made-under-the-competition-and-consumer-act-2010.pdf, p.10
1 Section 1
made-under-the-competition-and-consumer-act-2010.pdf, p.164
Default conditions on accreditations for rule 5.9 of these rules.
Reporting obligation on accredited persons
2 Section 2
made-under-the-competition-and-consumer-act-2010.pdf, p.165
Definition of assurance report and attestation statement
2(1) Section 2
Classifies assurance reports and attestation statements into categories
This clause applies to an accredited person other than one with streamlined accreditation under rule 5.5.
2(1A) Section 2
The clause applies between the specified points in time.
The clause applies between two specific points in time.
(1A) This clause applies to an accredited person other than one with streamlined accreditation under rule 5.5.
The clause applies to the specified type of artificial intelligence.
The clause applies to a specific type of artificial intelligence.
The clause applies to the specified person.
The clause diffuses to all persons within the specified scope.
The clause diffuses to all persons within a certain scope.
Accredited person must provide attestation statement within 3 months after end of reporting period.
2(2) Section 2
made-under-the-competition-and-consumer-act-2010.pdf, p.166
defined third-party management framework, annual review and assurance activities, reporting requirements
Accredited person must have defined third-party management framework for information security.
...will ensure that the person maintains appropriate information security capabilities as an affiliate.
Framework must ensure person maintains appropriate information security capabilities as an affiliate.
(a) has a defined third-party management framework that...
Accredited person must have defined third-party management framework.
...in technical and compliance matters relating to Schedule 2.
Accredited person must provide assistance or training in technical and compliance matters.
(b) provides the person with any appropriate assistance or training...
...includes requirements and activities relating to information security.
Framework includes requirements and activities relating to information security.
...includes requirements and activities relating to information security: (B) annual review and assurance activities.
Framework must include requirements and activities relating to annual review and assurance activities.
Reasonable steps to ensure affiliate complies with obligations under Schedule 2.
The sponsor of an affiliate must maintain the management framework and ensure compliance.
Obligation to maintain management framework and ensure compliance.
made-under-the-competition-and-consumer-act-2010.pdf, p.167
Establish a formal governance framework for managing information security risks.
1(1) Section 1
Duty to establish a governance framework.
Clear documentation of practices and procedures
Accredited data recipient must document information security and management practices.
1(2) Section 1
Accredited data recipient must have an information security policy.
1(3) Section 1
Obligation to maintain an information security policy.
made-under-the-competition-and-consumer-act-2010.pdf, p.168
Accredited data recipient must assess boundaries of CDR data environment.
Accredited data recipient must review CDR data environment for completeness and accuracy.
Must provide review of CDR data environment.
Accredited data recipient must have and maintain an information security capability.
Must comply with applicable information security controls.
Annual review and adjustment of information security capability
Establish and implement a testing program to review and assess the effectiveness of its information security capability.
Must establish and implement a testing program.
Monitor and evaluate security controls for CDR data management.
Duty to monitor and evaluate security controls
Must report deficiencies to senior management
Ensure testing is conducted by appropriately skilled persons independent from controls over CDR data environment.
1(4) Section 1
Temporal interval for ensuring testing is conducted by appropriately skilled persons independent from controls over CDR data environment.
(4) The accredited data recipient must ensure that testing is conducted by appropriately skilled persons who are independent from the performance of controls over the CDR data environment.
Argument for ensuring testing is conducted by appropriately skilled persons independent from controls over CDR data environment.
Diffusion of knowledge about ensuring testing is conducted by appropriately skilled persons independent from controls over CDR data environment.
Review testing program annually or upon material change
1(5) Section 1
made-under-the-competition-and-consumer-act-2010.pdf, p.169
An accredited data recipient must have procedures and practices in place to detect, record, and respond to information security incidents.
Obligation to have procedures and practices in place
Create and maintain plans to respond to information security incidents.
Notification of security breaches and incidents.
Accredited data recipient must notify breaches and incidents.
Must protect CDR data from misuse, interference and loss.
Steps must be taken within the scope of subsection 56EO(1) of the Act.
This Part sets out steps for the purposes of subsection 56EO(1) of the Act.
Steps must be taken by accredited data recipients.
An accredited data recipient must take the steps set out in this Schedule.
Steps must be taken to protect CDR data from misuse, interference and loss.
Subsection 56EO(1) of the Act is a civil penalty provision (see section 56EU of the Act).
All accredited data recipients must take steps to protect CDR data.
Defines terms for the management of CDR data environment and its security capability.
made-under-the-competition-and-consumer-act-2010.pdf, p.171
Multi-factor authentication or equivalent control is required for all access to CDR data.
Requires multi-factor authentication or equivalent control.
made-under-the-competition-and-consumer-act-2010.pdf, p.180
Defines customer data, account data, transaction data and product specific data.
