to enable consumers in certain sectors of the Australian economy to require information relating to themselves in those sectors to be disclosed safely, efficiently and conveniently:

to themselves for use as they see fit; or

to accredited persons for use subject to privacy safeguards; and

to enable any person to efficiently and conveniently access information in those sectors that:

is about goods (such as products) or services; and

does not relate to any identifiable, or reasonably identifiable, consumers; and

as a result of paragraphs (a) and (b), to create more choice and competition, or to otherwise promote the public interest.

enable consumers in certain sectors of the Australian economy to require information relating to themselves in those sectors to be disclosed to themselves or to accredited persons; and

enable any person to be disclosed information in those sectors that is about goods (such as products) or services, and does not relate to any identifiable, or reasonably identifiable, consumers; and

may require these kinds of disclosures, and other things, to be done in accordance with data standards.

(a) classes of information (the designated information); and

persons who hold one or more specified classes of the designated information (or on whose behalf such information is held); and

(c) the earliest day (the earliest holding day) applicable to the sector for beginning to hold the designated information; and

each of the classes of information within the designated information for which a person may charge a fee if:

the person is required under the consumer data rules to disclose information within that class to another person in specified circumstances; or

another person uses information within that class in specified circumstances as the result of a disclosure required of the first-mentioned person under the consumer data rules; and

if the sector is to have one or more gateways:

the particular persons who are gateways; and

for each of those persons, the classes of information within the designated information for which the person is a gateway.

(a) may be specified by class (see subsection 13(3) of the Legislation Act 2003); and

will be holders of the information, rather than the consumers to whom the information relates; and

(c) may not be the only holders of the information who can be required to disclose it under the consumer data rules (see data holder)).section 56AJ (about the meaning of

has at any time been generated or collected wholly or partly in Australia or the external Territories, and:

has been so generated or collected by (or on behalf of) one or more Australian persons; or

relates to one or more Australian persons (other than the persons who so generated or collected it); or

relates to goods or services supplied, or offered for supply, to one or more Australian persons; or

has only ever been generated and collected outside of Australia and the external Territories, and:

has been so generated or collected by (or on behalf of) one or more Australian persons; and

relates to one or more Australian persons (other than the persons who so generated or collected it), or relates to goods or services supplied, or offered for supply, to one or more Australian persons.

the likely effect of making the instrument on:

the interests of consumers; and

the efficiency of relevant markets; and

the privacy or confidentiality of consumers’ information; and

promoting competition; and

promoting data-driven innovation; and

any intellectual property in the information to be covered by the instrument; and

the public interest;

the likely regulatory impact of allowing the consumer data rules to impose requirements relating to the information to be covered by the instrument;

the following matters when considering whether to specify a class of information, as described in paragraph 56AC(2)(d), in the instrument:

whether not specifying that class could result in an acquisition of property (within the meaning of paragraph 51(xxxi) of the Constitution);

whether holders of information within that class currently charge a fee for disclosing such information;

whether the incentive to generate, collect, hold or maintain information within that class would be reduced if that class were not so specified;

the marginal cost of the disclosures required under the consumer data rules of information within that class;

whether one or more gateways need to be specified in the instrument in order to facilitate access to the information to be covered by the instrument;

any other matters the Minister considers relevant.

consult each of the following about the matters in paragraphs (1)(a) to (e) of this section:

the Commission;

any person or body prescribed by the regulations; and

wait at least 60 days after the day the Commission publishes its report arising from that consultation (see section 56AE).

analyse the matters in paragraphs 56AD(1)(a) to (e) in relation to the instrument; and

consult the public about those matters in relation to the instrument:

for at least 28 days; and

in one or more ways that includes making information available on the Commission’s website and inviting the public to comment; and

consult each of the following about those matters in relation to the instrument:

the Information Commissioner;

the person or body (if any) that the Commission believes to be the primary regulator of the sector that the instrument would designate;

any person or body prescribed by the regulations; and

report to the Minister about that analysis and consultation.

analyse the likely effect of making the instrument on the privacy or confidentiality of consumers’ information; and

report to the Minister about that analysis.

(a) have regard to the need to prevent the matters in subsection 33(2) of the Privacy Act 1988; and

try to achieve an appropriate balance between the need to prevent those matters and the desirability of ensuring that interested persons are sufficiently informed of the Information Commissioner’s analysis in the report.

designating a particular sector of the Australian economy; or

varying or revoking an instrument designating a sector under that subsection.

analyse the matters in paragraphs 56AD(1)(a) to (d) in relation to the proposed instrument;

consult the public about those matters in relation to the proposed instrument:

for at least 28 days; and

in one or more ways that includes making information available on the Commission’s website and inviting the public to comment;

consult each of the persons or bodies covered by paragraph 56AE(1)(c) about those matters in relation to the proposed instrument;

report to the Minister about that analysis and consultation;

publish the report on the Commission’s website.

is within a class of information specified, as described in paragraph 56AC(2)(a), in an instrument designating a sector under subsection 56AC(2); or

is not covered by paragraph (a) of this subsection, but is wholly or partly derived from information covered by:

paragraph (a) of this subsection; or

a previous application of this paragraph.

the CDR data relates to the person because:

(i) of the supply of a good or service to the person or to one or more of the person’s associates (Income Tax Assessment Act 1936); orwithin the meaning of section 318 of the

of circumstances of a kind prescribed by the regulations; and

the CDR data is held by another person who:

is a data holder of the CDR data; or

is an accredited data recipient of the CDR data; or

is holding the CDR data on behalf of a person mentioned in subparagraph (i) or (ii); and

the person is identifiable, or reasonably identifiable, from:

the CDR data; or

other information held by the other person referred to in paragraph (b); and

none of the conditions (if any) prescribed by the regulations apply to the first-mentioned person in relation to the CDR data.

the CDR data:

(i) is information within a class of information specified, as described in paragraph 56AC(2)(a), in an instrument designating a sector under subsection 56AC(2) (the designation instrument); or

is directly or indirectly derived from information covered by subparagraph (i); and

the CDR data is held by (or on behalf of) the person, and began to be so held on or after the earliest holding day specified in the designation instrument; and

the person is not a designated gateway for the CDR data; and

subsection (2), (3) or (4) applies to the person and the CDR data.

will not be a data holder of the CDR data; and

will not be required to disclose it under the consumer data rules.

the person, or a class of persons to which the person belongs, is specified, as described in paragraph 56AC(2)(b), in the designation instrument as holding a class of information to which the CDR data belongs; and

neither the CDR data, nor any other CDR data from which it was directly or indirectly derived, was disclosed to the person under the consumer data rules.

neither the CDR data, nor any other CDR data from which it was directly or indirectly derived, was disclosed to the person under the consumer data rules; and

the person is an accredited data recipient of other CDR data.

