate.

Division 1.4—General provisions relating to data holders and to accredited persons

Subdivision 1.4.1—Preliminary

1.11  Simplified outline of Division

Subdivision 1.4.2—Services for making requests under these rules

1.12  Product data request service

 (1) A data holder must provide an online service that:

 (a) can be used to make product data requests; and

 (b) enables requested data to be disclosed in machine‑readable form; and

 (c) conforms with the data standards.

Note 1: See rule 2.3 for the meaning of “product data request”.

Note 2: This subrule is a civil penalty provision (see rule 9.8).

Note 3:  For the energy sector, this rule is modified by clause 4.2 of Schedule 4.

 (2) Such a service is a product data request service.

1.13  Consumer data request service

 (1) A data holder must provide:

 (a) an online service that:

 (i) can be used by eligible CDR consumers to make consumer data requests directly to the data holder; and

 (ii) allows a request to be made in a manner that is no less timely, efficient and convenient than any of the online services that are ordinarily used by customers of the data holder to deal with it; and

 (iii) enables requested data to be disclosed in human‑readable form; and

 (iv) sets out any fees for disclosure of voluntary consumer data; and

 (v) conforms with the data standards; and

 (b) an online service that:

 (i) can be used by accredited persons to make consumer data requests, on behalf of eligible CDR consumers, to the data holder; and

 (ii) enables requested data to be disclosed in machine‑readable form; and

 (iii) conforms with the data standards; and

 (c) for each eligible CDR consumer that is not an individual—a service that can be used to:

 (i) nominate one or more individuals 18 years of age or older (nominated representatives) who are able to give, amend and manage authorisations to disclose CDR data for the purposes of these rules on behalf of the CDR consumer; and

 (ii) revoke such a nomination; and

 (d) for each partnership that relates to a partnership account with the data holder—a service that can be used to:

 (i) nominate one or more individuals 18 years of age or older (nominated representatives) who are able to give, amend and manage authorisations to disclose CDR data that relate to the partnership accounts of that partnership for the purposes of these rules on behalf of the CDR consumers who are its partners; and

 (ii) revoke such a nomination; and

 (e) in relation to each account in relation to which a person has account privileges―a service that can be used by the account holder to:

 (i) make a secondary user instruction; and

 (ii) withdraw the instruction.

Note 1: See rule 3.3 for the meaning of “consumer data request” in relation to a request made by a CDR consumer directly to a data holder.

Note 2: See rule 4.4 for the meaning of “consumer data request” in relation to a request made by an accredited person to a data holder on behalf of a CDR consumer.

Note 3: In the circumstances of paragraphs (1)(c) and (d), a person or partnership that does not have a nominated representative will not be able to give or amend authorisations, or use the dashboard to manage authorisations (see subrule 1.15(2A)), and accordingly, the data holder will be neither required nor permitted to disclose the requested CDR data under these rules.

Note 4: The services of paragraphs (c), (d) and (e) may, but need not, be online.

Note 5: This subrule is a civil penalty provision (see rule 9.8).

 (2) The service referred to in paragraph (1)(a) is the data holder’s direct request service.

 (3) The service referred to in paragraph (1)(b) is the data holder’s accredited person request service.

 (4) A data holder does not contravene subrule (1) in relation to subparagraph (1)(a)(ii) so long as it takes reasonable steps to ensure that the online service complies with that subparagraph.

Subdivision 1.4.3—Services for managing consumer data requests made by accredited persons

1.14  Consumer dashboard—accredited person

 (1) Subject to subrule (5), an accredited person must provide each eligible CDR consumer on whose behalf the accredited person makes a consumer data request with an online service that:

 (a) can be used by the CDR consumer to manage:

 (i) such requests; and

 (ii) associated consents; and

 (b) contains the details of each consent specified in subrule (3) and the information specified in subrule (3A); and

 (c) has a functionality that:

 (i) allows the CDR consumer, at any time, to:

 (A) withdraw current consents; and

 (B) elect that redundant data be deleted in accordance with these rules and withdraw such an election; and

 (ii) is simple and straightforward to use; and

 (iii) is prominently displayed.

Note: This subrule is a civil penalty provision (see rule 9.8).

 (2) Such a service is the accredited person’s consumer dashboard for that consumer.

 (2A) The consumer dashboard may also include a functionality that allows a CDR consumer to amend a current consent.

 (3) For paragraph (1)(b), the information is the following for each consent:

 (a) details of the CDR data to which the consent relates;

 (b) for a use consent―details of the specific use or uses for which the CDR consumer has given their consent;

 (c) when the CDR consumer gave the consent;

 (d) whether the consent applies:

 (i) on a single occasion; or

 (ii) over a period of time;

 (e) if a collection consent or disclosure consent applies over a period of time:

 (i) what that period is; and

 (ii) how often data has been, and is expected to be, collected or disclosed over that period;

 (ea) for an insight disclosure consent—a description of the CDR insight and to whom it was disclosed;

 (eb) if a business consumer statement has been given in relation to the consent—that fact;

 (f) if the consent is current—when it is scheduled to expire;

 (g) if the consent is not current—when it expired;

 (h) information relating to CDR data that was collected or disclosed pursuant to the consent (see rules 7.4 and 7.9);

 (ha) if the accredited person is an affiliate and the CDR data will be collected by a sponsor at its request:

 (i) the sponsor’s name; and

 (ii) the sponsor’s accreditation number;

 (i) details of each amendment (if any) that has been made to the consent.

Note 1: For paragraph (f), consents expire at the latest 12 months (or 7 years for certain consents by a CDR business consumer) after they are given or, in some circumstances, amended: see paragraph 4.14(1)(c).

Note 2:  For limits on the specific uses that are possible, see the data minimisation principle (rule 1.8).

Note 3: The consumer dashboard could contain other information too, for example, the written notices referred to in rule 7.15 (which deals with correction requests under privacy safeguard 13, section 56EP of the Act).

 (3A) For paragraph (1)(b), the other information is:

 (a) a statement that the CDR consumer is entitled to request further records in accordance with rule 9.5; and

 (b) information about how to make such a request.

 (4) An accredited person does not contravene subrule (1) in relation to subparagraph (1)(c)(ii) so long as it takes reasonable steps to ensure that the functionality complies with that subparagraph.

Dashboard in relation to CDR representative

 (5) Where a CDR representative principal makes a consumer data request at the request of a CDR representative, it may arrange for the CDR representative to provide the consumer dashboard on its behalf.