Date of transaction is a characteristic of the transaction.
Defines temporal intervals for transactions
The date on which the transaction occurred;
Meaning of customer data, account data, transaction data and product specific data.
Term listed in column 1 of an item has the meaning set out in column 2 of that item.
Term listed in column 2 of an item has the meaning set out in column 1 of that item.
Characteristics of a transaction include its date.
Describes characteristics of transactions
All of the following: (i) the date on which the transaction occurred;
Characteristics of a transaction include identifiers for counter-parties.
(ii) any identifier for the counter-party to the transaction;
Characteristics of a transaction include merchant information.
(iii) if the counter-party is a merchant—any information provided by the merchant in relation to the transaction;
Details of authorisations for direct debit deductions
Authorises access to account information
made-under-the-competition-and-consumer-act-2010.pdf, p.181
Product must be offered by data holder in sector through standard form contracts.
Imposes a duty on data holders in sectors.
A product need not be available to all members of the public in order to be publicly offered.
made-under-the-competition-and-consumer-act-2010.pdf, p.182
Definition of trial product for banking and non-bank lenders sectors.
Cease to be a trial product after certain conditions are met
Describes temporal intervals for trial product cessation
(a) the product is supplied or offered after the end of the trial period;
Definition of customer data, account data, and transaction data
made-under-the-competition-and-consumer-act-2010.pdf, p.177
Describes the structure and content of Schedule 3
Over time, as set out in that Part, these rules will apply to a progressively broader range of data holders and types of requests in relation to that sector.
Describes the temporal scope of the staged application of rules
Part 6 also affects the application of these rules to the banking sector in some respects.
and defines certain terms relevant to those sectors.
Describes the scope of exclusions for certain data holders
Part 1 of this Schedule excludes certain data holders in the banking sector and NBL sector from the application of these rules...
Describes the modifications to the operation of rules for entities moving between sectors
Part 8 of this Schedule makes certain modifications to the operation of these rules in cases where an entity moves from the NBL sector to the banking sector.
made-under-the-competition-and-consumer-act-2010.pdf, p.178
Excluded data holders in the banking sector or NBL sector
Data holder in banking sector or NBL sector
made-under-the-competition-and-consumer-act-2010.pdf, p.179
accounting standard means an accounting standard made under section 334 of the Corporations Act 2001.
account data has the meaning given by clause 1.3 of this Schedule.
product specific data has the meaning given by clause 1.3 of this Schedule.
customer data has the meaning given by clause 1.3 of this Schedule.
relevant non-bank lender has the meaning given by the NBL sector designation instrument.
covered product has the meaning given by clause 1.4 of this Schedule.
NBL sector means the sector of the Australian economy that is designated by the NBL sector designation instrument.
banking business has the meaning given by the banking sector designation instrument.
NBL sector data means CDR data covered by the NBL sector designation instrument.
banking sector data means CDR data covered by the banking sector designation instrument.
registered religious body means an entity that is: (a) registered under the Australian Charities and Not-for-profits Commission Act 2012 as the type of entity mentioned in column 1 of item 1 of the table in subsection 25-5(5) of that Act; and (b) registered under the Australian Charities and Not-for-profits Commission Act 2012 as the subtype of entity mentioned in column 2 of item 4 of the table in subsection 25-5(5) of that Act.
product has the meaning given by the banking sector designation instrument or the NBL sector designation instrument, as applicable.
made-under-the-competition-and-consumer-act-2010.pdf, p.193
Rules apply after certain periods for product and consumer data requests.
13 July 2025 date as set out in the following table.
made-under-the-competition-and-consumer-act-2010.pdf, p.184
Account must be accessible online for a CDR consumer to be eligible in relation to a data holder.
Account privileges for banking and NBL sectors
Account privileges exist during transactions on accounts
(2) For the banking sector and NBL sector, a person has account privileges in relation to an account the person holds with a data holder in either of those sectors if:
Account privileges exist for banking and NBL sectors if conditions are met
Account privileges exist for banking and NBL sectors
Data holder must provide CDR consumer with a consumer dashboard.
Definition of required product data and voluntary product data
3 Section 3
Definition of required consumer data and voluntary consumer competition
Imposes a duty on entities to provide required consumer data
made-under-the-competition-and-consumer-act-2010.pdf, p.185
Required product data must be disclosed for certain products in the banking sector or NBL sector.
3(1) Section 3
Subclass of product data that must be disclosed.
List of covered products for paragraph (1)(b) purposes
3(2) Section 3
Defines voluntary product data for the banking sector or NBL sector.
