to enable consumers in those sectors to request accredited persons to give instructions:

safely, efficiently and conveniently on behalf of the consumers; and

to service providers in those sectors;

may require these kinds of disclosures, and other things, to be done in accordance with data standards.

enable consumers in those sectors to request accredited persons to give instructions on behalf of the consumers to service providers in those sectors for the performance of actions; and

require these kinds of disclosures and other things to be done, and these kinds of instructions to be given, in accordance with data standards.

one or more types of actions for which an instruction may be given under the consumer data rules; and

for each of those action types—the classes of data holders, of CDR data, that are to be action service providers for that type of action.

for an instrument under subsection 56AC(2)—the person or body (if any) that the Secretary believes to be the primary regulator of the sector that the instrument would designate;

for an instrument under the Secretary believes to be a regulator of a type of actions that the instrument would declare;section 56ACA—a person or body (if any) that

information that:

relates to a CDR consumer for a CDR action; and

an accredited action initiator for CDR actions of that type is authorised by the consumer data rules to use, or disclose, to prepare or give a valid instruction for the performance of the CDR action on behalf of the CDR consumer; or

information that is not covered by paragraph (a) or (aa) of this subsection, but is wholly or partly derived from information covered by:

paragraph (a) or (aa) of this subsection; or

a previous application of this paragraph.

is holding the CDR data as an action service provider for a type of CDR action; or

the performance of the CDR action:

is for the person; or

relates to the person because of circumstances of a kind prescribed by the regulations; and

the performance of the CDR action is not for the person as:

an accredited action initiator for CDR actions of that type; or

an action service provider for CDR actions of that type; and

none of the exclusions (if any) prescribed by the regulations apply to the person in relation to the CDR action.

neither the CDR data, nor any other CDR data from which it was directly or indirectly derived, was disclosed to the person under the consumer data rules; and

(b) the designation instrument (see subsection (1)) also specifies, as described in paragraph 56AC(2)(b), a class of persons (the core data holders) as holding a class of information to which the CDR data belongs; and

the person is not a core data holder, but is a voluntary action service provider for a type of CDR action; and

the classes of data holders declared in the CDR declaration for that type of CDR action include the core data holders; and

the conditions (if any) specified in the consumer data rules are met.

the person, or a class of persons to which the person belongs, is specified, as described in paragraph 56AC(2)(b), in the designation instrument as holding a class of information to which the CDR data belongs; and

the CDR data, or any other CDR data from which it was directly or indirectly derived, was disclosed to the person under the consumer data rules; and

the conditions specified in the consumer data rules are met.

the CDR data, or any other CDR data from which it was directly or indirectly derived, either:

was disclosed to the person under the consumer data rules; or

is covered by subsection (2) for the person; and

the CDR data is information that relates to a CDR consumer for a CDR action; and

the person is authorised by the consumer data rules to use or disclose that information to prepare or give a valid instruction for the performance of the CDR action on behalf of the CDR consumer.

is within a class of data holders (of CDR data) declared in the CDR declaration for that type of CDR action; or

is a voluntary action service provider for that type of CDR action.

paragraph (1)(a) does not apply to the person for that type of CDR action; and

the person holds an approval, of the kind described in subsection 56BHA(1), under the consumer data rules for that type of CDR action.

the person is an accredited person; and

the person’s accreditation authorises the person to initiate that type of CDR action.

different rules for different classes of:

action service providers for types of CDR actions; or

accredited persons; or

CDR consumers for CDR actions.

initiating CDR actions (see also section 56BGA);

approving persons to be voluntary action service providers for types of CDR actions (see also section 56BHA);

the CDR data is covered by paragraph 56AI(1)(a) or (aa); and

a data holder of other CDR data; or

an action service provider for a type of CDR action; or

other CDR data within a class specified, as described in paragraph 56AC(2)(a), in an instrument designating a sector under subsection 56AC(2); or

other CDR data, about a CDR consumer for a CDR action, that an accredited action initiator is authorised to use to prepare or give a valid instruction for the performance of the CDR action.