the person is an accredited person; and

the CDR data, or any other CDR data from which it was directly or indirectly derived, was disclosed to the person under the consumer data rules; and

the conditions specified in the consumer data rules are met.

the person is an accredited person; and

the CDR data is held by (or on behalf of) the person; and

the CDR data, or any other CDR data from which it was directly or indirectly derived, was disclosed to the person under the consumer data rules; and

the person is neither a data holder, nor a designated gateway, for the first-mentioned CDR data.

the person is specified as a gateway, as described in subparagraph 56AC(2)(e)(i), in an instrument designating a sector under subsection 56AC(2); and

the CDR data is information within a class, specified in that instrument, for which the person is a gateway; and

the CDR data is, or is to be, disclosed to the person under the consumer data rules because the person is:

acting as described in a subparagraph of paragraph 56BG(1)(a) or (b); or

if there are no consumers for the CDR data—acting between a CDR participant for the CDR data and a person requesting a disclosure of the CDR data;

for that class of information; and

as described in subparagraph 56AC(2)(d)(i);

for that class of information; and

as described in subparagraph 56AC(2)(d)(ii);

a provision of this Part;

a provision of the regulations made for the purposes of a provision of this Part;

a provision of the consumer data rules;

another provision of this Act to the extent that it relates to a provision covered by paragraph (a), (b) or (c);

a provision of the Regulatory Powers Act to the extent that it applies in relation to a provision of this Part;

(f) a provision of the Privacy Act 1988 to the extent that it applies as described in section 56ES or 56ET of this Act.

the act or omission is by (or on behalf of) an Australian person; or

the act or omission occurs wholly or partly in Australia, or wholly or partly on board an Australian aircraft or an Australian ship; or

the act or omission occurs wholly outside Australia, and an Australian person suffers, or is likely to suffer, financial or other disadvantage as a result of the act or omission.

from a point outside Australia to a point inside Australia; or

from a point inside Australia to a point outside Australia;

a body corporate established by or under a law of the Commonwealth, of a State or of a Territory; or

(b) an Australian citizen, a permanent resident (within the meaning of the Australian Citizenship Act 2007), or any other person ordinarily resident within Australia or an external Territory; or

an entity covered by subsection 56AR(1), (2) or (3) (about Australian government entities).

liable to a pecuniary penalty or to be prosecuted for an offence; or

subject to a remedy under section 56EY (about actions for damages for contravening the privacy safeguards); or

subject to a remedy under Part VI (about enforcement) other than section 87B (about enforceable undertakings); or

subject to a remedy under Part 4 (about civil penalties) or 7 (about injunctions) of the Regulatory Powers Act; or

subject to Part XID of this Act (about search and seizure).

is part of the Commonwealth; or

(b) is a Commonwealth entity (within the meaning of the Public Governance, Performance and Accountability Act 2013); or

is a body (whether or not incorporated) established by or under a law of the Commonwealth; or

is:

holding or performing the duties of an office established by or under a law of the Commonwealth; or

holding an appointment made under a law of the Commonwealth; or

is prescribed by the regulations.

is part of a State or Territory; or

is a body (whether or not incorporated) established for a public purpose by or under a law of a State or Territory; or

is:

holding or performing the duties of an office established by or under a law of a State or Territory; or

holding an appointment made under a law of a State or Territory; or

is an entity prescribed by the regulations in relation to a State or Territory;

the CDR provisions relate to a CDR consumer for CDR data; and

the entity is a CDR consumer for CDR data (or would be a CDR consumer for CDR data if the entity were a person).

as if the entity were a person; and

with the modifications (if any) prescribed by the regulations.

a State or Territory has agreed to an entity of the State or Territory participating under this Part; and

the entity is a body corporate;

any right, privilege, obligation or liability acquired, accrued or incurred before the revocation; and

any investigation, legal proceeding or remedy in respect of any such right, privilege, obligation or liability;

different rules for different designated sectors; or

different rules for different classes of CDR data; or

different rules for different classes of persons specified, as described in paragraph 56AC(2)(b), in an instrument designating a sector under subsection 56AC(2); or

different rules for different classes of persons who are able to be disclosed CDR data under the consumer data rules.

disclosure, collection, use, accuracy, storage, security or deletion of CDR data for which there are one or more CDR consumers (see also sections 56BC and 56BD);

disclosure, collection, use, accuracy, storage, security or deletion of CDR data for which there are no CDR consumers (see also sections 56BE and 56BF);

designated gateways for CDR data (see also section 56BG);

accreditation of data recipients (see also section 56BH);

reporting, record keeping and auditing (see also section 56BI);

matters incidental or related to any of the above matters (see also section 56BJ).

requirements on a CDR participant for CDR data to disclose all or part of the CDR data, in response to a valid request by a CDR consumer for the CDR data, to:

the CDR consumer for use as the CDR consumer sees fit; or

an accredited person for use subject to the privacy safeguards;

rules about:

how a CDR consumer for the CDR data may make a valid request of the kind described in paragraph (a); and

what must be included in a request for it to be valid, what disclosures or other matters a valid request may cover, and when a request ceases to be a valid request;

requirements on a person (other than a CDR consumer for the CDR data) to satisfy in order to be disclosed the CDR data in the way described in paragraph (a).

rules authorising a CDR participant for CDR data to disclose all or part of the CDR data to a person in accordance with a valid consent of a CDR consumer for the CDR data;

rules authorising a person to use CDR data in accordance with a valid consent of a CDR consumer for the CDR data;

rules about:

how a CDR consumer for the CDR data may make a valid consent of the kind described in paragraph (a) or (b); and

what must be included in a consent for it to be valid, what disclosures, uses or other matters a valid consent may cover, and when a consent ceases to be a valid consent.

rules relating to the privacy safeguards;

other rules relating to the disclosure, collection, use, accuracy, storage or security of the CDR data that affect:

an accredited person; or

a CDR participant, or CDR consumer, for the CDR data;

other rules relating to the deletion of the CDR data that affect:

an accredited person; or

an accredited data recipient of the CDR data; or

a CDR consumer for the CDR data.

the CDR data is within a class of information specified, as described in paragraph 56AC(2)(a), in an instrument designating a sector under subsection 56AC(2); and

the disclosure is to:

one or more of those CDR consumers; or

an accredited person; or

a designated gateway for the CDR data.

is not within a class specified in such an instrument; and

is directly or indirectly derived from CDR data that is within a class specified in such an instrument.

the disclosure of fee-free CDR data under rules like those described in paragraph 56BC(1)(a) or 56BG(1)(a); or

the use of fee-free CDR data received as the result of such a disclosure.

cannot include rules affecting the data holder that relate to the deletion of the CDR data; and

can only include rules affecting the data holder that relate to the use, accuracy, storage or security of the CDR data if such rules also relate to the disclosure of the CDR data under the consumer data rules.