3(3) Section 3
Describes the scope of voluntary product data
Defines a relevant account for CDR consumer in banking and NBL sectors
The account is a relevant account for the CDR consumer
Account must be held for at least one year to be considered relevant
Account has been held for at least one year
Account must be open to be considered relevant
Identifies a relevant account based on ownership and access
Account is held in the name of the CDR consumer alone or is a joint account with the CDR consumer
Identifies a relevant account based on partnership and secondary user status
Account is a partnership account for a partnership in which the CDR consumer is a partner or is an account for which the CDR consumer is a secondary user
Account must be accessed online to be considered relevant
made-under-the-competition-and-consumer-act-2010.pdf, p.11
Meeting internal dispute resolution requirements
5 Section 5
Meeting external dispute resolution requirements for the banking sector
Obligation to meet external dispute resolution requirements
made-under-the-competition-and-consumer-act-2010.pdf, p.188
Compliance with Regulatory Guide 271 provisions
Internal dispute resolution requirements for the banking sector and NBL sector.
5(1) Section 5
Must comply with provisions of Regulatory Guide 271
5(2) Section 5
Regulatory Guide 271 has a specific definition
made-under-the-competition-and-consumer-act-2010.pdf, p.189
Meets external dispute resolution requirements if a member of the recognised external dispute resolution scheme.
Meets external dispute resolution requirements
Member of recognised external dispute resolution scheme
Obligation to meet internal dispute resolution requirements
6 Section 6
made-under-the-competition-and-consumer-act-2010.pdf, p.190
Relevant non-bank lender must meet certain value thresholds on commencement day.
6(1) Section 6
The lender must meet the threshold within this time period.
Temporal interval: Commencement day to most recent calendar month for report
the most recent calendar month for which a report was given to the Australian Prudential Regulation Authority...
(a) the total value of the resident loans and resident finance leases reported to the Australian Prudential Regulation Authority...
(b) the total value of the resident loans and resident finance leases reported to the Australian Prudential Regulation Authority...
Recurring trace: Average value over 12 months before commencement day
the total value of the resident loans and resident finance leases reported to the Australian Prudential Regulation Authority...
Lender must meet large provider qualification after first qualifying day
6(2) Section 6
Obligation to meet large provider qualification
Large provider qualification for non-bank lenders
6(3) Section 6
The lender is required to meet the qualification.
Lender must meet large provider qualification on or after commencement day if accredited.
6(4) Section 6
The qualification applies during the accreditation period.
Lender qualification during accreditation period.
(4) A relevant non-bank lender also meets the large provider qualification on a day that is, or is after, the commencement day, if the lender is an accredited person on that day.
The lender is classified as an accredited person.
Lender classification based on qualification.
The qualification implies accreditation.
Cease to meet large provider qualification after ceasing to be accredited and not meeting qualification.
6(5) Section 6
Cease to meet qualification after specified temporal overlap.
Temporal overlap between ceasing accreditation and meeting qualification
(a) ceases to be an accredited person on that later day; and (b) has not met the large provider qualification in subclause (3) at any time before that later day.
Cease to meet qualification if specified conditions occur.
Implication of ceasing accreditation on meeting qualification
Cease to meet large provider qualification after specified conditions.
Lender has obligation to cease meeting qualification.
Obligation to cease meeting qualification
(5) However, a relevant non-bank lender to whom subclause (4) applies is taken, for the purposes of that subclause...
Cease to meet qualification after recurring trace of specified conditions.
Recurring trace of ceasing accreditation and meeting qualification
Lender must provide monthly report if total assets >= $400m.
6(6) Section 6
Defines applicable standards and associated non-bank lenders for the purpose of the Act.
6(7) Section 6
Defines a temporal interval for compliance
Establishes a duty on ADIs and registered financial corporations
ADIs and registered financial corporations must comply with the applicable standards
the applicable standards apply to ADIs and registered financial corporations
applicable standards are defined for the purpose of the Act
made-under-the-competition-and-consumer-act-2010.pdf, p.192
Notify the Commission of certain information upon request.
Notify the Commission in writing if certain conditions are met
Civil penalty of $250,000 for non-compliance with paragraph 6.2(3)(b)
Rules apply to relevant non-bank lenders that are initial providers.
Rules apply to relevant non-bank lenders.
Applicable rules are specified in the table.
Rules do not apply to complex requests under Part 4 for relevant non-bank lenders that are initial providers.
Identifies the relation between the rule and the complex request under Part 4
(2) These rules do not apply to a complex request under Part 4, in relation to a relevant non-bank lender that is an initial provider.
Identifies the cognitive agent application of the rule to relevant non-bank lenders that are initial providers
Rules do not apply to complex requests under Part 4
Identifies the diffusion of the rule to relevant non-bank lenders that are initial providers
Identifies the ordered trace of the rule and the complex request under Part 4
Defines LP date for large non-bank lenders.
Application of rules to large providers with LP date on or before 13 July 2025
Rules apply to large providers with LP date after a certain point.
(3) These rules apply in relation to such a large provider with an LP date that is after
The rule diffuses to all relevant parties.