1.15  Consumer dashboard—data holder

 (1) If a data holder receives a consumer data request from an accredited person on behalf of a CDR consumer, the data holder must, in the circumstances specified in a sector Schedule, ensure that it provides the CDR consumer with an online service that:

 (a) can be used by the CDR consumer to manage authorisations to disclose CDR data in response to consumer data requests; and

 (b) contains the details of each authorisation to disclose CDR data specified in subrule (3); and

 (ba) contains any information in the data standards that is specified as information for the purposes of this rule; and

 (bb) contains any information on the Register of Accredited Persons that is specified as information for the purposes of this rule; and

 (c) has a functionality that:

 (i) allows for withdrawal, at any time, of authorisations to disclose CDR data; and

 (ii) is simple and straightforward to use; and

 (iii) is no more complicated to use than the process for giving the authorisation to disclose CDR data; and

 (iv) is prominently displayed; and

 (v) as part of the withdrawal process, displays a message relating to the consequences of the withdrawal in accordance with the data standards; and

 (d) contains any other details, and has any other functionality, required by a provision of these rules.

Note 1: This subrule is a civil penalty provision (see rule 9.8).

Note 2: The circumstances are specified in the following provisions of the sector Schedules:

 for the banking sector—clause 2.3 of Schedule 3;

 for the energy sector—clause 2.3 of Schedule 4.

 (2) Such a service is the data holder’s consumer dashboard for that consumer.

Note: If the consumer data request relates to a joint account, there may be an obligation to provide all joint account holders with consumer dashboards:  see rule 4A.13.

 (2A) For subrule (1), the online service must allow only nominated representatives to manage authorisations in the following circumstances:

 (a) where the CDR consumer is not an individual;

 (b) where the CDR data relates to a partnership account.

 (3) For paragraph (1)(b) and paragraph (5)(a), the information is the following for each authorisation:

 (a) details of the CDR data that has been authorised to be disclosed;

 (b) when the CDR consumer gave the authorisation;

 (c) the period for which the CDR consumer gave the authorisation;

 (d) if the authorisation is current—when it is scheduled to expire;

 (e) if the authorisation is not current—when it expired;

 (f) information relating to CDR data that was disclosed pursuant to the authorisation (see rule 7.9);

 (g) for a disclosure of CDR data that relates to the authorisation but that was pursuant to a request under subsection 56EN(4) of the Act—that fact;

 (h) details of each amendment (if any) that has been made to the authorisation.

Note 1: For paragraph (d), authorisations to disclose CDR data expire at the latest 12 months after they are given: see paragraph 4.26(1)(e).

Note 2: The consumer dashboard could contain other information too, for example, the written notice referred to in rules 7.10 (which deals with quality of CDR data under privacy safeguard 11, section 56EN of the Act) and 7.15 (which deals with correction requests under privacy safeguard 13, section 56EP of the Act).

 (3A) Paragraph (3)(h) applies on and after 1 July 2024.

 (4) A data holder does not contravene subrule (1) in relation to subparagraphs (1)(c)(ii) and (iii) so long as it takes reasonable steps to ensure that the functionality complies with those subparagraphs.

Secondary users

 (5) If the CDR consumer is a secondary user for an account, the data holder must also provide the account holder with an online service that:

 (a) for each authorisation to disclose CDR data given by the secondary user—contains the details specified in subrule (3); and

 (b) has a functionality that:

 (i) allows for the account holder to, at any time, give the indication referred to in subparagraph 4.6A(a)(ii) in relation to a particular accredited person; and

 (ii) allows for the withdrawal of the secondary user instruction; and

 (iii) is simple and straightforward to use; and

 (iv) is no more complicated to use than the processes for giving the authorisations or instructions; and

 (v) is prominently displayed; and

 (vi) as part of the withdrawal process, displays a message relating to the consequences of the withdrawal in accordance with the data standards.

Note 1: This subrule is a civil penalty provision (see rule 9.8).

Note 2:  If the account holder makes an indication in accordance with subparagraph (5)(b)(i), the data holder will no longer be able to disclose CDR data relating to that account to that accredited person: see subrules 4.6(2) and (4) and rule 4.6A.

 (6) A data holder does not contravene subrule (5) in relation to subparagraphs (5)(b)(iii) and (iv) so long as it takes reasonable steps to ensure that the functionality complies with those subparagraphs.

 (7) If the data holder provides a consumer dashboard for the account holder, the service mentioned in subrule (5) must be included in the consumer dashboard.

Note: This subrule is a civil penalty provision (see rule 9.8).

Subdivision 1.4.4—Other obligations of accredited persons

1.16  Obligations relating to outsourcing arrangements

OSPs of accredited person

 (1) If an accredited person is the OSP chain principal of one or more direct or indirect OSPs, it must ensure that each direct and indirect OSP complies with its requirements under the relevant CDR outsourcing arrangement.

 (2) The accredited person breaches this subrule if a direct OSP or indirect OSP of the accredited person fails to comply with a required provision of the relevant CDR outsourcing arrangement.

Note: This subrule is a civil penalty provision (see rule 9.8).

OSPs of CDR representative of accredited person

 (3) If an accredited person is the CDR representative principal in a CDR representative arrangement under which it permits the CDR representative to engage direct or indirect OSPs, it must ensure that each such direct and indirect OSP complies with its requirements under the relevant CDR outsourcing arrangement.

 (4) The accredited person breaches this subrule if a direct OSP or indirect OSP of the CDR representative fails to comply with a required provision of the relevant CDR outsourcing arrangement.

Note: This subrule is a civil penalty provision (see rule 9.8).

Accredited person acting as OSP for another accredited person

 (5) If an accredited person collects CDR data on behalf of another accredited person (the principal) as a direct or indirect OSP:

 (a) rules 7.4 and 7.9 apply only in relation to the principal; and

 (b) paragraph 7.10(1)(a) requires the principal to be identified.

Meaning of required provision

 (6) For this rule, a provision of a CDR outsourcing arrangement is a required provision if the arrangement would cease to be a CDR outsourcing arrangement under subrule 1.10(3) if the provision were removed.

1.16A  Obligations relating to CDR representative arrangements

Compliance with CDR representative arrangement

 (1) If an accredited person is the CDR representative principal in a CDR representative arrangement, it must ensure that the CDR representative complies with its requirements under the arrangement.

 (2) The accredited person breaches this subrule if the CDR representative:

 (a) fails to comply with a required provision of the CDR representative arrangement; or

 (b) does one of the things referred to in subrule 1.10AA(2) in circumstances where the CDR representative arrangement does not provide for the CDR representative to do that thing.