requirements on a CDR participant for the CDR data to disclose all or part of the CDR data to a person in response to a valid request by the person;

rules about:

how a person may make a valid request of the kind described in paragraph (a); and

what must be included in a request for it to be valid, what disclosures or other matters a valid request may cover, and when a request ceases to be a valid request;

requirements on a person to satisfy in order to be disclosed the CDR data in the way described in paragraph (a);

other rules affecting:

CDR participants for the CDR data; or

persons wishing to be disclosed the CDR data;

the CDR data is about the eligibility criteria, terms and conditions, price, availability or performance of:

a product or other kind of good; or

a service; and

in the case where the CDR data is about availability or performance—the CDR data is publicly available.

the disclosure of CDR data under rules like those described in paragraph 56BE(a) or 56BG(2)(a); or

the use of CDR data received as the result of such a disclosure.

rules like those described in subsection 56BC(1) for the CDR data, but involving the designated gateway:

acting between the CDR consumer and the CDR participant in the making of a valid request; or

acting between the CDR consumer and the accredited person who is the proposed recipient of the requested disclosure; or

acting between the CDR participant and the CDR consumer, or accredited person, who is the proposed recipient of the requested disclosure;

rules like those described in subsection 56BC(2) for the CDR data, but involving the designated gateway:

acting between the CDR consumer and a person authorised as described in that subsection; or

acting between persons authorised as described in that subsection;

other rules affecting the designated gateway that relate to the disclosure, collection, use, accuracy, storage, security or deletion of the CDR data.

rules like those described in paragraphs 56BE(a) to (c), but involving the designated gateway acting between the CDR participant and the person requesting the disclosure;

other rules affecting the designated gateway that relate to the disclosure, collection, use, accuracy, storage, security or deletion of the CDR data.

can only include rules affecting the designated gateway requiring or authorising the disclosure of the CDR data if such rules are as described in paragraph (1)(a) or (b); and

can only include rules affecting the designated gateway that relate to the collection, use, accuracy, storage, security or deletion of the CDR data if such rules also relate to a disclosure described in paragraph (a) of this subsection.

rules conferring functions or powers on the Data Recipient Accreditor;

the criteria for a person to be accredited under subsection 56CA(1);

rules providing that accreditations may be granted subject to conditions, and that conditions may be imposed on an accreditation after it has been granted;

rules providing that accreditations may be granted at different levels corresponding to different risks, including the risks associated with:

specified classes of CDR data; or

specified classes of activities; or

specified classes of applicants for accreditation;

rules for the period, renewal, transfer, variation, suspension, revocation or surrender of accreditations;

notification requirements on persons whose accreditations have been varied, suspended, revoked or surrendered;

transitional rules for when an accreditation is varied, is suspended or ends, including about the disclosure, collection, use, accuracy, storage, security or deletion of CDR data;

rules about a matter referred to in subsection 56CE(4) (about the Register of Accredited Persons).

the criteria may differ for different classes of persons; and

the criteria may include the payment of a fee.

a failure to comply with a requirement in this Part or in the consumer data rules;

a failure to comply with a requirement in the privacy safeguards.

a power for a CDR consumer for CDR data to direct a CDR participant for the CDR data to give the consumer, or an accredited person, reports about:

the consumer’s valid requests to the CDR participant, under rules like those described in paragraph 56BC(1)(a) or 56BG(1)(a), for the CDR data; and

any disclosures made in response to such requests;

a power for a CDR consumer for CDR data to direct a CDR participant for the CDR data to give the consumer, or an accredited person, reports about:

the consumer’s valid consents to the CDR participant, under rules like those described in paragraph 56BC(2)(a) or (b) or 56BG(1)(b), for the CDR data; and

any disclosures made in response to such consents;

a power for a person referred to in paragraph 56BG(1)(a) or (b) to direct a designated gateway referred to in that paragraph to give reports about:

valid requests or consents, affecting the designated gateway, under rules like those described in that paragraph; and

any disclosures made in response to such requests or consents;

requirements for CDR participants for CDR data to give reports to the Commission or the Information Commissioner;

requirements for accredited persons to give reports to the Commission or the Information Commissioner;

requirements for designated gateways for CDR data to give reports to the Commission or the Information Commissioner;

requirements for the keeping of records relating to the operation of the consumer data rules;

requirements for each of the following entities:

the Data Recipient Accreditor;

the Accreditation Registrar;

the Data Standards Chair;

copies of one or more of the records required to be kept as described in paragraph (1)(g); or

information from such records;

rules that refer to the data standards;

the circumstances in which persons are, or may be, relieved from complying with requirements in the consumer data rules that would otherwise apply to them;

a rule that depends on a person being satisfied of one or more specified matters;

rules for the making of applications for internal review, or of applications to the Administrative Appeals Tribunal for review, of decisions of a person under the consumer data rules;

rules about the manner or form in which persons or bodies:

may exercise powers under the consumer data rules; or

must comply with requirements imposed by the consumer data rules;

rules about the following matters:

the manner in which CDR participants for CDR data may charge (or cause to be charged) a fee for a matter covered by the consumer data rules;

the time for paying such a fee;

giving notice of, or publicising, such a fee or matters about such a fee;

rules requiring CDR participants, or designated gateways, for CDR data to have internal or external dispute resolution processes:

that relate to the operation of the consumer data rules or this Part; and

that meet specified criteria;

rules relating to an external dispute resolution scheme recognised under Division 4, including about access to such a scheme;

transitional rules for the external resolution of disputes:

described in subsection 56DA(1); and

not covered by a scheme recognised under that subsection;

rules about any other matters that the provisions of this Part provide may be specified, or otherwise dealt with, in the consumer data rules.

is a data holder of the CDR data; or

is an accredited person; or

is a person who has given a valid request under the consumer data rules relating to the CDR data; or

is a designated gateway for the CDR data.

have no effect to the extent that the consumer data rules deal with specified matters, or impose specified requirements, in relation to:

specified classes of CDR data; or

specified classes of persons; or

only have effect to the extent that the consumer data rules deal with specified matters, or impose specified requirements, in relation to:

specified classes of CDR data; or

specified classes of persons.

the person engages in conduct; and

the person does so knowing that the conduct:

is misleading or deceptive; or

is likely to be misleading or deceptive; and

(c) the conduct misleads or deceives, or is likely to mislead or deceive, another person (the second person) into believing that:

a person is a CDR consumer for CDR data; or

a person is making a valid request or consent, or has satisfied other criteria, for the disclosure of CDR data under the consumer data rules.

