32Rules 4.3 and 4.4

32  Rules 4.3 and 4.4

Repeal the rules, substitute:

4.3  Request for accredited person to seek to collect CDR data

 (a) a CDR consumer requests an accredited person to provide goods or services to the CDR consumer or to another person; and

 (b) the accredited person needs to collect the CDR consumer’s CDR data from a CDR participant under these rules and use it in order to provide those goods or services.

 (2) The accredited person may, in accordance with Division 4.3, ask the CDR consumer to give:

 (a) a collection consent for the accredited person to collect their CDR data from the CDR participant; and

 (b) a use consent for the accredited person to use that CDR data;

  in order to provide those goods or services.

Note 1: In order to provide goods or services in accordance with the CDR consumer’s request, it might be necessary for the accredited person to request CDR data from more than 1 CDR participant.

Note 2: The accredited person is able to collect and use CDR data only in accordance with the data minimisation principle: see rule 1.8.

 (3) In giving the consents, the CDR consumer gives the accredited person a valid request to seek to collect that CDR data from the CDR participant.

Note: If the accredited person seeks to collect CDR data under this Part without a valid request, it will contravene privacy safeguard 3 (a civil penalty provision under the Act): see section 56EF of the Act.

 (4) The request ceases to be valid if the collection consent is withdrawn.

Note: So long as the use consent is not also withdrawn, the accredited person could continue to use CDR data it had already collected in order to provide the requested goods or services. However, the notification requirement of rule 4.18A would apply.

 (5) If an accredited person asks for a CDR consumer’s consents for the purpose of making a consumer data request under this Part, the accredited person must do so in accordance with Division 4.3.

Subdivision 4.2.3—Consumer data requests by accredited persons to data holders

4.4  Consumer data request by accredited person to data holder

 (1) If:

 (a) a CDR consumer has given an accredited person a request under rule 4.3 to seek to collect CDR data from a data holder; and

 (b) the request is valid;

  the accredited person may request the data holder to disclose, to the accredited person, some or all of the CDR data that:

 (c) is the subject of the relevant collection consent and use consent; and

 (d) it is able to collect and use in compliance with the data minimisation principle.