Note: This subrule is a civil penalty provision (see rule 9.8).

Compliance with Division 4.3A

 (3) The accredited person must ensure that the CDR representative complies with Division 4.3A.

 (4) The accredited person breaches this subrule if the CDR representative fails to comply with a provision of Division 4.3A.

Note: This subrule is a civil penalty provision (see rule 9.8).

Meaning of required provision

 (5) For this rule, a provision of a CDR representative arrangement is a required provision if it is a provision of a kind referred to in any of subrules 1.10AA(1), (3) and (4).

Subdivision 1.4.5—Deletion and de‑identification of CDR data

1.17  CDR data de‑identification process

 (1) This rule sets out the CDR data de‑identification process for particular CDR data (the relevant data).

Note: This process is applied by an accredited data recipient when de‑identifying CDR data in accordance with a consent from a CDR consumer (see Subdivision 4.3.3) and when de‑identifying redundant data for the purposes of privacy safeguard 12 (see rule 7.12).

 (2) First, the accredited data recipient must consider whether, having regard to the following:

 (a) the DDF;

 (b) the techniques that are available for de‑identification of data;

 (c) the extent to which it would be technically possible for any person to be once more identifiable, or reasonably identifiable, after de‑identification in accordance with such techniques;

 (d) the likelihood (if any) of any person once more becoming so identifiable, or reasonably identifiable from the data after de‑identification;

  it would be possible to de‑identify the relevant data to the extent (the required extent) that no person would any longer be identifiable, or reasonably identifiable, from:

 (e) the relevant data after the proposed de‑identification; and

 (f) other information that would be held, following the completion of the de‑identification process, by any person.

 (3) If this is possible, the accredited data recipient must:

 (a) determine the technique that is appropriate in the circumstances to de‑identify the relevant data to the required extent; and

 (b) apply that technique to de‑identify the relevant data to the required extent; and

 (c) delete, in accordance with the CDR data deletion process, any CDR data that must be deleted in order to ensure that no person is any longer identifiable, or reasonably identifiable, from the information referred to in paragraphs (2)(e) and (f); and

 (d) as soon as practicable, make a record to evidence the following:

 (i) its assessment that it is possible to de‑identify the relevant data to the required extent;

 (ii) that the relevant data was de‑identified to that extent;

 (iii) how the relevant data was de‑identified, including records of the technique that was used;

 (iv) any persons to whom the de‑identified data is disclosed.

 (4) If this is not possible, the accredited data recipient must delete the relevant data and any CDR data directly or indirectly derived from it in accordance with the CDR data deletion process.

Note: For the CDR data deletion process, see rule 1.18.

 (5) For this rule, the DDF is The De‑Identification Decision‑Making Framework published by the Office of the Australian Information Commissioner and Data61, as in force from time to time.

Note: The De‑Identification Decision‑Making Framework could in 2023 be downloaded from Data61’s website (https://www.data61.csiro.au/).

1.17A  Identification of otherwise redundant data that is not to be deleted

 (1) Where the accredited data recipient has identified CDR data as redundant, it must identify whether any of the following provisions of the Act apply to the CDR data:

 (a) paragraphs 56BAA(2)(a), (b) or (c) of the Act (deletion request by consumer);

 (b) paragraphs 56EO(2)(b) or (c) of the Act (privacy safeguard 12).

 (2) Where one of those provisions applies, the accredited person must retain the CDR data while that provision applies.

 (3) For the purposes of paragraph 56BAA(2)(c) of the Act, in relation to CDR data of a CDR consumer, the person may:

 (a) request the CDR consumer to state whether or not proceedings of the kind mentioned in that paragraph are current or anticipated; and

 (b) rely on that statement.

1.18  CDR data deletion process

  For these rules, the CDR data deletion process in relation to a person that holds CDR data that is to be deleted consists of the following steps:

 (a) delete, to the extent reasonably practicable, that CDR data and any copies of that CDR data;

 (b) make a record to evidence the deletion; and

 (c) where another person holds the CDR data on its behalf and will perform those steps—direct that person to notify it when those steps have been performed.

Note: The CDR data deletion process is to be followed whenever these rules require a person to delete CDR data.

Division 1.5—Application of rules in relation to SR data

Note: The effect of this Division is that, from the point of view of a CDR consumer or an accredited person, the primary data holder for SR data is treated as if it were the relevant data holder: consumer data requests for the SR data are made to it; authorisations for disclosure are made to it; it is the entity that discloses or refuses to disclose the requested data; any complaints are made to it; it keeps the records that the CDR consumer can request under rule 9.5.

1.19  Eligible CDR consumers in relation to secondary data holders

  If a CDR consumer is eligible to make or initiate a consumer data request to a primary data holder for SR data, the CDR consumer is not also eligible to make or initiate a consumer data request for that data to the secondary data holder.

Note: As a result of this rule, a secondary data holder that only holds SR data is not required to provide request services under rule 1.13; however, it will be required to provide a service under subrule 1.20(2).

1.20  Consumer data request service—primary data holders and secondary data holders

Primary data holders

 (1) Rule 1.13 (consumer data request service) applies in relation to a data holder for CDR data as if it were also a data holder for any SR data for which it is the primary data holder.

Secondary data holders

 (2) A secondary data holder in relation to SR data must provide an online service that:

 (a) can be used by the primary data holder to request from the secondary data holder any SR data needed to respond to an SR data request; and

 (b) enables the requested data to be disclosed to the primary data holder in machine‑readable form; and

 (c) conforms with the data standards.

Note: This subrule is a civil penalty provision (see rule 9.8).

1.21  Consumer dashboard—SR data request

  Rule 1.15 (provision of dashboard) applies in relation to an SR data request as if the primary data holder were the data holder for the requested SR data.

1.22  SR data request by a CDR consumer

Note: This rule relates to Division 3.2.

 (1) This rule applies where a CDR consumer proposes to make an SR data request.

 (2) The request must be made to the primary data holder, using the primary data holder’s direct request service.

Dealing with the request

 (3) The primary data holder must, using the service mentioned in subrule 1.20(2) in accordance with the data standards, request the secondary data holder to disclose any SR data that the primary data holder needs in order to respond to the SR data request.

Note: This subrule is a civil penalty provision (see rule 9.8).

 (4) If the secondary data holder chooses to disclose the SR data requested to the primary data holder, it must do so in accordance with any relevant data standards.