$10,000,000;

if the court can determine the value of the benefit that the body corporate, and any body corporate related to the body corporate, have obtained directly or indirectly and that is reasonably attributable to the commission of the offence—3 times the value of that benefit;

if the court cannot determine the value of that benefit—10% of the annual turnover of the body corporate during the 12-month period ending at the end of the month in which the commission of the offence happened or began.

a person is a CDR consumer for CDR data; or

a person is making a valid request or consent, or has satisfied other criteria, for the disclosure of CDR data under the consumer data rules.

consult the public about the making of the rules:

for at least 28 days; and

in one or more ways that includes making information available on the Commission’s website, and inviting the public to comment; and

consult each of the following about the making of the rules:

the Information Commissioner;

if the rules relate to a particular designated sector—the person or body (if any) that the Commission believes to be the primary regulator of that sector;

any person or body prescribed by the regulations; and

wait at least 60 days after the day consultation of the public begins under paragraph (a) about the making of the rules.

after consulting the Information Commissioner, but without otherwise complying with section 56BQ; and

without the consent of the Minister as required by section 56BR;

the efficiency, integrity or stability of any aspect of the Australian economy; or

the interests of consumers.

on the following day, give the Minister a written explanation of the need for the emergency rules; and

vary or repeal the emergency rules in accordance with any directions given under subsection (2).

the emergency rules are made without consulting the Information Commissioner, but otherwise in accordance with subsection 56BS(1); and

the Minister does not give a direction under subsection (2) about the emergency rules;

the person is a CDR participant for CDR data; and

the person is required under the consumer data rules to disclose all or part of the CDR data; and

the person charges (or causes to be charged) a fee for either or both of the following matters:

the disclosure (or a related disclosure by a designated gateway or other CDR participant for the CDR data);

the use of the CDR data as the result of the disclosure (or of that related disclosure); and

subsection (2) or any of the following subparagraphs applies:

the CDR data is fee-free CDR data;

to the extent that the fee is charged for the disclosure of chargeable CDR data—the fee purports to cover a disclosure in circumstances that are not chargeable circumstances;

to the extent that the fee is charged for the use of chargeable CDR data—the fee purports to cover use in circumstances that are not chargeable circumstances.

(a) any fee (the reasonable fee):

that has been determined under subsection 56BV(1) for the person; or

that can be worked out from a method determined under subsection 56BV(1) for the person;

the portion of the fee charged as described in that paragraph for those matters exceeds the corresponding portion of the reasonable fee.

(a) the amount of a fee, or a method for working out the amount of a fee, that the CDR participant may charge (or cause to be charged) for either or both of the following matters (the chargeable matters):

the disclosure of the chargeable CDR data in chargeable circumstances because of a requirement under the consumer data rules to do so;

the use of the chargeable CDR data in chargeable circumstances as the result of such a disclosure;

the specified persons who are liable to pay that fee;

reflects the reasonable costs (including capital costs) necessary for the CDR participant to comply with this Part and the consumer data rules in relation to the chargeable matters; and

is reasonable having regard to the criteria in subsection (3).

the matters in subparagraphs 56AD(1)(a)(i), (ii), (iv) to (vi) and (c)(ii) and (iv); and

whether a lower fee could result in an acquisition of property (within the meaning of paragraph 51(xxxi) of the Constitution); and

whether a lower fee would reduce the incentive to generate, collect, hold or maintain CDR data of that kind; and

any other matters the Commission considers relevant.

must be made by written notice given to the CDR participant; and

is not a legislative instrument.

the CDR participant specified in the determination; or

a person whose interests are affected by the determination;

may make a decision affirming, setting aside or varying the determination; and

for the purposes of the review, may perform all the functions and exercise all the powers of the Commission.

is not a body corporate established by or under a law of the Commonwealth, of a State or of a Territory; and

(b) is neither an Australian citizen, nor a permanent resident (within the meaning of the Australian Citizenship Act 2007).

is an accredited person; or

is an accredited person holding an accreditation that has been granted at a particular level (see paragraph 56BH(1)(d)); or

is an accredited data recipient of CDR data;

$10,000,000;

if the court can determine the value of the benefit that the body corporate, and any body corporate related to the body corporate, have obtained directly or indirectly and that is reasonably attributable to the commission of the offence—3 times the value of that benefit;

if the court cannot determine the value of that benefit—10% of the annual turnover of the body corporate during the 12-month period ending at the end of the month in which the commission of the offence happened or began.

is an accredited person; or

is an accredited person holding an accreditation that has been granted at a particular level (see paragraph 56BH(1)(d)); or

is an accredited data recipient of CDR data;

the inclusion in the register of entries for accredited persons;

the correction of entries in the register;

the publication or availability of all or part of the register, or of specified information in the register;

any other matter relating to the content, administration or operation of the register.

(a) is the accountable authority of a Commonwealth entity (within the meaning of the Public Governance, Performance and Accountability Act 2013); or

is a Commonwealth entity (within the meaning of that Act).

to accredit persons under subsection 56CA(1); and

such other functions as are conferred by the consumer data rules.

(a) the person’s functions and powers in their capacity other than as the Data Recipient Accreditor (their primary capacity); and

if the person is not a body corporate—the functions that may be performed, and the powers that may be exercised, by anyone appointed under a Commonwealth law to act as the person in that primary capacity;

a person is the Data Recipient Accreditor at any time during a period; and

(b) an annual report for the period is prepared under Public Governance, Performance and Accountability Act 2013:section 46 of the

by the person in the person’s primary capacity; or

about the person in the person’s primary capacity;

an SES employee, or an acting SES employee, in the Department, in the Commission or in the Commonwealth entity appointed under paragraph 56CG(1)(b) (if any); or

an APS employee who is holding or performing the duties of a specified office or position that:

is in the Department, in the Commission or in the Commonwealth entity appointed under paragraph 56CG(1)(b) (if any); and

is an office or position that the Data Recipient Accreditor is satisfied is sufficiently senior for the APS employee to perform the function or exercise the power.

(a) is the accountable authority of a Commonwealth entity (within the meaning of the Public Governance, Performance and Accountability Act 2013); or

is a Commonwealth entity (within the meaning of that Act).

those described in Subdivision B; and

such other functions as are conferred by the consumer data rules.

(a) the person’s functions and powers in their capacity other than as the Accreditation Registrar (their primary capacity); and

if the person is not a body corporate—the functions that may be performed, and the powers that may be exercised, by anyone appointed under a Commonwealth law to act as the person in that primary capacity;

a person is the Accreditation Registrar at any time during a period; and

(b) an annual report for the period is prepared under Public Governance, Performance and Accountability Act 2013:section 46 of the

by the person in the person’s primary capacity; or

about the person in the person’s primary capacity;

an SES employee, or an acting SES employee, in the Department, in the Commission or in the Commonwealth entity appointed under paragraph 56CK(1)(b) (if any); or

an APS employee who is holding or performing the duties of a specified office or position that:

is in the Department, in the Commission or in the Commonwealth entity appointed under paragraph 56CK(1)(b) (if any); and

is an office or position that the Accreditation Registrar is satisfied is sufficiently senior for the APS employee to perform the function or exercise the power.

relating to the operation of the consumer data rules, or this Part, in relation to one or more designated sectors; and

involving one or more of the following:

CDR participants for CDR data;

