Privacy safeguard 10—notifying of the disclosure of CDR data
56EM Privacy safeguard 10—notifying of the disclosure of CDR data
Disclosures by data holders
If a data holder of CDR data is required or authorised under the consumer data rules to disclose the CDR data to a person, the data holder must:
take the steps specified in the consumer data rules to notify CDR consumers for the CDR data of the disclosure; and
ensure that this notification:
is given to those of the CDR consumers (if there are more than one) that the consumer data rules require to be notified; and
covers the matters specified in those rules; and
is given at or before the time specified in those rules.
This subsection is a civil penalty provision (see section 56EU).
Disclosures by accredited data recipients
If an accredited data recipient of CDR data discloses the CDR data, the accredited data recipient must:
take the steps specified in the consumer data rules to notify CDR consumers for the CDR data of the disclosure; and
ensure that this notification:
is given to those of the CDR consumers (if there are more than one) that the consumer data rules require to be notified; and
covers the matters specified in those rules; and
is given at or before the time specified in those rules.
This subsection is a civil penalty provision (see section 56EU).
Disclosures to designated gateways
To avoid doubt, subsection (1) or (2) applies even if the disclosure of the CDR data is to a designated gateway for the CDR data as required or authorised under the consumer data rules.
The designated gateway may be subject to a similar notification requirement under the consumer data rules (see paragraph 56BG(1)(c)).
Disclosures by action service providers
If a person as an action service provider for a type of CDR action is required or authorised under the consumer data rules to disclose CDR data to another person, the action service provider must:
take the steps specified in the consumer data rules to notify CDR consumers for the CDR data of the disclosure; and
ensure that this notification:
is given to those of the CDR consumers (if there are more than one) that the consumer data rules require to be notified; and
covers the matters specified in those rules; and
is given at or before the time specified in those rules.
This subsection is a civil penalty provision (see section 56EU).
The statute text is free to read above. View subscription options to unlock the case-law research tools for each provision.