56EIPrivacy safeguard 6—use or disclosure of CDR data by accredited data recipients or designated gateways

56EI Privacy safeguard 6—use or disclosure of CDR data by accredited data recipients or designated gateways

(1) An accredited data recipient of CDR data must not use or disclose it unless:

(a) in the case of a disclosure—the disclosure is required under the consumer data rules in response to a valid request from a CDR consumer for the CDR data; or

(b) the use or disclosure is otherwise required, or authorised, under the consumer data rules; or

(c) the use or disclosure is required or authorised by or under:

(i) another Australian law; or

(ii) a court/tribunal order;

and the accredited data recipient makes a written note of the use or disclosure.

Note 1: This subsection is a civil penalty provision (see section 56EU).

Note 2: The valid request referred to in paragraph (a) could be given through a designated gateway (see section 56BG).

Note 3: The Australian Privacy Principles will not apply for subparagraph (c)(i) (see paragraph 56EC(4)(a)).

(2) A designated gateway for CDR data must not use or disclose it unless:

(a) in the case of a disclosure—the disclosure is required under the consumer data rules; or

(b) the use or disclosure is authorised under the consumer data rules; or

(c) the use or disclosure is required or authorised by or under:

(i) another Australian law; or

(ii) a court/tribunal order;

and the designated gateway makes a written note of the use or disclosure in accordance with the consumer data rules.

Note 1: This subsection is a civil penalty provision (see section 56EU).

Note 2: Australian Privacy Principle 6 will not apply for subparagraph (c)(i) (see paragraph 56EC(4)(d)).

(3) Neither subsection (1) nor (2) applies to the use or disclosure of CDR data for the purposes of direct marketing.

Note: Section 56EJ deals with the use or disclosure of CDR data for the purposes of direct marketing.