can only include rules affecting the data holder that relate to the deletion of the CDR data if:

the CDR data; or

any other CDR data from which it was directly or indirectly derived;

can only include rules affecting the data holder that relate to the use, accuracy, storage or security of the CDR data if such rules also relate to the disclosure of the CDR data under the consumer data rules.

requirements on an accredited action initiator for a type of CDR action relating to giving a valid instruction:

for the performance of a CDR action of that type; and

to an action service provider for a CDR action of that type; and

on behalf of a CDR consumer for the CDR action, and in response to that consumer’s valid request; and

after a series of specified kinds of interactions between that initiator, provider, consumer or other persons (whether involving all or any 2 of them);

rules about how an instruction must be prepared for it to be a valid instruction of the kind described in paragraph (a), what matters a valid instruction may cover, and when an instruction ceases to be a valid instruction;

rules about:

how a CDR consumer for a CDR action may make a valid request of the kind described in subparagraph (a)(iii); and

what must be included in a request for it to be valid, what matters a valid request may cover, and when a request ceases to be a valid request;

for an accredited action initiator for a type of CDR action who is acting as described in paragraph (a) to give a valid instruction on behalf of a CDR consumer for a CDR action—rules authorising the initiator to use or disclose information relating to the consumer that:

is disclosed to the initiator; or

is otherwise held by the initiator;

requirements on an action service provider for a type of CDR action relating to how the provider processes a valid instruction of the kind described in paragraph (a);

rules relating to the interactions described in subparagraph (a)(iv);

rules relating to the privacy safeguards in relation to an instruction or request relating to a CDR action;

rules relating to information that is not CDR data, but that relates to a CDR action.

rules authorising a CDR action participant to disclose all or part of specified CDR data to a person in accordance with a valid consent of a CDR consumer for the CDR data;

rules authorising a person to use CDR data in accordance with a valid consent of a CDR consumer for the CDR data;

rules about:

how a CDR consumer for the CDR data may make a valid consent of the kind described in paragraph (a) or (b); and

what must be included in a consent for it to be valid, what disclosures, uses or other matters a valid consent may cover, and when a consent ceases to be a valid consent.

is information referred to in paragraph (1)(d), or is directly or indirectly derived from other information referred to in that paragraph; and

is disclosed to a CDR action participant under the consumer data rules (whether the disclosure is directly or indirectly from the accredited action initiator referred to in that paragraph);

specified types of CDR actions; or

rules specifying what a person accredited at a particular level is authorised to do (or not authorised to do);

to vary, suspend or revoke an accreditation; or

to refuse to make a decision described in paragraph (a);

rules for the approval of persons who apply to be action service providers for one or more types of CDR actions;

the criteria for a person to be so approved;

rules providing that such approval may be granted subject to conditions, and that conditions may be imposed on such an approval after it has been granted;

rules providing that such approvals may be granted at different levels corresponding to different risks, including the risks associated with:

specified types of CDR actions; or

specified classes of CDR data; or

specified classes of applicants for such approvals;

rules specifying what a person approved at a particular level is authorised to do (or not authorised to do);

rules for the period, renewal, transfer, variation, suspension, revocation or surrender of such approvals;

notification requirements on persons whose such approvals have been granted, renewed, transferred, varied, suspended, revoked or surrendered;

rules about publishing details of such approvals, renewals, transfers, variations, suspensions, revocations or surrenders;

transitional rules for when such an approval is varied, is suspended or ends, including about the disclosure, collection, use, accuracy, storage, security or deletion of CDR data;

rules conferring functions or powers on the Minister for any of the matters described in this subsection.

the criteria may differ for different classes of persons; and

the criteria may permit a person to be approved even if the person:

is not a body corporate established by or under a law of the Commonwealth, of a State or of a Territory; and

(ii) is neither an Australian citizen, nor a permanent resident (within the meaning of the Australian Citizenship Act 2007); and

the criteria may include the payment of a fee.

to grant, vary, suspend or revoke such an approval; or

to refuse to make a decision described in paragraph (a);

a person able to make any of the kinds of decisions described in subsection (5) may supply to another person a copy or extract that:

is from a publication of details described in paragraph (1)(h), where those details are matters of fact; and

is certified by the person to be a true copy or a true extract (as applicable); and

(b) such a certified copy or extract (the certificate) is admissible in any proceedings as prima facie evidence of the original; and

the certificate must not be admitted in evidence in proceedings relating to a person unless:

the person; or

a barrister or solicitor who is representing the person in the proceedings;

a power for a CDR consumer for a CDR action to direct an accredited action initiator for CDR actions of that type to give the consumer, or an accredited person, reports about:

the consumer’s valid request made to the initiator, under rules like those described in subsection 56BGA(1), for the giving of a valid instruction for the performance of the CDR action; or

a valid instruction given by the initiator, under rules like those described in subsection 56BGA(1), on behalf of the consumer and for the performance of the CDR action;

a power for a CDR consumer for a CDR action to direct an action service provider for CDR actions of that type to give the consumer, or an accredited person, reports about the provider’s processing of any valid instruction given to the provider:

on behalf of the consumer under rules like those described in subsection 56BGA(1); and

for the performance of the CDR action;

an action service provider for a type of CDR action;

consider the following kinds of matters in relation to making a rule described in subsection 56BGA(2) (about fees at the instruction layer) for a type of CDR action:

whether performers of actions of that type currently charge fees for processing instructions to perform such actions;

whether the incentive to perform actions of that type would be reduced if fees could not be charged for processing such instructions;

the marginal cost of processing such instructions in accordance with the consumer data rules; and

a person has satisfied any criteria under the consumer data rules for the making of a request, the giving of a valid instruction, or the processing of a valid instruction, for the performance of a CDR action.

a person has satisfied any criteria under the consumer data rules for:

the making of a request; or

the giving of a valid instruction; or

the processing of a valid instruction;

(a) the amount of a fee, or a method for working out the amount of a fee, that a specified class of CDR participants for specified chargeable CDR data may charge (or cause to be charged) for either or both of the following matters (the chargeable matters):

the disclosure of the chargeable CDR data in chargeable circumstances because of a requirement under the consumer data rules to do so;

the use of the chargeable CDR data in chargeable circumstances as the result of such a disclosure; and

the specified persons who are liable to pay that fee;

(a) the amount of a fee, or a method for working out the amount of a fee, that the CDR participant may charge (or cause to be charged) for either or both of the following matters (the chargeable matters):

the disclosure of the chargeable CDR data in chargeable circumstances because of a requirement under the consumer data rules to do so;

the use of the chargeable CDR data in chargeable circumstances as the result of such a disclosure; and

the specified persons who are liable to pay that fee;

reflects the reasonable costs (including capital costs) necessary for the CDR participants or CDR participant to comply with this Part and the consumer data rules in relation to the chargeable matters; and

is reasonable having regard to the criteria in subsection (4).

the matters in subparagraphs 56AD(1)(a)(i), (ii), (iv) to (vi) and (c)(ii) and (iv); and

whether a lower fee could result in an acquisition of property (within the meaning of paragraph 51(xxxi) of the Constitution) otherwise than on just terms (within the meaning of that paragraph); and

whether a lower fee would reduce the incentive to generate, collect, hold or maintain CDR data of that kind; and

any other matters the Commission considers relevant.

the person is an accredited person; and

the person’s accreditation authorises the person to initiate a type of CDR action; and

the person engages in conduct that includes:

proposing to a potential CDR consumer for a CDR action of that type that the person give a valid instruction under the consumer data rules for the performance of the CDR action; or

giving a valid instruction under the consumer data rules for the performance of a CDR action of that type; and

the person fails to act efficiently, honestly and fairly in relation to a matter described in subparagraph (c)(i) or (ii).

the person is an accredited person; and

the person’s accreditation authorises the person to initiate a type of CDR action; and

the person purports to give a valid instruction:

for the performance of a CDR action of that type; and

to an action service provider for a CDR action of that type; and

on behalf of a CDR consumer for the CDR action; and

when purporting to give that instruction:

there was no valid request by the consumer, made in accordance with the consumer data rules, for the giving of that instruction; or

the person had failed to comply with a requirement in the consumer data rules for giving a valid instruction for a CDR action of that type.