Note: This subrule is a civil penalty provision (see rule 9.8).

 (5) If the secondary data holder chooses not to disclose the SR data requested to the primary data holder, it must notify the primary data holder of its refusal.

Note: This subrule is a civil penalty provision (see rule 9.8).

Responding to the request

 (6) Rule 3.4 (disclosing consumer data in response to a consumer data request) and rule 3.5 (refusal to disclose) apply as if the primary data holder were the data holder for any SR data covered by the SR data request.

 (7) Subrule 3.4(3) does not apply in relation to SR data that the secondary data holder has refused to disclose to the primary data holder.

1.23  SR data request by an accredited person

Note: This rule relates to Subdivisions 4.2.2, 4.2.3 and 4.3.2 and Division 4.4.

 (1) This rule applies where an accredited person proposes to make an SR data request on behalf of a CDR consumer.

Making the request

 (2) The request must be made to the primary data holder, using the primary data holder’s accredited person request service.

Dealing with the request

 (3) Rule 4.5 (asking CDR consumer for authorisation to disclose CDR data) applies as if the primary data holder were the data holder for any SR data covered by the SR data request.

 (4) If the CDR consumer authorises disclosure of requested data, the primary data holder must, using the service mentioned in subrule 1.20(2) and in accordance with the data standards, request the secondary data holder to disclose any SR data that the primary data holder needs in order to respond to the SR data request.

Note: This subrule is a civil penalty provision (see rule 9.8).

 (5) If the secondary data holder chooses to disclose the SR data requested to the primary data holder, it must do so in accordance with any relevant data standards.

Note: This subrule is a civil penalty provision (see rule 9.8).

 (6) If the secondary data holder chooses not to disclose the SR data requested to the primary data holder, it must notify the primary data holder of its refusal.

Note: This subrule is a civil penalty provision (see rule 9.8).

Responding to the request

 (7) Subject to subrule (8), rule 4.6 (disclosing consumer data in response to a consumer data request) applies as if the primary data holder were the data holder for any SR data covered by the SR data request.

 (8) Subrule 4.6(4) does not apply in relation to SR data that the secondary data holder has refused to disclose to the primary data holder.

 (9) Rule 4.7 (refusal to disclose) applies as if the primary data holder were the data holder for any SR data covered by the SR data request.

Notification of withdrawal of consent

 (10) Rule 4.13 (withdrawal of consent) applies as if the primary data holder were the data holder for any SR data covered by the SR data request.

Dealing with authorisations

 (11) Division 4.4 (authorisations to disclose CDR data) applies as if:

 (a) a reference to the data holder were a reference to the primary data holder; and

 (b) the following subrule were added after subrule 4.25(2) (withdrawal of authorisation by CDR consumer):

 “(3) For subrule (2), giving effect to withdrawal includes cancelling any current requests to the secondary data holder by the primary data holder under subrule 1.23(4).”.

1.24  SR data disclosed to primary data holder not to be used for other purposes

 (1) A primary data holder must not use the service mentioned in subrule 1.20(2) other than to request SR data that it needs to respond to an SR data request.

 (2) Where a secondary data holder provides SR data to a primary data holder in response to such a request:

 (a) the primary data holder must not use or disclose the SR data for a purpose other than responding to the SR data request; and

 (b) once the primary data holder has responded to the SR data request, it must delete any of the SR data that it holds in accordance with the CDR data deletion process.

Note : See rule 1.18 for the definition of “CDR data deletion process”.

1.25  Dealing with unsolicited SR data

  If a primary data holder:

 (a) collects SR data from a secondary data holder:

 (i) purportedly under these rules; but

 (ii) not as the result of seeking to collect that SR data under these rules; and

 (b) is not required to retain that SR data by or under an Australian law or a court/tribunal order;

  the primary data holder must destroy the SR data as soon as practicable.

Note: This rule is a civil penalty provision (see rule 9.8).

1.26  Dispute resolution—primary data holders and secondary data holders

  Where a primary data holder requests relevant information from a secondary data holder in relation to a consumer complaint or dispute with the primary data holder that relates to an SR data request, the secondary data holder must provide the information to the extent that it is reasonable to do so.

Part 2—Product data requests

2.1  Simplified outline of this Part

2.2  Making product data requests—flowchart

  The following is a flowchart for how product data requests are made:

2.3  Product data requests

 (1) A person may:

 (a) using the data holder’s product data request service; and

 (b) in accordance with the data standards;

  request a data holder to disclose some or all of the required product data or voluntary product data that it holds.

Note: In the banking sector, these rules will progressively permit product data requests to be made to a broader range of data holders, and in relation to a broader range of CDR data, according to the timetable set out in Part 6 of Schedule 3.

 In the energy sector, the AER and the Victorian agency are designated data holders for all the relevant product data under the designation instrument.

 (2) Such a request is a product data request.

Note: A fee cannot be charged for making a product data request.

2.4  Disclosing product data in response to product data request

 (1) This rule applies if a data holder has received a product data request.

 (2) The data holder may disclose any requested voluntary product data to the requester.

Note: See rule 1.7 for the meaning of “voluntary product data”.  See also:

 for the banking sector—clause 3.1 of Schedule 3;

 for the energy sector—clause 3.1 of Schedule 4.

 (2A) If the data holder discloses any requested voluntary product data to the requester, it must do so:

 (a) through its product data request service; and

 (b) in accordance with the data standards.

Note: This subrule is a civil penalty provision (see rule 9.8).

 (3) The data holder must, subject to subrule (4) and rule 2.5:

 (a) disclose the requested required product data to the requester:

 (i) through its product data request service; and

 (ii) in accordance with the data standards; and

 (b) include in the disclosed data any required product data that is:

 (i) the subject of the product data request; and

 (ii) contained:

 (A) on the data holder’s website; or

 (B) in a disclosure document that relates to the product.

Note 1: See rule 1.7 for the meaning of “required product data”.  See also:

 for the banking sector—clause 3.1 of Schedule 3;

 for the energy sector—clause 3.1 of Schedule 4.

Note 2: This subrule is a civil penalty provision (see rule 9.8).

Note 3: A fee cannot be charged for the disclosure of required product data: see section 56BU of the Act.

 (4) If:

 (a) a data holder (the first data holder) receives a request for CDR data that relates to a product (the relevant product); and

 (b) the first data holder offers the relevant product on behalf of another data holder (the second data holder), such that the second data holder is the data holder that enters into contracts with consumers to provide the relevant product;

  the first data holder is not required to disclose the requested required product data under subrule (3).

