56ETInvestigating breaches of the privacy safeguards etc.

56ET Investigating breaches of the privacy safeguards etc.

Breaches to which this section applies

(1) This section applies to a breach (a privacy safeguard breach) of any of the following:

(a) one or more of the privacy safeguards;

(b) the consumer data rules to the extent that those rules relate:

(i) to one or more of the privacy safeguards; or

(ii) to the privacy or confidentiality of CDR data;

(c) section 26WH, 26WK or 26WL or subsection 26WR(10) of the Privacy Act 1988, as they apply because of section 56ES of this Act;

in relation to the CDR data of:

(d) a CDR consumer who is an individual; or

(e) a small business (within the meaning of the Privacy Act 1988) carried on by a CDR consumer for the CDR data.

(2) This section also applies to a breach of section 56ED (privacy safeguard 1).

Object

(3) The object of this section is for Part V of the Privacy Act 1988 to apply to an act or practice:

(a) of a CDR participant, designated gateway, accredited person or action service provider for a type of CDR action; and

(b) that may be:

(i) a privacy safeguard breach relating to CDR data covered by subsection (1); or

(ii) a breach of section 56ED (privacy safeguard 1);

in a corresponding way to the way that Part applies to an act or practice of an organisation, person or entity that may be an interference with the privacy of an individual or a breach of Australian Privacy Principle 1.

Note: That Part is about investigations of interferences with privacy etc. The Information Commissioner also has the power, under Division 1AC of Part VIB of the Privacy Act 1988, to investigate contraventions of civil penalty provisions in Division 5 of Part IVD of this Act.

Extended application of Part V of the Privacy Act 1988

(4) Part V of the Privacy Act 1988, and any other provision of that Act that relates to that Part, also apply in relation to:

(a) a CDR participant for CDR data; or

(b) a designated gateway for CDR data; or

(c) an accredited person who may become an accredited data recipient of CDR data; or

(d) an action service provider for a type of CDR action, who has been or may be disclosed CDR data under the consumer data rules;

as if the substitutions in the following table, and the modifications in subsection (5), were made.

• Substitutions to be made
• Item Subject to subsection (6), for a reference in Part V to … … substitute a reference to …