CDR consumers for CDR data;

designated gateways for CDR data;

other persons relating to any of those designated sectors.

specify a period for which the recognition of the external dispute resolution scheme is in force; and

make the recognition of the external dispute resolution scheme subject to specified conditions, including conditions relating to the conduct of an independent review of the operation of the scheme.

the accessibility of the scheme; and

the independence of the scheme; and

the fairness of the scheme; and

the accountability of the scheme; and

the efficiency of the scheme; and

the effectiveness of the scheme; and

any other matters the Commission considers relevant.

the Australian Privacy Principles do not apply to an accredited data recipient of CDR data in relation to the CDR data; and

if subsection 56EN(1) applies to a disclosure of CDR data by a data holder of the CDR data—Australian Privacy Principle 10 does not apply to the data holder in relation to that disclosure of the CDR data; and

if subsection 56EP(1) applies to CDR data and a data holder of the CDR data—Australian Privacy Principle 13 does not apply to the data holder in relation to the CDR data; and

Australian Privacy Principles 6, 7 and 11 do not apply to a designated gateway for CDR data in relation to the CDR data.

a data holder of CDR data in relation to the CDR data; or

a designated gateway for CDR data in relation to the CDR data.

a data holder of CDR data; or

an accredited data recipient of CDR data; or

a designated gateway for CDR data;

will ensure that the CDR entity complies with this Part and the consumer data rules; and

will enable the CDR entity to deal with inquiries or complaints from a CDR consumer for the CDR data about the CDR entity’s compliance with this Part or the consumer data rules.

is about the CDR entity’s management of CDR data; and

is in a form approved in accordance with the consumer data rules; and

contains the information required by subsections (4), (5) and (6) (as applicable).

how a CDR consumer for the CDR data may access the CDR data and seek the correction of the CDR data;

how a CDR consumer for the CDR data may complain about a failure of the CDR entity to comply with this Part or the consumer data rules, and how the CDR entity will deal with such a complaint.

the classes of CDR data held by (or on behalf of) the CDR entity as an accredited data recipient, and how such CDR data is held;

the purposes for which the CDR entity may collect, hold, use or disclose such CDR data with the consent of a CDR consumer for the CDR data;

how a CDR consumer for such CDR data may access the CDR data and seek the correction of the CDR data;

how a CDR consumer for such CDR data may complain about a failure of the CDR entity to comply with this Part or the consumer data rules, and how the CDR entity will deal with such a complaint;

whether the CDR entity is likely to disclose such CDR data to accredited persons who are based overseas;

if the CDR entity is likely to disclose such CDR data to accredited persons who are based overseas—the countries in which such persons are likely to be based if it is practicable to specify those countries in the policy;

the circumstances in which the CDR entity may disclose such CDR data to a person who is not an accredited person;

the events about which the CDR entity will notify the CDR consumers of such CDR data;

the circumstances in which the CDR entity must delete or de-identify such CDR data in accordance with a request given by a CDR consumer for the CDR data under the consumer data rules.

an explanation of how the CDR entity, as a designated gateway, will act between persons to facilitate:

the disclosure of CDR data; or

the accuracy of CDR data; or

other matters;

how a CDR consumer for such CDR data may complain about a failure of the CDR entity to comply with this Part or the consumer data rules, and how the CDR entity will deal with such a complaint.

free of charge; and

in accordance with the consumer data rules.

a CDR consumer for the CDR data has requested this by giving a valid request under the consumer data rules; and

the person complies with all other requirements in the consumer data rules for the collection of the CDR data from the CDR participant.

while the person is an accredited person, collects CDR data from a CDR participant for the CDR data:

purportedly under the consumer data rules; but

not as the result of seeking to collect that CDR data under the consumer data rules; and

is not required to retain that CDR data by or under an Australian law or a court/tribunal order;

take the steps specified in the consumer data rules to notify CDR consumers for the CDR data of the collection; and

ensure that this notification:

is given to those of the CDR consumers (if there are more than one) that the consumer data rules require to be notified; and

covers the matters specified in those rules; and

is given at or before the time specified in those rules.

in the case of a disclosure—the disclosure is required under the consumer data rules in response to a valid request from a CDR consumer for the CDR data; or

the use or disclosure is otherwise required, or authorised, under the consumer data rules; or

the use or disclosure is required or authorised by or under:

another Australian law; or

a court/tribunal order;

in the case of a disclosure—the disclosure is required under the consumer data rules; or

the use or disclosure is authorised under the consumer data rules; or

the use or disclosure is required or authorised by or under:

another Australian law; or

a court/tribunal order;

in the case of a disclosure—the disclosure is required under the consumer data rules in response to a valid request from a CDR consumer for the CDR data; or

the use or disclosure is authorised under the consumer data rules in accordance with a valid consent of a CDR consumer for the CDR data.

in the case of a disclosure—the disclosure is required under the consumer data rules; or

the use or disclosure is authorised under the consumer data rules.

an accredited data recipient of CDR data proposes to disclose the CDR data; and

(b) the recipient (the new recipient) of the proposed disclosure:

is not in Australia or an external Territory; and

is not a CDR consumer for the CDR data;

the new recipient is an accredited person; or

the accredited data recipient takes reasonable steps to ensure that any act or omission by (or on behalf of) the new recipient will not, after taking into account subsection (3), contravene:

subsection 56ED(3); or

another privacy safeguard penalty provision in relation to the CDR data; or

the accredited data recipient reasonably believes:

that the new recipient is subject to a law, or binding scheme, that provides substantially similar protection for the CDR data as the privacy safeguards provide in relation to accredited data recipients; and

that a CDR consumer for the CDR data will be able to enforce those protections provided by that law or binding scheme; or

the conditions specified in the consumer data rules are met.

the accredited data recipient of the CDR data makes the disclosure to the new recipient; and

none of paragraphs (1)(c), (e) and (f) apply in relation to the disclosure to the new recipient; and

an act or omission by (or on behalf of) the new recipient, after taking into account subsection (3), contravenes:

subsection 56ED(3); or

another privacy safeguard penalty provision in relation to the CDR data;

a person is an accredited data recipient of CDR data; and

(b) the CDR data includes a government related identifier (within the meaning of the Privacy Act 1988) of a CDR consumer for the CDR data who is an individual;

the adoption or use is required or authorised by or under:

an Australian law other than the consumer data rules; or

a court/tribunal order; or

subclause 9.3 of Australian Privacy Principle 9 applies in relation to the adoption or use.

a person who is an accredited data recipient of CDR data proposes to disclose the CDR data; and

(b) the CDR data includes a government related identifier (within the meaning of the Privacy Act 1988) of a CDR consumer for the CDR data who is an individual;

this is required or authorised by or under:

an Australian law other than the consumer data rules; or

a court/tribunal order; or

subclause 9.3 of Australian Privacy Principle 9 applies in relation to the disclosure.