the person is an action service provider for a type of CDR action; and

the person is given a valid instruction under the consumer data rules to perform a CDR action of that type; and

the person fails to perform the CDR action in accordance with the valid instruction; and

having regard to criteria in the consumer data rules, the person would ordinarily perform actions of that type in the course of the person’s business.

the person is an action service provider for a type of CDR action; and

the person is given a valid instruction under the consumer data rules to perform a CDR action of that type; and

the person charges (or causes to be charged) one or more fees for either or both of the following matters:

processing the valid instruction;

performing the CDR action in accordance with the valid instruction; and

either subsection (2) or (3) applies to those fees.

the consumer data rules have not declared, as described in subsection 56BGA(2), that fees may be charged (or caused to be charged) for processing valid instructions for CDR actions of that type; or

the fees for processing the valid instruction exceed any fees:

determined under subsection 56BZE(1) or (2) for the person; or

worked out from a method determined under subsection 56BZE(1) or (2) for the person;

the amount of a fee that a specified class of action service providers for a type of CDR action may charge (or cause to be charged) for processing a valid instruction for a CDR action of that type; or

a method for working out the amount of such a fee;

the amount of a fee that the provider may charge (or cause to be charged) for processing a valid instruction for a CDR action of that type; or

a method for working out the amount of such a fee;

the consumer data rules have declared, as described in subsection 56BGA(2), that fees may be charged (or caused to be charged) for processing valid instructions for CDR actions of that type; and

the Commission is satisfied that the fee that would otherwise be charged (or caused to be charged) is unreasonable having regard to the criteria in subsection (5).

reflects the reasonable costs (including capital costs) necessary for the providers or provider to comply with this Part and the consumer data rules in relation to processing the valid instruction; and

is reasonable having regard to the criteria in subsection (5).

the matters in subparagraphs 56AD(1)(a)(i), (ii) and (iv) to (vi); and

the marginal cost of processing the valid instruction in accordance with the consumer data rules; and

whether a lower fee could result in an acquisition of property (within the meaning of paragraph 51(xxxi) of the Constitution) otherwise than on just terms (within the meaning of that paragraph); and

whether a lower fee would reduce the incentive to perform actions of that type; and

any other matters the Commission considers relevant.

the CDR participant or action service provider specified in the determination; or

a person whose interests are affected by the determination;

may make a decision affirming, setting aside or varying the determination; and

for the purposes of the review, may perform all the functions and exercise all the powers of the Commission.

the person is an accredited person; or

the person is an accredited person holding an accreditation that has been granted at a particular level (see paragraph 56BH(1)(d)); or

the person is an accredited person holding an accreditation that authorises the person to do something (see paragraph 56BH(1)(da)); or

the person is an accredited data recipient of CDR data; or

the person is an accredited action initiator for a type of CDR action; or

the person is an action service provider for a type of CDR action; or

the person is approved as an action service provider at a particular level (see paragraph 56BHA(1)(d)); or

the person’s approval as an action service provider authorises the person to do something (see paragraph 56BHA(1)(e));

$10,000,000;

if the court can determine the value of the benefit that the body corporate, and any body corporate related to the body corporate, have obtained directly or indirectly and that is reasonably attributable to the commission of the offence—3 times the value of that benefit;

if the court cannot determine the value of that benefit—10% of the adjusted turnover of the body corporate during the 12-month period ending at the end of the month in which the commission of the offence happened or began.

the person is an accredited person; or

the person is an accredited person holding an accreditation that has been granted at a particular level (see paragraph 56BH(1)(d)); or

the person is an accredited person holding an accreditation that authorises the person to do something (see paragraph 56BH(1)(da)); or

the person is an accredited data recipient of CDR data; or

the person is an accredited action initiator for a type of CDR action; or

the person is an action service provider for a type of CDR action; or

the person is approved as an action service provider at a particular level (see paragraph 56BHA(1)(d)); or

the person’s approval as an action service provider authorises the person to do something (see paragraph 56BHA(1)(e));

if section 56ED or 56EE applies to an accredited person in relation to CDR data—the corresponding Australian Privacy Principle does not apply to the accredited person in relation to the CDR data; and