 (5) If:

 (a) the second data holder receives such a request; and

 (b) the data holders have agreed in writing that, in such a case, the first data holder will disclose the requested required product data;

  then:

 (c) subrule (3) applies as if:

 (i) it permitted the CDR data to be disclosed through the first data holder’s product data request service; and

 (ii) in the case that the first data holder disclosed CDR data in response to the request―the reference to the data holder’s website in sub‑subparagraph (3)(b)(ii)(A) was to the first data holder’s website; and

 (d) rule 2.6 applies as if it applied in relation to each of the first data holder and the second data holder.

 (6) In this rule, disclosure document includes:

 (a) a Product Disclosure Statement within the meaning of the Corporations Act 2001; or

 (b) a key facts sheet within the meaning of the National Consumer Credit Protection Act 2009; or

 (c)  a similar document that is required by law to be disclosed to a customer prior to entering into a contract with that customer.

2.5  Refusal to disclose required product data in response to product data request

 (1) Despite subrule 2.4(3), the data holder may refuse to disclose required product data in response to the request in circumstances (if any) set out in the data standards.

 (2) The data holder must inform the requester of such a refusal in accordance with the data standards.

  Civil penalty:

 (a) for an individual―$50,000; and

 (b) for a body corporate―$250,000.

2.6  Use of data disclosed pursuant to product data request

  A data holder that discloses CDR data in response to a product data request must not impose conditions, restrictions or limitations of any kind on the use of the disclosed data.

Note: This rule is a civil penalty provision (see rule 9.8).

Part 3—Consumer data requests made by eligible CDR consumers

Division 3.1—Preliminary

3.1  Simplified outline of this Part

3.2  How an eligible CDR consumer makes a consumer data request—flowchart

  The following is a flowchart for how an eligible CDR consumer makes a consumer data request under this Part:

Division 3.2—Consumer data requests made by CDR consumers

3.3  Consumer data requests made by CDR consumers

 (1) A CDR consumer may, using the data holder’s direct request service, request a data holder to disclose some or all of their CDR data.

Note: In the banking sector, these rules will progressively permit consumer data requests to be made to a broader range of data holders, and in relation to a broader range of CDR data, according to the timetable set out in Part 6 of Schedule 3.

 (2) Such a request is a consumer data request made by a CDR consumer.

Note: A fee cannot be charged for the disclosure of required consumer data: see section 56BU of the Act.

 (3) A consumer data request made under this Part is valid if it is made by a CDR consumer who is eligible to make the request.

Note:  See rule 1.7 for the meaning of “eligible”.  See also:

 for the banking sector—clause 2.1 of Schedule 3;

 for the energy sector—clause 2.1 of Schedule 4.

3.4  Disclosing consumer data in response to a valid consumer data request

 (1) This rule applies if a data holder has received a request that it reasonably believes to be a valid consumer data request made under this Part, for disclosure of CDR data of which it is the data holder.

 (2) The data holder may disclose any requested voluntary consumer data to the CDR consumer who made the request.

Note: See rule 1.7 for the meaning of “voluntary consumer data”.  See also:

 for the banking sector—clause 3.2 of Schedule 3;

 for the energy sector—clause 3.2 of Schedule 4.

 (3) The data holder must, subject to rule 3.5, disclose any requested required consumer data to the CDR consumer who made the request:

 (a) through its direct request service; and

 (b) in accordance with the data standards.

Note 1: See rule 1.7 for the meaning of “required consumer data”.  See also:

 for the banking sector—clause 3.2 of Schedule 3;

 for the energy sector—clause 3.2 of Schedule 4.

Note 2: For a request that relates to a joint account, see rules 4A.10 and 4A.15 for additional circumstances in which data relating to the joint account might not be disclosed under these rules.

Note 3: This subrule is a civil penalty provision (see rule 9.8).

Note 4: A fee cannot be charged for the disclosure of required consumer data: see section 56BU of the Act.

3.5  Refusal to disclose required consumer data in response to consumer data request

 (1) Despite subrule 3.4(3), the data holder may refuse to disclose required consumer data in response to the request:

 (a) if the data holder considers this to be necessary to prevent physical, psychological or financial harm or abuse; or

 (aa) in relation to an account that is blocked or suspended; or

 (b) in circumstances (if any) set out in the data standards.

 (2) The data holder must inform the CDR consumer of such a refusal in accordance with the data standards.

  Civil penalty:

 (a) for an individual―$50,000; and

 (b) for a body corporate―$250,000.

Part 4—Consumer data requests made by accredited persons

Division 4.1—Preliminary

4.1  Simplified outline of this Part

Division 4.2—Consumer data requests made by accredited persons to CDR participants

Subdivision 4.2.1—Preliminary

4.2  Consumer data requests made by accredited persons to CDR participants—flowchart

  The following is a flowchart for how an accredited person makes a consumer data request to a CDR participant under this Division.

Note:  The flowchart does not illustrate how consumer data requests are made using CDR representatives.

Subdivision 4.2.2—Requests to seek to collect CDR data from CDR participants

4.3  Request for accredited person to seek to collect CDR data

 (1) This rule applies if:

 (a) a CDR consumer requests an accredited person to provide goods or services to the CDR consumer or to another person; and

 (b) the accredited person needs to collect the CDR consumer’s CDR data from a CDR participant under these rules and use it in order to provide those goods or services.

 (2) The accredited person may, in accordance with Division 4.3, ask the CDR consumer to give:

 (a) a collection consent for the accredited person to collect their CDR data from the CDR participant; and

 (b) a use consent for the accredited person to use that CDR data;

  in order to provide those goods or services.

Note 1: In order to provide goods or services in accordance with the CDR consumer’s request, it might be necessary for the accredited person to request CDR data from more than 1 CDR participant.

Note 2: The CDR data may be collected and used only in accordance with the data minimisation principle: see rule 1.8.

 (2A) If a CDR consumer has given a collection consent requested under subrule (2) in relation to CDR data, and whether or not the CDR data has yet been collected, the accredited person may also ask the consumer to give a disclosure consent in relation to the CDR data.

Note 1: In order to provide goods or services in accordance with the CDR consumer’s request, it might be necessary for the accredited person to request CDR data from more than 1 CDR participant.

Note 2: The CDR data may be collected and used only in accordance with the data minimisation principle: see rule 1.8.

