56BGARules about initiating CDR actions

56BGA Rules about initiating CDR actions

Instructions may be given to initiate types of CDR actions

(1) Without limiting paragraph 56BB(ca), the consumer data rules may include the following rules:

(a) requirements on an accredited action initiator for a type of CDR action relating to giving a valid instruction:

(i) for the performance of a CDR action of that type; and

(ii) to an action service provider for a CDR action of that type; and

(iii) on behalf of a CDR consumer for the CDR action, and in response to that consumer’s valid request; and

(iv) after a series of specified kinds of interactions between that initiator, provider, consumer or other persons (whether involving all or any 2 of them);

(b) rules about how an instruction must be prepared for it to be a valid instruction of the kind described in paragraph (a), what matters a valid instruction may cover, and when an instruction ceases to be a valid instruction;

(c) rules about:

(i) how a CDR consumer for a CDR action may make a valid request of the kind described in subparagraph (a)(iii); and

(ii) what must be included in a request for it to be valid, what matters a valid request may cover, and when a request ceases to be a valid request;

(d) for an accredited action initiator for a type of CDR action who is acting as described in paragraph (a) to give a valid instruction on behalf of a CDR consumer for a CDR action—rules authorising the initiator to use or disclose information relating to the consumer that:

(i) is disclosed to the initiator; or

(ii) is otherwise held by the initiator;

to prepare or give the valid instruction;

(e) requirements on an action service provider for a type of CDR action relating to how the provider processes a valid instruction of the kind described in paragraph (a);

(f) rules relating to the interactions described in subparagraph (a)(iv);

(g) rules relating to the privacy safeguards in relation to an instruction or request relating to a CDR action;

(h) rules relating to information that is not CDR data, but that relates to a CDR action.

Note 1: The requirements described in paragraph (a) could, for example, include a requirement that the instruction be prepared and given in accordance with the relevant data standards.

Note 2: The rules may deal with similar or additional matters to those in the privacy safeguards. When doing so, the rules will need to be consistent with those safeguards (see subsections 56EC(1) and (2)).

Allowing providers to charge fees at the instruction layer