take the steps specified in the consumer data rules to notify CDR consumers for the CDR data of the disclosure; and

ensure that this notification:

is given to those of the CDR consumers (if there are more than one) that the consumer data rules require to be notified; and

covers the matters specified in those rules; and

is given at or before the time specified in those rules.

take the steps specified in the consumer data rules to notify CDR consumers for the CDR data of the disclosure; and

ensure that this notification:

is given to those of the CDR consumers (if there are more than one) that the consumer data rules require to be notified; and

covers the matters specified in those rules; and

is given at or before the time specified in those rules.

required under the consumer data rules to do so in response to a valid request from a CDR consumer for the CDR data; or

otherwise required, or authorised, under the consumer data rules to do so;

makes a disclosure referred to in subsection (1) or (2) for a CDR consumer; and

later becomes aware that some or all of the CDR data was incorrect when it was disclosed because, having regard to the purpose for which it was held, it was inaccurate, out of date or incomplete;

a CDR consumer for CDR data is advised under subsection (3) by a CDR participant for the CDR data that some or all of the CDR data was incorrect when the CDR participant had earlier disclosed it; and

the CDR consumer requests the CDR participant to fix this by disclosing the corrected CDR data;

an accredited data recipient of CDR data; or

a designated gateway for CDR data;

misuse, interference and loss; and

unauthorised access, modification or disclosure.

(a) the CDR entity no longer needs any of that CDR data for either of the following purposes (the redundant data):

a purpose permitted under the consumer data rules;

a purpose for which the person is able to use or disclose it in accordance with this Division; and

the CDR entity is not required to retain the redundant data by or under an Australian law or a court/tribunal order; and

the redundant data does not relate to any current or anticipated:

legal proceedings; or

dispute resolution proceedings;

a CDR consumer for CDR data gives a request to a data holder of the CDR data (including a request given through a designated gateway for the CDR data); and

the request is for the data holder to correct the CDR data; and

the data holder was earlier required or authorised under the consumer data rules to disclose the CDR data;

a CDR consumer for CDR data gives a request to an accredited data recipient of the CDR data (including a request given through a designated gateway for the CDR data); and

the request is for the accredited data recipient to correct the CDR data;

either:

to correct the CDR data; or

to include a statement with the CDR data, to ensure that, having regard to the purpose for which the CDR data is held, the CDR data is accurate, up to date, complete and not misleading;

to give notice of any correction or statement, or notice of why a correction or statement is unnecessary or inappropriate.

making guidelines for the avoidance of acts or practices that may breach the privacy safeguards;

promoting an understanding and acceptance of the privacy safeguards;

undertaking educational programs for the purposes of promoting the protection of CDR data.

the Information Commissioner; or

a person or authority acting on behalf of the Information Commissioner.

the privacy safeguards; or

the consumer data rules to the extent that those rules relate to:

the privacy safeguards; or

the privacy or confidentiality of the CDR data.

an accredited data recipient of CDR data; or

a designated gateway for CDR data;

(a) sections 26WB to 26WD of the Privacy Act 1988 were not enacted; and

subsection 26WE(1) of that Act were replaced with the following:

(a) CDR data of one or more CDR consumers is held by (or on behalf of) either of the following entities (the CDR entity):

an accredited data recipient of the CDR data;

a designated gateway for the CDR data; and

(b) Competition and Consumer Act 2010 applies to the CDR entity in relation to the CDR data.”.section 56EO (about privacy safeguard 12) of the

one or more of the privacy safeguards;

the consumer data rules to the extent that those rules relate:

to one or more of the privacy safeguards; or

to the privacy or confidentiality of CDR data;

(c) Privacy Act 1988, as they apply because of section 56ES of this Act;section 26WH, 26WK or 26WL or subsection 26WR(10) of the

a CDR consumer who is an individual; or

(e) a small business (within the meaning of the Privacy Act 1988) carried on by a CDR consumer for the CDR data.

of a CDR participant or designated gateway; and

that may be:

a privacy safeguard breach relating to CDR data covered by subsection (1); or

a breach of section 56ED (privacy safeguard 1);

a CDR participant for CDR data; or

a designated gateway for CDR data;

(a) subsection 5B(4) of the Privacy Act 1988 were not enacted; and

section 36 of that Act also stated that:

in the case of a complaint about an act or practice of a CDR participant—the CDR participant is the respondent; or

in the case of a complaint about an act or practice of a designated gateway—the designated gateway is the respondent; and

subsections 36(6) to (8), section 37, subsections 40(1B), 43(1A), (8), (8A) and (9) and 48(2), section 50A, sub-subparagraph 52(1)(b)(i)(A) and sections 53A and 53B of that Act were not enacted; and

the paragraphs in each of subsections 55B(1) and (3) of that Act were replaced by:

a paragraph that states that an act or practice of a specified CDR participant for CDR data has breached a privacy safeguard; and

a paragraph that states that an act or practice of a specified designated gateway for CDR data has breached a privacy safeguard; and

Division 4 of Part V, and subsection 63(2A), of that Act were not enacted.

subsection 56ED(3);

subsection 56EF(1);

subsection 56EG(1);

section 56EH;

subsection 56EI(1) or (2);

subsection 56EJ(1) or (2);

subsection 56EK(1);

subsection 56EL(1) or (2);

subsection 56EM(1) or (2);

subsection 56EN(1), (2), (3) or (4);

subsection 56EO(1) or (2);

subsection 56EP(1) or (2).

the Federal Court;

the Federal Circuit Court;

a court of a State or Territory that has jurisdiction in relation to the matter.

a contravention of one or more of the privacy safeguard penalty provisions; and

a contravention of one or more civil penalty provisions of the consumer data rules;

Part 4 of the Regulatory Powers Act for a contravention referred to in paragraph (5)(a) of this section; and

Part VI of this Act for a contravention referred to in paragraph (5)(b) of this section;

by a person; and

under a civil penalty order under Part 4 of that Act (as that Part applies because of section 56EU of this Act);

$10,000,000;

if the relevant court (see subsection 56EU(4)) can determine the value of the benefit that the body corporate, and any body corporate related to the body corporate, have obtained directly or indirectly and that is reasonably attributable to the contravention—3 times the value of that benefit;

if that court cannot determine the value of that benefit—10% of the annual turnover of the body corporate during the 12-month period ending at the end of the month in which the contravention happened or began.

the Federal Court;

the Federal Circuit Court;

a court of a State or Territory that has jurisdiction in relation to the matter.

the Federal Court;

the Federal Circuit Court;

a court of a State or Territory that has jurisdiction in relation to the matter.

of another person; and

that was in contravention of:

a provision of the privacy safeguards; or

the consumer data rules to the extent that those rules relate to the privacy safeguards or to the privacy or confidentiality of CDR data;

under the Regulatory Powers Act (as that Act applies because of this Subdivision) in which the person is found to have contravened a provision of the privacy safeguards; or

under Part VI of this Act in which the person is found to:

have contravened; or

have been involved in a contravention;

in any case—a document under the seal of the court from which the finding or admission appears; or

in the case of an admission—a document from which the admission appears that is filed in the court.

