Competition and Consumer Act 2010

Without limiting paragraph 56BB(a), the consumer data rules may include the following rules:

requirements on a CDR participant for CDR data to disclose all or part of the CDR data, in response to a valid request by a CDR consumer for the CDR data, to:

the CDR consumer for use as the CDR consumer sees fit; or

an accredited person for use subject to the privacy safeguards; or

a data holder of other CDR data;

rules about:

how a CDR consumer for the CDR data may make a valid request of the kind described in paragraph (a); and

what must be included in a request for it to be valid, what disclosures or other matters a valid request may cover, and when a request ceases to be a valid request;

requirements on a person (other than a CDR consumer for the CDR data) to satisfy in order to be disclosed the CDR data in the way described in paragraph (a).

The requirements described in paragraph (a) could, for example, include a requirement that the disclosure be in accordance with the relevant data standards.

A fee may be charged for such a disclosure if the CDR data is chargeable CDR data, unless section 56BU provides otherwise.

Without limiting paragraph 56BB(a), the consumer data rules may include the following rules:

rules authorising a CDR participant for CDR data to disclose all or part of the CDR data to a person in accordance with a valid consent of a CDR consumer for the CDR data;

rules authorising a person to use CDR data in accordance with a valid consent of a CDR consumer for the CDR data;

rules about:

how a CDR consumer for the CDR data may make a valid consent of the kind described in paragraph (a) or (b); and

what must be included in a consent for it to be valid, what disclosures, uses or other matters a valid consent may cover, and when a consent ceases to be a valid consent.

Fees may be charged for these disclosures or uses.

Without limiting paragraph 56BB(a), the consumer data rules may include the following rules relating to CDR data for which there are one or more CDR consumers:

rules relating to the privacy safeguards;

other rules relating to the disclosure, collection, use, accuracy, storage or security of the CDR data that affect:

an accredited person; or

a CDR participant, or CDR consumer, for the CDR data;

other rules relating to the deletion of the CDR data that affect:

an accredited person; or

an accredited data recipient of the CDR data; or

a CDR consumer for the CDR data.

Subsection 56BD(3) limits how such rules can affect a data holder.

The rules may deal with similar or additional matters to those in the privacy safeguards. When doing so, the rules will need to be consistent with those safeguards (see subsections 56EC(1) and (2)).

The rules must include a requirement on an accredited data recipient to delete all or part of the CDR data in response to a valid request by a CDR consumer for the CDR data (see section 56BAA).