Competition and Consumer Act 2010

The object of this section is for Part IIIC of the Privacy Act 1988 to apply to an accredited data recipient, or designated gateway, that holds a CDR consumer’s CDR data in a corresponding way to the way that Part applies to an entity that holds an individual’s personal information.

That Part is about notification of eligible data breaches.

Part IIIC of the Privacy Act 1988, and any other provision of that Act that relates to that Part, also apply in relation to:

an accredited data recipient of CDR data; or

a designated gateway for CDR data;

When CDR data and the other terms in the last column of the table appear in this notional version of Part IIIC, they have the same meanings as in this Act.

For the purposes of subsection (2), assume that:

sections 26WB to 26WD of the Privacy Act 1988 were not enacted; and

subsection 26WE(1) of that Act were replaced with the following:

This section applies if:

CDR data of one or more CDR consumers is held by (or on behalf of) either of the following entities (the CDR entity):

an accredited data recipient of the CDR data;

a designated gateway for the CDR data; and

section 56EO (about privacy safeguard 12) of the Competition and Consumer Act 2010 applies to the CDR entity in relation to the CDR data.”.

For the purposes of the table in subsection (2):

for item 1 of the table, disregard the following references to information in Part IIIC of the Privacy Act 1988:

the last reference in section 26WA;

the last reference in paragraph 26WG(h);

the reference in the note to section 26WG;

all references in Division 4 of Part IIIC other than the reference in paragraph 26WU(2)(e); and

for item 2 of the table, disregard each reference to entity in paragraphs 26WF(1)(f), (2)(f), (3)(f), (4)(f) and (5)(f) of the Privacy Act 1988.