 (2B) If the accredited person is an affiliate and the CDR data will be collected by a sponsor at its request:

 (a) the request for a collection consent must specify that fact; and

 (b) a consent for the affiliate to collect the CDR data is taken to be consent for the sponsor to so collect it.

 (3) In giving the consents, the CDR consumer gives the accredited person a valid request to seek to collect that CDR data from the CDR participant.

Note: If the accredited person seeks to collect CDR data under this Part without a valid request, it will contravene privacy safeguard 3 (a civil penalty provision under the Act): see section 56EF of the Act.

 (4) The request ceases to be valid if the collection consent is withdrawn.

Note: So long as the use consent is not also withdrawn, the accredited person could continue to use CDR data it had already collected in order to provide the requested goods or services. However, the notification requirement of rule 4.18A would apply.

 (5) If an accredited person asks for a CDR consumer’s consents for the purpose of making a consumer data request under this Part, the accredited person must do so in accordance with Division 4.3.

Note: This subrule is a civil penalty provision (see rule 9.8).

4.3A  Request for CDR representative principal to seek to collect CDR data on behalf of CDR representative

 (1) This rule applies if:

 (a) a CDR consumer requests a CDR representative to provide goods or services to the CDR consumer or to another person; and

 (b) the CDR representative needs to:

 (i) request its CDR representative principal to collect the CDR consumer’s CDR data from a CDR participant under these rules; and

 (ii) use it in order to provide those goods or services.

 (2) The CDR representative may, in accordance with Division 4.3A, ask the CDR consumer to give:

 (a) a collection consent for the CDR representative principal to collect the CDR consumer’s CDR data from the CDR participant and disclose it to the CDR representative; and

 (b) a use consent for the CDR representative to use it in order to provide those goods or services.

Note 1: For a collection consent mentioned in paragraph (a), see subrule 1.10A(8).

 For consents mentioned in paragraph (b), see rule 1.10A as applied to a CDR representative under subrule 1.10A(5).

Note 2: In order to provide goods or services in accordance with the CDR consumer’s request, it might be necessary for the CDR representative principal to request CDR data from more than 1 CDR participant.

Note 3: The CDR data may be collected and used only in accordance with the data minimisation principle: see rule 1.8.

 (3) If a CDR consumer has given a collection consent requested under subrule (2) in relation to CDR data, and whether or not the CDR data has yet been collected, the CDR representative may also ask the consumer to give a disclosure consent in relation to the CDR data.

Note 1: In order to provide goods or services in accordance with the CDR consumer’s request, it might be necessary for the accredited person to request CDR data from more than 1 CDR participant.

Note 2: The CDR data may be collected and used only in accordance with the data minimisation principle: see rule 1.8.

 (4) In giving the consents, the CDR consumer gives the CDR representative principal a valid request to seek to collect that CDR data from the CDR participant.

Note: If an accredited person seeks to collect CDR data under this Part without a valid request, it will contravene privacy safeguard 3 (a civil penalty provision under the Act): see section 56EF of the Act.

 (5) The request ceases to be valid if the collection consent is withdrawn.

Note: So long as the use consent is not also withdrawn, the CDR representative principal could continue to disclose CDR data it had already collected to the CDR representative, and the CDR representative could use it in order to provide the requested goods or services. However, the notification requirement of rule 4.20O would apply.

4.3B  Consumer data requests by accredited persons to CDR representatives

Note: Subrule (1) allows an accredited person to make a consumer data request to a CDR representative as if the latter were also an accredited person.

 Subrule (2) allows a CDR representative that receives such a consumer data request to obtain a disclosure consent from the consumer. Under paragraphs 7.5(1)(i) and (j), the CDR representative is then able to disclose the requested data.

Application of rule 4.7A to CDR representative holding service data

 (1) Rule 4.7A applies in relation to a CDR representative that holds service data as if:

 (a) a reference to CDR data were a reference to CDR data included in the service data; and

 (b) a reference to an accredited data recipient were a reference to the CDR representative.

Application of rule 4.7B to CDR representative receiving request for service data

 (2) Rule 4.7B applies in relation to a CDR representative that receives, or reasonably anticipates receiving, a consumer data request under rule 4.7A as applied by subrule (1), as if:

 (a) a reference to an accredited data recipient were a reference to the CDR representative; and

 (b) a reference to Division 4.3 were a reference to Division 4.3A.

Subdivision 4.2.3—Consumer data requests by accredited persons to data holders

4.4  Consumer data request by accredited person to data holder

 (1) If:

 (a) a CDR consumer has given an accredited person a request under rule 4.3 or 4.3A to seek to collect CDR data from a data holder; and

 (b) the request is valid;

  the accredited person may request the data holder to disclose, to the accredited person, some or all of the CDR data that:

 (c) is the subject of the relevant collection consent and use consent; and

 (d) can be collected and used in compliance with the data minimisation principle.

Note: See rule 1.8 for the definition of the “data minimisation principle”.

 (2) Such a request is a consumer data request by an accredited person to a data holder on behalf of a CDR consumer.

Note 1: An accredited person might need to make consumer data requests to several CDR participants in order to provide the goods or services requested by the CDR consumer, and might need to make regular consumer data requests over a period of time in order to provide those goods or services.

Note 2: These rules will progressively permit consumer data requests to be made in relation to CDR data held by a broader range of data holders within the banking sector, and in relation to a broader range of CDR data, according to the timetable set out in Part 6 of Schedule 3.

 (3) An accredited person must, if it makes a consumer data request under this Subdivision, make the request:

 (a) using the data holder’s accredited person request service; and

 (b) in accordance with the data standards.

Note 1: A data holder cannot charge an accredited person a fee for making a consumer data request in relation to required consumer data.

Note 2: This subrule is a civil penalty provision (see rule 9.8).

4.5  Data holder must ask eligible CDR consumer to authorise disclosure

 (1) This rule applies if:

 (a) a data holder receives a consumer data request under rule 4.4; and

 (b) there is no current authorisation for the data holder to disclose the requested data to the person who made the request; and

 (c) the data holder reasonably believes that the request was made by an accredited person on behalf of an eligible CDR consumer.

Note:  See rule 1.7 for the meaning of “eligible”.  See also:

 for the banking sector—clause 2.1 of Schedule 3;

 for the energy sector—clause 2.1 of Schedule 4.

 (2) If the data holder is considering disclosing any of the requested voluntary consumer data, the data holder must ask the CDR consumer on whose behalf the request was made to authorise the disclosure:

 (a) in accordance with Division 4.4; and

 (b) in accordance with the data standards.

