4.1Simplified outline of this Part

4.1 Simplified outline of this Part

This Part deals with consumer data requests that are made to CDR participants by accredited persons on behalf of CDR consumers. Such requests, if made to a data holder, are made using the data holder’s accredited person request service.

In order for such a request to be made, the CDR consumer must have first asked the accredited person, or a CDR representative of the accredited person, to provide goods or services to the CDR consumer or to another person, where provision of those goods or services requires the use of the CDR consumer’s CDR data.

Before making a consumer data request on behalf of a CDR consumer, the consumer must first have consented to the accredited person collecting specified CDR data, and either using it to provide the requested goods or services, or providing it to the CDR representative for the CDR representative to provide the goods or services.

Subject to certain limitations, the requested data can be any CDR data that relates to the CDR consumer.

Collection, use and disclosure of CDR data under this Part is limited by the data minimisation principle, under which:

• no more data may be collected than is reasonably needed in order to provide the requested goods or services; and

• the collected data may be used or disclosed only as reasonably needed in order to provide the requested goods or services or as otherwise consented to by the CDR consumer.

A request may be for the CDR consumer’s required consumer data, their voluntary consumer data, or both. The sector Schedules to these rules:

• provide for what is required consumer data and voluntary consumer data for the particular designated sector; and

• set out the circumstances in which CDR consumers are eligible in relation to a request for their CDR data in that designated sector.

Consumer data requests made to data holders

Subject to exceptions outlined in this Part, if a request is made to a data holder, the data holder:

• must seek the CDR consumer’s authorisation to disclose required consumer data; and

• must seek the CDR consumer’s authorisation to disclose any voluntary consumer data that it intends to disclose.

The data holder then must disclose, to the accredited person, the required consumer data it is authorised to disclose, and may (but is not required to) disclose the voluntary consumer data it is authorised to disclose. The data is disclosed in machine‑readable form and in accordance with the data standards.

Consumer data requests made to accredited data recipients

If a request is made to an accredited data recipient, the accredited data recipient: