69Subrules 9.3(1) and (2)

69  Subrules 9.3(1) and (2)

Repeal the subrules, substitute:

Records to be kept and maintained—data holder

 (1) A data holder must keep and maintain records that record and explain the following:

 (a) authorisations given by CDR consumers to disclose CDR data;

 (b) amendments to or withdrawals of authorisations to disclose CDR data;

 (c) notifications of withdrawals of consents to collect CDR data;

 (d) disclosures of CDR data made in response to consumer data requests;

 (da) any written agreement of a kind referred to in subrule 2.4(5) the data holder has entered into;

  (e) instances where the data holder has refused to disclose requested CDR data and the rule or data standard relied upon to refuse to disclose the CDR data;

 (f) CDR complaint data;

 (g) the processes by which the data holder asks CDR consumers for their authorisation to disclose CDR data and for an amendment to their authorisation, including a video of each process.

Records to be kept and maintained—accredited data recipient

 (2) An accredited data recipient must keep and maintain records that record and explain the following:

 (a) all consents, including, if applicable, the uses of the CDR data that the CDR consumer has consented to under any use consents;

 (b) amendments to or withdrawals of consents by CDR consumers;

 (c) notifications of withdrawals of authorisations received from data holders;

 (d) CDR complaint data;

 (e) collections of CDR data under these rules;

 (ea) disclosures of CDR data to accredited persons under these rules, and the accredited persons to which any CDR data was disclosed;

 (f) elections to delete and withdrawals of those elections;

 (g) the use of CDR data by the accredited data recipient;

 (h) the processes by which the accredited data recipient asks CDR consumers for their consent and for an amendment to their consent, including a video of each process;

 (i) if applicable:

 (i) arrangements that may result in CDR data being collected by or disclosed to outsourced service providers, including copies of agreements with outsourced service providers; and

 (ii) the use and management of CDR data by those providers;

 (j) if CDR data was de-identified in accordance with a consent referred to in paragraph 4.11(3)(e):

 (i) how the data was de‑identified; and

 (ii) how the accredited data recipient used the de‑identified data; and

 (iii) if the accredited data recipient disclosed (by sale or otherwise) the de‑identified data to another person as referred to in paragraph 4.15(b):