Note 1: See rule 1.7 for the meaning of “voluntary consumer data”.  See also:

 for the banking sector—clause 3.2 of Schedule 3;

 for the energy sector—clause 3.2 of Schedule 4.

Note 2: This subrule is a civil penalty provision (see rule 9.8).

 (3) The data holder must, subject to rule 4.7, ask the CDR consumer on whose behalf the request was made to authorise the disclosure of any requested required consumer data:

 (a) in accordance with Division 4.4; and

 (b) in accordance with the data standards.

Note 1:  See rule 1.7 for the meaning of “required consumer data”.  See also:

 for the banking sector—clause 3.2 of Schedule 3;

 for the energy sector—clause 3.2 of Schedule 4.

Note 2:  This subrule is a civil penalty provision (see rule 9.8).

4.6  Disclosing consumer data in response to a consumer data request

 (1) This rule applies if:

 (a) a data holder has received a consumer data request made under rule 4.4 for disclosure of CDR data; and

 (b) the CDR consumer on whose behalf the request was made has given the data holder a current authorisation to disclose some or all of that CDR data.

 (2) The data holder may, subject to rule 4.6A, disclose, to the person who made the request, any of the requested voluntary consumer data that it is authorised to disclose.

Note 1: See rule 1.7 for the meaning of “voluntary consumer data”.  See also:

 for the banking sector—clause 3.2 of Schedule 3;

 for the energy sector—clause 3.2 of Schedule 4.

Note 2: For requests that relate to joint accounts, additional requirements need to be met in order for the data holder to be authorised to disclose requested CDR data that relates to the joint account: see Part 4A.

 (3) It must do so:

 (a) through its accredited person request service; and

 (b) in accordance with the data standards.

Note: This subrule is a civil penalty provision (see rule 9.8).

 (4) The data holder must, subject to rule 4.6A and rule 4.7, disclose, to the person who made the request, the requested required consumer data that it is authorised to disclose:

 (a) through its accredited person request service; and

 (b) in accordance with the data standards.

Note 1:  See rule 1.7 for the meaning of “required consumer data”.  See also:

 for the banking sector—clause 3.2 of Schedule 3;

 for the energy sector—clause 3.2 of Schedule 4.

Note 2: For requests that relate to joint accounts, additional requirements need to be met in order for the data holder to be authorised to disclose requested CDR data that relates to the joint account: see Part 4A.

Note 3: A fee cannot be charged for the disclosure of required consumer data: see section 56BU of the Act.

Note 4: Rule 7.4 (which deals with privacy safeguard 5, paragraph 56EH(a) of the Act) requires the accredited person to update its consumer dashboard for the CDR consumer on whose behalf the request was made to indicate the CDR data that was collected.

Note 5: Rule 7.9 (which deals with privacy safeguard 10, paragraph 56EM(1)(a) of the Act) requires the data holder to update its consumer dashboard for the CDR consumer on whose behalf the request was made to indicate the CDR data that was disclosed.

Note 6: This subrule is a civil penalty provision (see rule 9.8).

4.6A  Disclosure of CDR data relating to account not permitted if not approved by account holder

  Despite subrules 4.6(2) and (4), the data holder must not disclose requested CDR data that relates to a particular account to the person who made the request if:

 (a) both of the following are satisfied:

 (i) the request was made on behalf of a secondary user of the account;

 (ii) the account holder has indicated, through their consumer dashboard, that they no longer approve CDR data relating to that account being disclosed to that accredited person in response to consumer data requests made by that secondary user; or

 (b) a provision of these rules provides that the requested CDR data must not be disclosed.

Note 1: For subparagraph (a)(ii), the account holder is able to indicate this using the functionality referred to in subparagraph 1.15(5)(b)(i).

Note 2:  For paragraph (b)—for example, see subrules 4A.10(5) and (6) in relation to joint accounts.

4.7  Refusal to disclose required consumer data in response to consumer data request

 (1) Despite subrules 4.5(3), 4.6(4) and 4.22A(1), a data holder may refuse to ask for an authorisation in relation to the relevant CDR data, to invite a CDR consumer to amend the authorisation, or to disclose required consumer data in response to the request:

 (a) if the data holder considers this to be necessary to prevent physical, psychological or financial harm or abuse; or

 (b) if the data holder has reasonable grounds to believe that disclosure of some or all of that data would adversely impact the security, integrity or stability of:

 (i) the Register of Accredited Persons; or

 (ii) the data holder’s information and communication technology systems; or

 (c) in relation to an account that is blocked or suspended; or

 (d) in circumstances (if any) set out in the data standards; or

 (e) if the disclosure of some or all of that CDR data would not be permitted because of another provision of these rules.

 (3) The data holder must inform the accredited person of such a refusal in accordance with the data standards.

  Civil penalty:

 (a) for an individual―$50,000; and

 (b) for a body corporate―$250,000.

Subdivision 4.2.4—Consumer data requests by accredited persons to accredited data recipients

4.7A  Consumer data request by accredited person to accredited data recipient

 (1) If:

 (a) a CDR consumer has given an accredited person a request under rule 4.3 or 4.3A to seek to collect CDR data from an accredited data recipient; and

 (b) the request is valid;

  the accredited person may request the accredited data recipient to disclose, to the accredited person, some or all of the CDR data that:

 (c) is the subject of the relevant collection consent and use consent; and

 (d) can be collected and used in compliance with the data minimisation principle.

Note: See rule 1.8 for the definition of the “data minimisation principle”.

 (2) Such a request is a consumer data request by an accredited person to an accredited data recipient on behalf of a CDR consumer.

Note: An accredited person might need to make consumer data requests to several CDR participants in order to provide the goods or services requested by the CDR consumer, and might need to make regular consumer data requests over a period of time in order to provide those goods or services.

4.7B  Accredited data recipient may ask eligible CDR consumer for AP disclosure consent

 (1) This rule applies if:

 (a) an accredited data recipient receives, or reasonably anticipates receiving, a consumer data request under rule 4.7A; and

 (b) there is no current AP disclosure consent for the accredited data recipient to disclose the requested data to the person who made the request; and

 (c) the accredited data recipient reasonably believes that the request was or will be made by an accredited person on behalf of an eligible CDR consumer.

Note: See rule 1.7 for the meaning of “eligible”.  See also:

 for the banking sector—clause 2.1 of Schedule 3;

 for the energy sector—clause 2.1 of Schedule 4.

 (2) The accredited data recipient may, in accordance with Division 4.3, ask the CDR consumer for such an AP disclosure consent.