if section 56EF or 56EG applies to a person:

who is an accredited person; or

as a CDR action participant;

if section 56EN applies to a disclosure of CDR data by a person:

who is a data holder of the CDR data; or

as an action service provider for a type of CDR action;

if subsection 56EP(1) applies to CDR data and a person:

who is a data holder of the CDR data; or

as an action service provider for a type of CDR action;

subject to paragraphs (ab) to (c) of this subsection; and

in relation to personal information disclosed to the provider under the consumer data rules;

is a data holder of CDR data; or

is an accredited person who is or who may become an accredited data recipient of CDR data; or

is a designated gateway for CDR data; or

as an action service provider for a type of CDR action, has been or may be disclosed CDR data under the consumer data rules;

how a CDR consumer for the CDR data may access the CDR data and seek the correction of the CDR data;

how a CDR consumer for the CDR data may complain about a failure of the CDR entity to comply with this Part or the consumer data rules, and how the CDR entity will deal with such a complaint.

a CDR consumer for the CDR data has validly requested this under the consumer data rules for the purposes described in column 3 of that item; and

the person complies with all other requirements in the consumer data rules for the collection of the CDR data from that other person.

(a) the person (the collector) collected the CDR data while covered by column 1 of an item of the following table, and from a person covered by column 2 of that item; and

the collector collected the CDR data:

purportedly under the consumer data rules; but

not as the result of seeking to collect the CDR data under the consumer data rules; and

the collector is not required to retain the CDR data by or under an Australian law or a court/tribunal order; and

in the case where item 3 of the table applies, the circumstances specified in the consumer data rules do not apply.

take the steps specified in the consumer data rules to notify CDR consumers for the CDR data of the disclosure; and

ensure that this notification:

is given to those of the CDR consumers (if there are more than one) that the consumer data rules require to be notified; and

covers the matters specified in those rules; and

is given at or before the time specified in those rules.

makes a disclosure referred to in subsection (1), (2) or (2A) for a CDR consumer for CDR data; and

later becomes aware that some or all of the CDR data was incorrect when it was disclosed because, having regard to the purpose for which it was held, it was inaccurate, out of date or incomplete;

correct the CDR data; and

disclose the corrected CDR data, in accordance with the consumer data rules, to the recipient of the earlier disclosure;

is requested to do so by the CDR consumer in accordance with the consumer data rules; or

is required to do so by the consumer data rules.

(a) a CDR consumer for CDR data gives a request to the following person (the CDR entity):

a data holder of the CDR data (including a request given through a designated gateway for the CDR data);

a person as an action service provider for a type of CDR action; and

the request is for the CDR entity to correct the CDR data, and is not given in response to advice from the CDR entity under subsection 56EN(3); and

the CDR entity was earlier required or authorised under the consumer data rules to disclose the CDR data;

the privacy safeguards; or

the consumer data rules to the extent that those rules relate to:

the privacy safeguards; or

the privacy or confidentiality of the CDR data.

(a) for item 1 of the table, disregard the following references to information in Privacy Act 1988:Part IIIC of the

the last reference in paragraph 26WG(h);

the reference in the note to section 26WG; and

(b) for item 2 of the table, disregard each reference to entity in paragraphs 26WF(1)(f), (2)(f), (3)(f), (4)(f) and (5)(f) of the Privacy Act 1988.

in the case of a complaint about an act or practice of an action service provider for a type of CDR action, who has been or may be disclosed CDR data under the consumer data rules—the action service provider is the respondent; and

a paragraph that states that an act or practice of an action service provider for a type of CDR action, who has been or may be disclosed CDR data under the consumer data rules, has breached a privacy safeguard; and

if a person holds an appointment under subsection 56CG(1)—that person; or

otherwise—the Commission.

