56EDPrivacy safeguard 1—open and transparent management of CDR data

56ED Privacy safeguard 1—open and transparent management of CDR data

Object

(1) The object of this section is to ensure that each person (a CDR entity) who:

(a) is a data holder of CDR data; or

(b) is an accredited person who is or who may become an accredited data recipient of CDR data; or

(c) is a designated gateway for CDR data; or

(d) as an action service provider for a type of CDR action, has been or may be disclosed CDR data under the consumer data rules;

manages the CDR data in an open and transparent way.

Compliance with this Part etc.

(2) The CDR entity must take such steps as are reasonable in the circumstances to implement practices, procedures and systems that:

(a) will ensure that the CDR entity complies with this Part and the consumer data rules; and

(b) will enable the CDR entity to deal with inquiries or complaints from a CDR consumer for the CDR data about the CDR entity’s compliance with this Part or the consumer data rules.

Policy about the management of CDR data

(3) The CDR entity must have and maintain a clearly expressed and up‑to‑date policy that:

(a) is about the CDR entity’s management of CDR data; and

(b) is in a form approved in accordance with the consumer data rules; and

(c) contains the information required by subsections (4), (5), (6) and (6A) (as applicable).

Note: This subsection is a civil penalty provision (see section 56EU).

(4) If the CDR entity is a data holder of any CDR data, the CDR entity’s policy must contain the following information:

(a) how a CDR consumer for the CDR data may access the CDR data and seek the correction of the CDR data;

(b) how a CDR consumer for the CDR data may complain about a failure of the CDR entity to comply with this Part or the consumer data rules, and how the CDR entity will deal with such a complaint.

(5) If the CDR entity is an accredited person who is or who may become an accredited data recipient of any CDR data, the CDR entity’s policy must contain the following information:

(a) the classes of CDR data that is or may become held by (or on behalf of) the CDR entity as an accredited data recipient, and how such CDR data is held or is to be held;

(b) the purposes for which the CDR entity may collect, hold, use or disclose such CDR data with the consent of a CDR consumer for the CDR data;

(c) how a CDR consumer for such CDR data may access the CDR data and seek the correction of the CDR data;

(d) how a CDR consumer for such CDR data may complain about a failure of the CDR entity to comply with this Part or the consumer data rules, and how the CDR entity will deal with such a complaint;