Competition and Consumer Act 2010

If:

an accredited data recipient of CDR data proposes to disclose the CDR data; and

the recipient (the new recipient) of the proposed disclosure:

is not in Australia or an external Territory; and

is not a CDR consumer for the CDR data;

the new recipient is an accredited person; or

the accredited data recipient takes reasonable steps to ensure that any act or omission by (or on behalf of) the new recipient will not, after taking into account subsection (3), contravene:

subsection 56ED(3); or

another privacy safeguard penalty provision in relation to the CDR data; or

the accredited data recipient reasonably believes:

that the new recipient is subject to a law, or binding scheme, that provides substantially similar protection for the CDR data as the privacy safeguards provide in relation to accredited data recipients; and

that a CDR consumer for the CDR data will be able to enforce those protections provided by that law or binding scheme; or

the conditions specified in the consumer data rules are met.

This subsection is a civil penalty provision (see section 56EU).

This subsection applies in addition to the disclosure restrictions in sections 56EI, 56EJ and 56EL.

A similar disclosure by a data holder of the CDR data that is required under the consumer data rules will be covered by Australian Privacy Principle 8 if the CDR data is personal information about an individual.

If:

the accredited data recipient of the CDR data makes the disclosure to the new recipient; and

none of paragraphs (1)(c), (e) and (f) apply in relation to the disclosure to the new recipient; and

an act or omission by (or on behalf of) the new recipient, after taking into account subsection (3), contravenes:

subsection 56ED(3); or

another privacy safeguard penalty provision in relation to the CDR data;

For the purposes of paragraphs (1)(d) and (2)(c), assume that the privacy safeguards apply to the new recipient as if the new recipient were an accredited data recipient for the CDR data.