the Federal Circuit Court;

subject to the Constitution, the several courts of the Territories.

a provision of the privacy safeguards; or

the consumer data rules to the extent that those rules relate to the privacy safeguards or to the privacy or confidentiality of CDR data.

is in this section; and

is to a person involved in a contravention covered by paragraph (1)(b) of this section;

the Information Commissioner’s functions or powers under section 56ER;

(b) the Information Commissioner’s functions or powers under Privacy Act 1988, as those Parts apply because of sections 56ES and 56ET of this Act;Part IIIC or V of the

the Information Commissioner’s functions or powers under Part 4, 6 or 7 of the Regulatory Powers Act, that are conferred because of this Subdivision.

the Commission; or

a member of the Commission; or

a member of the staff of the Commission referred to in section 27 of this Act.

the Commission has agreed to the delegation in writing; and

in the case of a delegation to a staff member referred to in paragraph (2)(c)—the Commission is satisfied that the staff member:

is an SES employee or acting SES employee; or

is holding or performing the duties of a sufficiently senior office or position for the function or power.

the format and description of CDR data;

the disclosure of CDR data;

the collection, use, accuracy, storage, security and deletion of CDR data;

de-identifying CDR data, including so that it no longer relates to:

an identifiable person; or

a person who is reasonably identifiable;

other matters prescribed by the regulations.

making a data standard; or

varying or revoking a data standard;

make, under subsection (1), a data standard about a particular matter mentioned in subsection (1) if the consumer data rules so requires; and

specify in that data standard that it is binding if the consumer data rules so requires.

different provisions for different designated sectors; or

different provisions for different classes of CDR data; or

different provisions for different classes of persons specified, as described in paragraph 56AC(2)(b), in an instrument designating a sector under subsection 56AC(2); or

different provisions for different classes of accredited persons.

each of the different designated sectors referred to in paragraph (1)(a) of this section; or

each of the different classes referred to in paragraph (1)(b), (c) or (d) of this section.

a data holder of CDR data to which a binding data standard applies; and

each accredited person;

agrees to observe the standard to the extent that the standard applies to the person; and

agrees to engage in conduct that the person is required by the standard to engage in.

a data holder of the CDR data; and

the designated gateway for the CDR data; and

each accredited person;

agrees to observe the standard to the extent that the standard applies to the person; and

agrees to engage in conduct that the person is required by the standard to engage in.

the Commission; or

a person aggrieved by the failure.

the person against whom the order is sought; or

if that person is a body corporate—the directors of the body corporate;

to make standards under Subdivision A; and

to review those standards regularly; and

such other functions as are prescribed by the regulations.

the power to establish committees, advisory panels and consultative groups;

the power to do all other things necessary or convenient to be done for or in connection with the performance of the Chair’s functions.

the Department; or

(b) another Commonwealth entity (within the meaning of the Public Governance, Performance and Accountability Act 2013).

the Body’s composition; or

the Body’s governance or processes.

during a vacancy in the office of Data Standards Chair (whether or not an appointment has previously been made to the office); or

during any period, or during all periods, when the Data Standards Chair:

is absent from duty or from Australia; or

is, for any reason, unable to perform the duties of the office.

the performance of the Data Standards Chair’s functions; and

the exercise of the Data Standards Chair’s powers;

subsections (1) and (2) do not apply; and

the Department’s annual report under section 46 of that Act for the period that includes that time must include information about the performance of the Data Standards Chair’s functions, and the exercise of the Data Standards Chair’s powers, at that time.

for misbehaviour; or

if the Data Standards Chair is unable to perform the duties of the Data Standards Chair’s office because of physical or mental incapacity.

the Data Standards Chair:

becomes bankrupt; or

applies to take the benefit of any law for the relief of bankrupt or insolvent debtors; or

compounds with the Data Standards Chair’s creditors; or

makes an assignment of the Data Standards Chair’s remuneration for the benefit of the Data Standards Chair’s creditors; or

if the Data Standards Chair is appointed on a full-time basis—the Data Standards Chair is absent, except on leave of absence, for 14 consecutive days or for 28 days in any 12-month period; or

(c) the Data Standards Chair fails, without reasonable excuse, to comply with Public Governance, Performance and Accountability Act 2013 (which deals with the duty to disclose interests) or rules made for the purposes of that section.section 29 of the

an SES employee, or an acting SES employee, in the Data Standards Body, in the Department or in the Commission; or

an APS employee who is holding or performing the duties of a specified office or position that:

is in the Data Standards Body, in the Department or in the Commission; and

is an office or position that the Chair is satisfied is sufficiently senior for the APS employee to perform the function or exercise the power; or

if there are no APS employees (including SES employees) in the Data Standards Body—a person:

who holds an office or position in the Data Standards Body that the Chair considers is sufficiently senior for the person to perform the function; and

who the Chair considers has appropriate qualifications or expertise to perform the function.

the functions conferred on the Information Commissioner by another provision of this Part, or by an instrument made under this Part;

to consult with or advise the Minister, Commission or Data Standards Chair about any matter relevant to the operation of this Part (or the operation of instruments made under this Part).

designations under section 56AC (about designated sectors);

regulations made for the purposes of a provision of this Part;

the consumer data rules;

data standards.

as in force or existing at a particular time; or

as in force or existing from time to time.

(a) a CDR participant, or designated gateway, for CDR data (the CDR entity):

provides the CDR data to another person; or

otherwise allows another person access to the CDR data; and

the CDR entity does so, in good faith, in compliance with:

this Part; and

regulations made for the purposes of this Part; and

the consumer data rules;

the following provisions:

the provisions of this Part;

the provisions of regulations made for the purposes of the provisions of this Part;

the provisions of the consumer data rules; and

definitions in this Act, or in the regulations or consumer data rules, as they apply to references in provisions referred to in paragraph (a).

may or may not be limited to a specified period; and

may apply unconditionally or subject to specified conditions.

the following provisions:

the provisions of this Part;

the provisions of regulations made for the purposes of the provisions of this Part;

the provisions of the consumer data rules; and

definitions in this Act, or in the regulations or consumer data rules, as they apply to references in provisions referred to in paragraph (a).

exempt a particular person, in relation to particular CDR data or one or more classes of CDR data, from all or specified provisions covered by this section; or

exempt a class of persons, in relation to particular CDR data or one or more classes of CDR data, from all or specified provisions covered by this section; or

declare that provisions covered by this section apply in relation to:

a particular person in relation to particular CDR data or one or more classes of CDR data; or

a class of persons in relation to particular CDR data or one or more classes of CDR data;

may or may not be limited to a specified period; and

may apply unconditionally or subject to specified conditions.