(a) under subsection 56CG(1) of the Competition and Consumer Act 2010; and

in force immediately before the commencement of this Part;

a provision of any other instrument made under this Part;

the act or omission is by (or on behalf of) an Australian person; or

the act or omission occurs wholly or partly in Australia, or wholly or partly on board an Australian aircraft or an Australian ship.

is part of a State or Territory; or

is a body (whether or not incorporated) established for a public purpose by or under a law of a State or Territory; or

is:

holding or performing the duties of an office established by or under a law of a State or Territory; or

holding an appointment made under a law of a State or Territory; or

is an entity prescribed by the regulations in relation to a State or Territory;

the CDR provisions relate to a CDR consumer for CDR data, and the entity is a CDR consumer for CDR data (or would be if the entity were a person); or

the CDR provisions relate to a CDR consumer for a CDR action, and the entity is a CDR consumer for a CDR action (or would be if the entity were a person).

as an accredited person, the entity is conferred such functions as are necessary to enable the entity to operate as an accredited person in accordance with the CDR provisions; or

as a data holder of CDR data;

as an accredited person;

as a designated gateway for CDR data;

as an action service provider for a type of CDR action.

had been made under that subsection as substituted by this Part; and

had declared the applicable entity as a participating entity, for the applicable State or Territory, in the capacity as a data holder of CDR data.

CDR action participants;

CDR consumers for CDR actions;

the format and description of a valid instruction for the performance of a type of CDR action;

the giving of a valid instruction for the performance of a type of CDR action;

different provisions for different types of CDR actions; or

different provisions for different classes of action service providers for types of CDR actions; or

each of the different classes or types referred to in any of paragraphs (1)(b) to (d) of this section.

an action service provider for a type of CDR action to which a binding data standard applies; and

each accredited action initiator for a CDR action of that type;

agrees to observe the standard to the extent that the standard applies to the person; and

agrees to engage in conduct that the person is required by the standard to engage in.

as described in paragraph 56BHA(1)(j); and

in the consumer data rules;

CDR declarations for types of CDR actions;

in good faith; and

in compliance with the CDR provisions; and

in compliance with each law (if any) of the Commonwealth, of a State or of a Territory prescribed by the regulations;

particular CDR data or one or more classes of CDR data; or

a particular CDR action or one or more types of CDR actions;

exempt a particular person in relation to:

particular CDR data or one or more classes of CDR data; or

a particular CDR action or one or more types of CDR actions;

exempt a class of persons in relation to:

particular CDR data or one or more classes of CDR data; or

a particular CDR action or one or more types of CDR actions;

declare that provisions covered by this section apply in relation to:

a particular person in relation to particular CDR data or one or more classes of CDR data; or

a class of persons in relation to particular CDR data or one or more classes of CDR data; or

a particular person in relation to a particular CDR action or one or more types of CDR actions; or

a class of persons in relation to a particular CDR action or one or more types of CDR actions;

are made for the purposes of subsection 56GE(2) of that Act; and

are in force immediately before the commencement of this Part;

the person is a corporation; or

the person is not a corporation, but the person:

acts; or

omits to act;

a person (whether or not a corporation) acting or omitting to act in the course of, or in relation to, the carrying on of:

a postal, telegraphic, telephonic or other like service (within the meaning of paragraph 51(v) of the Constitution); or

the business of banking, other than State banking (within the meaning of paragraph 51(xiii) of the Constitution) not extending beyond the limits of the State concerned; or

the business of insurance, other than State insurance (within the meaning of paragraph 51(xiv) of the Constitution) not extending beyond the limits of the State concerned; or

a person (whether or not a corporation):

making a supply or communication; or

conducting an activity or otherwise doing something;

a person (whether or not a corporation) acting or omitting to act in the course of, or in relation to:

trade or commerce between Australia and places outside Australia; or

trade or commerce among the States; or

trade or commerce within a Territory, between a State or Territory or between 2 Territories; or

an individual who is being, has been or is at risk of being subjected to interference, or attacks, of the kind described in paragraph 1 of Article 17 of the ICCPR; or

a person (whether or not a corporation) who is undertaking, has undertaken or could undertake interference, or attacks, of the kind described in paragraph 1 of Article 17 of the ICCPR.

an agency having the function in a foreign country of supervising or regulating types of actions similar to those declared under section 56ACA; or

the last reference in section 26WA;

all references in Division 4 of Part IIIC other than the reference in paragraph 26WU(2)(e); and