The rule holds for all large providers with LP dates after the specified point.
made-under-the-competition-and-consumer-act-2010.pdf, p.194
Part 3 of these rules does not apply in relation to NBL sector data.
Prohibits application of Part 3 rules to NBL sector data.
made-under-the-competition-and-consumer-act-2010.pdf, p.195
Part 3 of these rules does not apply in relation to banking sector data.
Applicable to persons becoming unrestricted ADI on or after commencement date.
Conditional commencement of rules for product data requests, consumer data requests, and complex requests.
Requires temporal intervals for commencement
Defines BNPL date for data holders in the banking sector.
Rules apply to data holder with BNPL date on or before the tranche 1 date in respect of CDR data that relates to a BNPL product.
These rules apply in relation to such a data holder with a BNPL date that is on or before the tranche 1 date.
Rules apply to specified type of request.
Application to data holder with BNPL date on or before the tranche 1 date, in respect of CDR data that relates to a BNPL product
Rules apply to data holders with specific BNPL dates and CDR data.
made-under-the-competition-and-consumer-act-2010.pdf, p.197
Data holder may notify Commission to apply Part 2 or Part 4 rules from a specified date.
Data holder may disclose data in response to request.
Compliance with all aspects of these rules relevant to handling requests
Data holder must comply with rules for handling requests from eligible consumers.
Classification of data handling as a task
made-under-the-competition-and-consumer-act-2010.pdf, p.198
Exempts banking sector data from these rules when it relates to a trial product.
Prohibits the application of these rules to banking sector data relating to a trial product.
Rules apply to banking sector data or NBL sector data when a covered product ceases to be a trial product.
7 Section 7
made-under-the-competition-and-consumer-act-2010.pdf, p.200
Criteria for streamlined accreditation in the banking sector
made-under-the-competition-and-consumer-act-2010.pdf, p.201
Sets out how the accreditation criteria operate in relation to the banking sector.
7(1) Section 7
Accredited person exempt from certain rules
7(2) Section 7
Exempts accredited ADIs from certain rules
Condition for accreditation to cease if authority is no longer in force.
The relevant condition is that the accredited person was, at the time of the accreditation, an ADI; and
The accredited person ceases to satisfy the condition if its authority to carry on banking business is no longer in force.
Laws relevant to the management of CDR data—banking sector
Grounds for revocation, suspension and surrender of
made-under-the-competition-and-consumer-act-2010.pdf, p.199
Data holder may elect to comply with rules in place of another data holder.
Rules apply to first data holder in relation to covered product as if it were the second data holder.
Australian Securities and Investments Commission Act 2001 is a law relevant to the management of CDR data in relation to the banking sector and NBL sector.
Australian Securities and Investments Commission Act 2001
Temporal relationship between law relevant to the management of CDR data and banking sector/NBL sector
Definition of law relevant to the management of CDR data
Recurring trace between law relevant to the management of CDR data and banking sector/NBL sector
the collection must occur before or at the same time as the notification
Temporal overlap between collection and notification
(c) the accredited person reasonably believes that the relevant CDR data is relevant to its supply of a product to the CDR consumer, for that data;
(c) the accredited person reasonably believes that the relevant CDR data is relevant to its supply of a product to the CDR consumer, for that data.
the accredited person must provide notification prior to first collection
Obligation to notify before collecting CDR data
(a) the person is an ADI or a relevant non-bank lender;
the notification must diffuse to all relevant parties
Diffusion of notification to all relevant parties
(d) either: (i) the conditions specified in subclause (2); or (ii) the conditions specified in subclause (2A).
the collection must repeat indefinitely if the conditions are met
Repeating pattern of collection and notification
8 Section 8
made-under-the-competition-and-consumer-act-2010.pdf, p.202
Request to be made in respect of banking sector upon certain conditions
8(1) Section 8
Request overlaps with Part 2 or 4 of these rules
(ii) a current authorisation or consent given under Part 4 of these rules in respect of NBL sector data covered by such a request was in existence.
Request taken to be made in respect of banking sector
Obligation to make a request in respect of banking sector
(a) for the purpose of moving to the banking sector, a person ceases to be a data holder in the NBL sector at a particular time (the NBL exit time); and
Request is made in respect of banking sector upon certain conditions
Obligation to make a request in respect of banking sector upon certain conditions
(b) at a time as soon as practicable thereafter (the transition time), the person becomes a data holder in the banking sector;
Request is recurrently made upon certain conditions
Request, consent or authorisation remains effective after transition time.
8(2) Section 8
8(3) Section 8
Must respond to request in accordance with Part 2 or Part 4.
8(4) Section 8
Notify CDR consumer of data holder's sector change
8(5) Section 8
Notify accredited persons of change in sector operation
8(6) Section 8
Accredited person must update consumer dashboard within a reasonable period after receiving notification.
8(7) Section 8
made-under-the-competition-and-consumer-act-2010.pdf, p.15
Definitions and usage of terms in the Act.
Part 2 of these rules deals with product data requests.
Only eligible CDR consumers may make consumer data requests.
Only eligible consumers may request data.
Eligibility is a condition for making data requests.
CDR consumers must be eligible to make requests.
Part 4 of these rules deals with consumer data requests that involve accredited persons.
made-under-the-competition-and-consumer-act-2010.pdf, p.17
Sector Schedules may modify operation of Parts 1 to 9 in relation to a particular sector or sectors and matter.
made-under-the-competition-and-consumer-act-2010.pdf, p.18
Definitions for Competition and Consumer (Consumer Data Right) Rules 2020
made-under-the-competition-and-consumer-act-2010.pdf, p.26
Accredited person must comply with data minimisation principle when collecting CDR data.
Accredited person must comply with the data minimisation principle.
Compliance with data minimisation principle when using or disclosing CDR data.
Obligation to comply with data minimisation principle.
made-under-the-competition-and-consumer-act-2010.pdf, p.27
Determination made under an external dispute resolution scheme
Has a history of insolvency or bankruptcy
Convicted of serious criminal offence or dishonesty
made-under-the-competition-and-consumer-act-2010.pdf, p.28
Defines OSP chain principal relationship in CDR outsourcing arrangements
Each direct and indirect OSP has a temporal relationship with the person
Temporal relationship between OSPs and persons
Person is the OSP chain principal of each direct and indirect OSP
The provider must provide OSP chain principal information for each direct and indirect OSP
Obligation to provide OSP chain principal information
Provider in an arrangement is a direct OSP of a person
The person must provide OSP chain principal information for each direct and indirect OSP
Obligation to provide OSP chain principal information (continued)
Each direct and indirect OSP has a temporal relationship with the person until another OSP takes over
Temporal relationship between OSPs and persons (continued)
Exempts accredited persons and CDR representatives from a specific provision.
compliance with OSP principal's CDR policy and privacy safeguards
Provider must comply with OSP principal's CDR policy and privacy safeguards.
Provider must comply with OSP principal's CDR policy.
(a) where the OSP principal is the OSP chain principal, (b) otherwise
OSP principal must provide goods and services for CDR data collection
Temporal relation between OSP principal and CDR data collection
(4) For subparagraph (3)(a)(ii), the provision of the specified goods or services must...
Rationale for OSP principal's obligation to provide goods and services
Cognitive AI application to OSP principal's obligation to provide goods and services
Obligation to provide goods and services
Diffusion of CDR data collection to OSP chain principal
Provide access to service data, delete records, and provide required records.
made-under-the-competition-and-consumer-act-2010.pdf, p.30
CDR representative must comply with rules and consumer experience data standards.
Seek consent for use or disclosure of service data
Cannot engage provider to collect CDR data except as provided in the arrangement.
not to engage the provider to collect CDR data
except through its CDR representative principal
Because a CDR representative cannot collect CDR data except through its CDR representative principal
not to engage a person as the provider in a CDR outsourcing arrangement
(3) A CDR representative arrangement must require the CDR representative
not to enter into another CDR representative arrangement
Prohibition on entering into another arrangement
CDR representative must comply with specific requirements when handling service data.
(a) in holding, using or disclosing the service data
made-under-the-competition-and-consumer-act-2010.pdf, p.32
Definition of consent types for CDR data collection and use
Establishes obligations for CDR consumers and data recipients
Disclosure consent for specific purposes
Accredited person must not make certain actions.
made-under-the-competition-and-consumer-act-2010.pdf, p.35
Eligibility for CDR consumer based on data holder and time
made-under-the-competition-and-consumer-act-2010.pdf, p.36
Invite a CDR consumer to nominate trusted advisers.
CDR consumer may nominate trusted advisers.
Accredited person or CDR representative may invite a CDR consumer.
A trusted adviser must belong to one of the specified classes.
x belongs to one of the specified classes during the applicable time period.
(2) A trusted adviser must belong to one of the following classes:
x is a trusted adviser if x belongs to one of the specified classes.
The text implies a relationship between class membership and being a trusted adviser.
x is classified as a trusted adviser if x belongs to one of the specified classes.
The text classifies individuals into categories.
(a) qualified accountants within the meaning of the Corporations Act 2001
Class membership is a necessary condition.
(x) x belongs to one of the specified classes.
The text propagates a condition from the class membership to the role of being a trusted adviser.
Member of a class for the purposes of this rule if nominated as trusted adviser
...the person is taken to be a member...
Cannot make certain nominations or give TA disclosure consent without a condition.
(a) the nomination of a trusted adviser;
Cannot give TA disclosure consent without a condition.
(c) the giving of a TA disclosure consent;
Exemption for CDR data collection from trusted adviser
A sponsorship arrangement is a written contract between a sponsor and an affiliate.
Sponsor may make consumer data requests or use/disclose CDR data at affiliate's request.
Permission to make requests or use/disclose data
Consumer dashboards with information relating to consumer data requests, allowing CDR consumers to manage consents and authorisations.
made-under-the-competition-and-consumer-act-2010.pdf, p.38
General obligations of data holders for product data requests and consumer data requests.
Data holder must provide an online service that meets certain requirements.
Service is a product data request service.
The service occurs during the provision of a product data request.
(2) Such a service is a product data request service.
The service is classified as a product data request service using AI.
The service is classified as a product data request service using SHACL.
(a) an online service that can be used by eligible CDR consumers to make consumer data requests directly to the data holder; (b) an online service that can be used by accredited persons to make consumer data requests, on behalf of eligible CDR consumers, to the data holder
Data holder must provide online services for eligible CDR consumers and accredited persons.
Data holder must provide online services.
The data holder's direct request service is specified.
The data holder’s accredited person must request service.
Ensure online service complies with subparagraph (1)(a)(ii)
Temporal interval for ensuring compliance
(4) A data holder does not contravene subrule (1)
made-under-the-competition-and-consumer-act-2010.pdf, p.39
Accredited person must provide consumer with an online service.
made-under-the-competition-and-consumer-act-2010.pdf, p.41
Must provide a specific online service to CDR consumers upon request.
Consumer's right to access their data dashboard.
The data holder must provide the consumer's dashboard.
made-under-the-competition-and-consumer-act-2010.pdf, p.43
Ensure compliance with CDR outsourcing arrangement requirements.
Accredited person must comply with CDR outsourcing arrangement.
Ensure OSP compliance under CDR outsourcing arrangement.
Accredited person breaches subrule if OSP fails to comply with CDR outsourcing arrangement.
Failure to comply with CDR outsourcing arrangement
Principal must be identified when collecting CDR data on behalf of another accredited person.
A provision in a CDR outsourcing arrangement is required if removing it would cease the arrangement.
1(6) Section 1
Requires a provision in a CDR outsourcing arrangement.
CDR representative must comply with requirements under the arrangement.
made-under-the-competition-and-consumer-act-2010.pdf, p.44
Consent from a CDR consumer is required for de-identifying CDR data.
Data recipient must consider certain factors before de-identifying data.
de-identification BETWEEN start and end times
De-identification must occur within a certain timeframe.
(f) other information that would be held, following the completion of the de-identification process, by any person;
Must consider the DDF and techniques for de-identification.
de-identification WILL result in a change to the data
(e) the relevant data after the proposed de-identification;
de-identification BUT before other actions
De-identification must occur before other actions.
De-identify data to required extent and maintain records.
Delete CDR data upon impossibility of data retention.
Data retention period overlaps with impossibility period.
References a framework for de-identification decision-making.
made-under-the-competition-and-consumer-act-2010.pdf, p.45
Identify whether provisions of the Act apply to CDR data
Obligation to identify provisions of the Act
Must retain CDR data while provision applies.
Request to CDR consumer for information about proceedings.
of the kind mentioned in that paragraph are current or anticipated;
Temporal overlap between request and proceedings.
(3) For the purposes of paragraph 56BAA(2)(c)
Requesting information as a form of argument.
Granting permission to request information.
state whether or not proceedings of the kind mentioned in that paragraph are current or anticipated;
Spreading information about proceedings.
Delete CDR data to the extent reasonably practicable.
made-under-the-competition-and-consumer-act-2010.pdf, p.47
Secondary data holder not required to provide request services under rule 1.13.
Secondary data holders must comply with Rule 1.13 for SR data.
Secondary data holder must provide online service for primary data holder to request SR data.
Consumer dashboard provision applies to SR data requests.
Request must be made to primary data holder using direct request service.
Request must be made within primary data holder's direct request service interval
Primary data holder's direct request service
Direct request service is a type of cognitive action
Direct request service is a type of RDF action
Direct request service is a type of semantic action
made-under-the-competition-and-consumer-act-2010.pdf, p.48
Accredited person must make SR data request on behalf of CDR consumer.
1(10) Section 1
Cancelling current requests to the secondary data holder by the primary data holder upon withdrawal of authorisation.
1(11) Section 1
Defines a temporal interval for cancellation of requests.
(3) For subrule (2), giving effect to withdrawal includes...
Establishes a causal relationship between withdrawal and cancellation.
(a) a reference to the data holder were a reference to the primary data holder;
Applies machine learning techniques to infer cancellation from withdrawal.
(b) the following subrule were added after subrule 4.25(2);
Imposes a duty on the primary data holder to cancel current requests.
Spreads the obligation from the primary data holder to the secondary data holder.
Request must be made to primary data holder using their accredited person request service.
