28At the end of rule 2.4

28  At the end of rule 2.4

Add:

 (4) If:

 (a) a data holder (the first data holder) receives a request for CDR data that relates to a product (the relevant product); and

 (b) the first data holder offers the relevant product on behalf of another data holder (the second data holder), such that the second data holder is the data holder that enters into contracts with consumers to provide the relevant product;

  the first data holder is not required to disclose the requested required product data under subrule (3).

 (5) If:

 (a) the second data holder receives such a request; and

 (b) the data holders have agreed in writing that, in such a case, the first data holder will disclose the requested required product data;

  then:

 (c) subrule (3) applies as if:

 (i) it permitted the CDR data to be disclosed through the first data holder’s product data request service; and

 (ii) in the case that the first data holder disclosed CDR data in response to the request―the reference to the data holder’s website in sub‑subparagraph (3)(b)(ii)(A) was to the first data holder’s website; and

 (d) rule 2.6 applies as if it applied in relation to each of the first data holder and the second data holder.

 (6) In this rule, disclosure document includes:

 (a) a Product Disclosure Statement within the meaning of the Corporations Act 2001; or

 (b) a key facts sheet within the meaning of the National Consumer Credit Protection Act 2009; or

 (c)  a similar document that is required by law to be disclosed to a customer prior to entering into a contract with that customer.