a postal, telegraphic, telephonic or other like service (within the meaning of paragraph 51(v) of the Constitution); or

the business of banking, other than State banking (within the meaning of paragraph 51(xiii) of the Constitution) not extending beyond the limits of the State concerned; or

the business of insurance, other than State insurance (within the meaning of paragraph 51(xiv) of the Constitution) not extending beyond the limits of the State concerned.

making a supply or communication; or

conducting an activity or otherwise doing something;

trade or commerce between Australia and places outside Australia;

trade or commerce among the States;

trade or commerce within a Territory, between a State or Territory or between 2 Territories.

protecting CDR entities against interference, or attacks, of the kind described in paragraph 1 of Article 17 of the ICCPR; or

protecting against interference, or attacks, of the kind described in paragraph 1 of Article 17 of the ICCPR by CDR entities.

a data holder of CDR data;

an accredited person;

a designated gateway for CDR data.

the Federal Court; or

the Supreme Court of a State or Territory;

is to specify matters including:

(i) one or more authorised deposit-taking institutions (within the meaning of the Banking Act 1959); or

(ii) one or more classes of authorised deposit-taking institutions (within the meaning of the Banking Act 1959);

is to be made before the later of:

1 July 2020; and

the end of the 3-month period starting on the day this Part commences.

relate to matters covered by an instrument under subsection 56AC(2) of that Act that is to be made as described in subitem (1); and

are made before the later of:

1 July 2020; and

the end of the 3-month period starting on the day this Part commences.

is to specify matters including one or more of the following:

one or more, or one or more classes of, Registered participants (within the meaning of the National Electricity Law);

the Australian Energy Regulator;

Australian Energy Market Operator Limited (ACN 072 010 327);

(iv) all or a part of the Department of State administered by the Minister of Victoria administering the National Electricity (Victoria) Act 2005 (Vic.);

is to be made before the later of:

1 July 2020; and

the end of the 3-month period starting on the day this Part commences.

the functions:

relate to the privacy of an individual; and

are not freedom of information functions; or

the functions are conferred by:

(i) Competition and Consumer Act 2010; orPart IVD (about the consumer data right) of the

an instrument made under that Part; or

another Act because of that Part.

for information covered by subsection (5)—the person records, discloses or otherwise uses the information in the course of any of the following:

performing a function described in paragraph 9(1)(b), or exercising a related power;

providing information to the Minister or the Department;

(iii) providing information to the Minister administering Competition and Consumer Act 2010 or the Department administered by that Minister;Part IVD of the

providing information to the Australian Competition and Consumer Commission or the Data Recipient Accreditor (within the meaning of that Act); or

was acquired in the course of performing a function described in paragraph 9(1)(b) (about the consumer data right), or exercising a related power; or

could be relevant to either of the following decisions:

(i) a decision under subsection 56CA(1) (about accreditation for the consumer data right) of the Competition and Consumer Act 2010;

a decision under the consumer data rules (within the meaning of that Act) relating to a person’s accreditation under subsection 56CA(1) of that Act.

if a person holds an appointment under subsection 56CK(1)—that person; or

otherwise—the Commission.

in relation to the disclosure of chargeable CDR data—has the meaning given by subsection 56AM(2); or

in relation to the use of chargeable CDR data—has the meaning given by subsection 56AM(3).

(a) a record (within the meaning of the Privacy Act 1988); or

a generally available publication (within the meaning of that Act).

if a person holds an appointment under subsection 56CG(1)—that person; or

otherwise—the Commission.

if a person holds an appointment under section 56FG—that person; or

otherwise—the Minister.

Part VI; or

Division 5 of Part XI; or

section 155;

to the Information Commissioner; or

(b) to a member of the staff of the Office of the Australian Information Commissioner referred to in Australian Information Commissioner Act 2010;section 23 of the

the Information Commissioner agrees to the delegation in writing; and

in the case of a delegation to a staff member referred to in paragraph (b)—the Information Commissioner is satisfied that the staff member:

is an SES employee or acting SES employee; or

is holding or performing the duties of a sufficiently senior office or position for the function or power.

subsection 56BO(1) or 56BU(1), section 56CD or a civil penalty provision of the consumer data rules;

for each act or omission to which this section applies that relates to a civil penalty provision of the consumer data rules that sets out at its foot a pecuniary penalty for a body corporate indicated by the words “Civil penalty”—the amount of that pecuniary penalty; and

for each act or omission to which this section applies that relates to subsection 56BO(1) or 56BU(1), section 56CD or a civil penalty provision of the consumer data rules not covered by paragraph (aab) of this subsection—$500,000; and

for each act or omission to which this section applies that relates to a civil penalty provision of the consumer data rules that sets out at its foot a pecuniary penalty for a person other than a body corporate indicated by the words “Civil penalty”—the amount of that pecuniary penalty; and

subsection 56BN(1), 56BO(1), 56BU(1) or 56CC(1), section 56CD or a civil penalty provision of the consumer data rules;

a provision of Part IV or IVB; or

section 55B, 60C or 60K; or

subsection 56BN(1), 56BO(1), 56BU(1) or 56CC(1) or section 56CD; or

a civil penalty provision of the consumer data rules;

in which that person has been found to have contravened, or to have been involved in a contravention of:

a provision of Part IV or IVB; or

section 55B, 60C or 60K; or

subsection 56BO(1) or 56BU(1), section 56CD or a civil penalty provision of the consumer data rules.

contravenes Part IV or IVB, section 55B, subsection 56BN(1), 56BO(1), 56BU(1) or 56CC(1), section 56CD, section 60C, 60K or 92 or a civil penalty provision of the consumer data rules; or

the consumer data rules; or

a designated consumer data right matter (as defined by subsection (9AA) of this section); or

Part IVD (other than Division 5); or

regulations made under this Act for the purposes of that Part; or

the consumer data rules.

the Information Commissioner; or

any staff or consultant assisting the Information Commissioner in performing that Commissioner’s functions, or exercising that Commissioner’s powers, relating to Part IVD or the consumer data rules;

for a purpose connected with the performance of the functions, or the exercise of the powers, referred to in paragraph (1)(b); and

in accordance with any conditions imposed under subsection (4).

an agency having the function in a foreign country of supervising or regulating the disclosure of similar information to that covered by an instrument designating a sector under subsection 56AC(2); or

an agency, that is prescribed by the regulations, of a foreign country;

under this Act in relation to Part IVD or the consumer data rules; or

under the consumer data rules.

a member, or associate member, of the Commission; or

a person referred to in subsection 27(1); or

a person engaged under section 27A.

the region is a colony, territory or protectorate of a foreign country; or

the region is part of a foreign country; or

the region is under the protection of a foreign country; or

a foreign country exercises jurisdiction or control over the region; or

a foreign country is responsible for the region’s international relations.

is personal information; but

is not CDR data (within the meaning of that Act);