Primary data holder's accredited person request service
Rule applies as if primary data holder were data holder for SR data.
Must disclose SR data upon request from primary data holder.
Disclosure of SR data must comply with relevant data standards.
Obligation to disclose SR data in accordance with relevant data standards.
Notify primary data holder of refusal to disclose SR data.
Rule applies to primary data holder for SR data covered by request.
1(7) Section 1
as if the primary data holder were the data holder for any SR data covered by the SR data request.
Exemption from subrule 4.6(4) for SR data not disclosed by secondary data holder
1(8) Section 1
Notification of withdrawal of consent is required.
1(9) Section 1
made-under-the-competition-and-consumer-act-2010.pdf, p.49
Primary data holder cannot use the service mentioned in subrule 1.20(2) except for requesting SR data.
Must not use or disclose SR data for a purpose other than responding to the request.
Defines the temporal scope of the obligation.
(2) Where a secondary data holder provides SR data to a primary data holder in response to such a request:
Establishes the relationship between the obligation and the condition.
(a) the primary data holder must not use or disclose the SR data for a purpose other than responding to the SR data request:
Describes how the obligation is inferred.
Prohibits using or disclosing SR data for a purpose other than responding to the request.
Describes how the obligation is transmitted.
Primary data holder must collect SR data from secondary data holder
made-under-the-competition-and-consumer-act-2010.pdf, p.50
Secondary data holder must provide information to primary data holder upon request.
Primary data holder requests information from secondary data holder.
made-under-the-competition-and-consumer-act-2010.pdf, p.204
Defines the scope and application of the rules in relation to the energy sector.
energy sector data means CDR data covered by the energy sector designation instrument.
This is data for which AEMO is the designated data holder under the energy sector designation instrument.
AER means the Australian Energy Regulator...
...energy sector designation instrument.
DER (for distributed energy resources), in relation to an account, means any...
made-under-the-competition-and-consumer-act-2010.pdf, p.206
Defines customer data, account data, billing data, metering data, NMI standing data, DER register data, product specific data and tailored tariff data.
Applies to explicit class/type/subclass hierarchies
made-under-the-competition-and-consumer-act-2010.pdf, p.208
Retailer definition for energy sector data
Connection points in the National Electricity Market are relevant to retailer activities
Retailer retails electricity during connection points in the National Electricity Market
Retailer authorisation is a property of retailers
Retailer has a retailer authorisation issued under the National Energy Retail Law
Electricity Industry Act 2000 (Vic) is relevant to retailer definitions
Retailer is a retailer within the meaning of the Electricity Industry Act 2000 (Vic)
Retailer retails electricity to connection points in the National Electricity Market
Retailer authorisation and Electricity Industry Act 2000 (Vic) are relevant to retailer definitions
Retailer is either the holder of a retailer authorisation or a retailer within the meaning of the Electricity Industry Act 2000 (Vic)
Plan must be offered with specific descriptions and limitations.
Plan ceases to be trial product after certain conditions occur
Prohibits supplying or offering plan after certain conditions occur
(2) A plan will cease to be a trial product from the time any of the following occurs:
made-under-the-competition-and-consumer-act-2010.pdf, p.228
1 October 2020
made-under-the-competition-and-consumer-act-2010.pdf, p.13
Section 56BA of the Competition and Consumer Act 2010
Data holder must disclose CDR data in response to a valid request
made-under-the-competition-and-consumer-act-2010.pdf, p.14
Sets out details of how the consumer data right works.
References other legislative provisions for interpretation.
11 November 2024
Consumer Data Right Amendment (2025 Measures No. 1) Rules 2025
12 November 2024
15 November 2021
Amendment Rules (No. 1) for Consumer Data Right
16 November 2021 (s 2(1))
18 June 2020
Amendment Rules (No. 2) for Consumer Data Right
19 June 2020
made-under-the-competition-and-consumer-act-2010.pdf, p.210
Eligibility criteria for a CDR consumer to be eligible in relation to a retailer at a particular time.
The consumption associated with the account must be less than 5 GWh in the previous 12 months if the account has been in existence for 12 months or more.
Eligibility criteria apply during the existence of the account.
The CDR consumer must be a customer of the retailer in relation to an eligible arrangement.
Eligibility criteria impose an obligation on the retailer.
Eligibility criteria grant permission to the retailer.
The CDR consumer has the right to be eligible in relation to a retailer at a particular time.
Eligibility criteria create a right for the CDR consumer.
The estimated annual consumption for the account must be less than 5 GWh if the account has been in existence for less than 12 months.
Relates to one or more connection points or child connection points
...definition of account privileges in subrule 1.7(1)
(1) This clause is made for the purposes of...
Account privileges for energy sector customers
(2) For the energy sector, a person has account privileges...
Retailer must provide CDR consumer with consumer dashboard upon request.