Note: If the CDR consumer consents to the disclosure, the accredited data recipient is authorised (but not required) to disclose the requested CDR data to the accredited person: see paragraph 7.5(1)(h) and rules 7.6, 7.7 and 7.8.

 (3) If an accredited data recipient asks for an AP disclosure consent for the purposes of subrule (2), it must do so in accordance with Division 4.3.

Note: This subrule is a civil penalty provision (see rule 9.8).

Division 4.3—Giving and amending consents—accredited persons

Subdivision 4.3.1—Preliminary

4.8  Purpose of Division

  This Division deals with:

 (a) giving collection consents, use consents and disclosure consents to accredited persons; and

 (b) amending such consents; and

 (c) related matters.

Note: This Division does not cover collection consents for accredited persons to collect CDR data on behalf of CDR representatives; since those consents are given to the CDR representatives, they are covered by Division 4.3A.

4.9  Object

  The object of this Division is to ensure that a consent is:

 (a) voluntary; and

 (b) express; and

 (c) informed; and

 (d) specific as to purpose; and

 (e) time limited; and

 (f) easily withdrawn.

Subdivision 4.3.2—Giving consents

Note: Under rule 4.3, if an accredited person asks a CDR consumer for their consent to collect and use their CDR data, it must do so in accordance with this Division, and in particular, rules 4.10, 4.11 and 4.12. A failure to do so could contravene one or more civil penalty provisions: see section 56EF of the Act and rule 4.3.

4.10  Requirements relating to accredited person’s processes for seeking consent

 (1) An accredited person’s processes for asking a CDR consumer to give or amend a consent:

 (a) must:

 (i) accord with any relevant data standards; and

 (ii) having regard to any consumer experience guidelines developed by the Data Standards Body, be as easy to understand as practicable, including by use of concise language and, where appropriate, visual aids; and

 (b) must not:

 (i) include or refer to the accredited person’s CDR policy or other documents so as to reduce comprehensibility; or

 (ii) bundle consents with other directions, permissions, consents or agreements.

4.11  Asking CDR consumer to give consent

 (1) When asking a CDR consumer to give a consent, an accredited person must:

 (a) allow the CDR consumer to choose the types of CDR data to which the consent will apply by enabling the CDR consumer to actively select or otherwise clearly indicate:

 (i) in the case of a collection consent or a disclosure consent―the particular types of CDR data to which the consent will apply; and

 (ii) in the case of a use consent―the specific uses of collected data to which they are consenting; and

 (b) allow the CDR consumer to choose the period of the collection consent, use consent, or disclosure consent (as appropriate) by enabling the CDR consumer to actively select or otherwise clearly indicate whether the consent would apply:

 (i)  on a single occasion; or

 (ii)  over a specified period of time; and

 (ba) in the case of a disclosure consent―allow the CDR consumer to select the person to whom the CDR data may be disclosed; and

 (bb) where the accredited person proposes, or is offering, to deal with a person in their capacity as a CDR business consumer in relation to a consent of a kind mentioned in paragraph 1.10A(10)(a)―invite the CDR business consumer to provide the business consumer statement; and

 (c) ask for the CDR consumer’s express consent to the choices referred to in paragraphs (a), (b) and (ba) for each relevant category of consents; and

 (d) if the accredited person intends to charge a fee for disclosure of CDR data, or pass on to the CDR consumer a fee charged by a data holder or accredited data recipient for disclosure of CDR data:

 (i) clearly distinguish between the CDR data for which a fee will, and will not, be charged or passed on; and

 (ii) allow the CDR consumer to actively select or otherwise clearly indicate whether they consent to the collection or disclosure, as appropriate, of the CDR data for which a fee will be charged or passed on; and

 (e) allow the CDR consumer to make an election in relation to deletion of redundant data in accordance with rule 4.16.

Example: For a collection consent, an accredited person could present the CDR consumer with a set of un‑filled boxes corresponding to different types of data, and permit the CDR consumer to select the boxes that correspond to the data they consent to the accredited person collecting.

Note 1: An accredited person cannot infer consent, or seek to rely on an implied consent.

Note 2: For paragraph (b), the specified period may not be more than 12 months (or 7 years for certain consents by a CDR business consumer): see subrule 4.12(1). After the end of the period, redundant data would need to be dealt with in accordance with subsection 56EO(2) of the Act (privacy safeguard 12) and rules 7.12 and 7.13.

Note 3:  For paragraph (d), a data holder could charge a fee for disclosure of voluntary consumer data, while an accredited data recipient could charge a fee for the disclosure of any CDR data.

 (2) The accredited person must not present pre‑selected options to the CDR consumer for the purposes of subrule (1).

Information presented to CDR consumer when asking for consent

 (3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information:

 (a) its name;

 (b) its accreditation number;

 (c) in the case of a collection consent or a use consent―how the collection or use (as applicable) indicated in accordance with subrule (1) complies with the data minimisation principle, including how:

 (i) in the case of a collection consent―that collection is reasonably needed, and relates to no longer a time period than is reasonably needed; and

 (ii) in the case of a use consent―that use would not go beyond what is reasonably needed;

  in order to provide the requested goods or services to the CDR consumer or make the other uses consented to;

 (ca) in the case of an insight disclosure consent—an explanation of the CDR insight that will make clear to the CDR consumer what the CDR insight would reveal or describe;

 (d) if the accredited person intends passing a fee on, or charging a fee, to the CDR consumer as described in paragraph (1)(d)―the following information:

 (i) the amount of the fee;

 (ii) the consequences if the CDR consumer does not consent to the collection, or to the disclosure, of that data;

 (e) if the accredited person is seeking a de‑identification consent—the additional information specified in rule 4.15;

 (f) if the CDR data may be disclosed to, or collected by, a direct or indirect OSP (including one that is based overseas) of the accredited person:

 (i) a statement of that fact; and

 (ii) a link to the accredited person’s CDR policy; and

 (iii) a statement that the consumer can obtain further information about such disclosures from the policy if desired;

 (g) the following information about withdrawal of consents:

 (i) a statement that, at any time, the consent can be withdrawn;

 (ii) instructions for how the consent can be withdrawn;

 (iii) a statement indicating the consequences (if any) to the CDR consumer if they withdraw the consent;

 (h) the following information about redundant data:

 (i) a statement, in accordance with rule 4.17, regarding the accredited person’s intended treatment of redundant data;

 (ii) a statement outlining the CDR consumer’s right to elect that their redundant data be deleted;