Offer consumer dashboard to CDR consumer upon request.
2 October 2020
made-under-the-competition-and-consumer-act-2010.pdf, p.51
Data holder must disclose required product data and may disclose voluntary product data.
Requester may obtain product data from a data holder.
made-under-the-competition-and-consumer-act-2010.pdf, p.52
Data holder must comply with product data request.
• for the banking sector and non-bank lenders sector—clause 3.1 of Schedule 3;
• for the energy sector—clause 3.1 of Schedule 4.
Data holder may disclose voluntary product data to requester.
Must disclose requested voluntary product data through its product data request service and in accordance with the data standards.
2(2A) Section 2
Must disclose requested voluntary product data
Data holder must disclose required product data to requester.
2(3) Section 2
Data must be disclosed within a certain timeframe.
Disclosure implies compliance with rule 2.5.
Data disclosure is inclusive of all required product data.
Data holder not required to disclose product data under certain conditions.
2(4) Section 2
Data holder has an obligation to disclose product data.
(a) a data holder (the first data holder) receives a request for CDR data that relates to a product (the relevant product); and
...the first data holder is not required to disclose the requested required product data under subrule (3).
First data holder not required to disclose product data if second data holder offers it.
(4) If: (a) a data holder (the first data holder) receives a request for CDR data that relates to a product (the relevant product); and (b) the first data holder offers the relevant product on behalf of another data holder (the second data holder), such that the second data holder is the data holder that enters into contracts with consumers to provide the relevant product;
Permits disclosure of CDR data through first data holder's product data request service under certain conditions.
2(5) Section 2
Establishes temporal relationship between data holders' requests for disclosure of CDR data
Requires temporal relation between data holders' requests
(a) the second data holder receives such a request; and (b) the data holders have agreed in writing...
Demands that data holders agree to disclose CDR data through first data holder's product data request service
Requires agreement between data holders on disclosure of CDR data
(b) the data holders have agreed in writing...
Demands that CDR data be disclosed through first data holder's product data request service under certain conditions
Requires disclosure of CDR data through first data holder's product data request service
Establishes an ordered relationship between data holders' requests for disclosure of CDR data
Requires ordered trace of data holders' requests
Disclosure document includes Product Disclosure Statement, key facts sheet, or similar required document.
2(6) Section 2
Subclass of required customer disclosure documents
made-under-the-competition-and-consumer-act-2010.pdf, p.53
Data holder may refuse to disclose required product data under certain circumstances.
Data holder's refusal to disclose product data.
Circumstances set out in the data standards.
Data holder must inform requester of refusal in accordance with data standards.
No conditions or restrictions on data use
21 July 2023
22 December 2020
23 December 2020
made-under-the-competition-and-consumer-act-2010.pdf, p.211
Required product data for the energy sector must be provided to the AER or Victorian agency.
Classifies as required product data for the energy sector.
Data holder must provide CDR data for specific conditions.
Defines relevant account for CDR consumer in energy sector
3 March 2025
made-under-the-competition-and-consumer-act-2010.pdf, p.12
Definition of required and voluntary product data
Definition of required consumer data and voluntary consumer
made-under-the-competition-and-consumer-act-2010.pdf, p.54
Data holder must disclose required consumer data upon valid request.
Obligation to disclose required consumer data.
made-under-the-competition-and-consumer-act-2010.pdf, p.55
Data holder must disclose required consumer data to CDR consumer upon request.
made-under-the-competition-and-consumer-act-2010.pdf, p.56
A fee cannot be charged for the disclosure of required consumer data.
Prohibits charging a fee for disclosure of required consumer data.
Consumer data request must be made by eligible CDR consumer
Data holder must disclose CDR data upon valid consumer request.
Disclosure of voluntary consumer data to the CDR consumer who made the request.
Must disclose requested required consumer data to the CDR consumer
Refusal to disclose required consumer data under certain circumstances.
Defines temporal interval for refusal to disclose required consumer data.
(a) if the data holder considers this to be necessary to prevent physical, psychological or financial harm or abuse; or (aa) in relation to an account that is blocked or suspended; or (b) in circumstances (if any) set out in the data standards.
Describes how CogAI applies to refusal to disclose required consumer data.
Prohibits disclosure of required consumer data.
Describes how refusal to disclose required consumer data spreads.
Defines temporal trace for refusal to disclose required consumer data.
Inform CDR consumer of refusal in accordance with data standards.
Data holder must comply with obligations under this Part in relation to the plan.
4 Section 4
made-under-the-competition-and-consumer-act-2010.pdf, p.62
CDR representative must request principal to collect CDR data and use it for goods/services.
4(1) Section 4
Temporal relation: CDR data collection must be after request
Request principal must be before CDR data collection
Request principal implies CDR data collection
CDR representative needs to use CDR data
CDR consumer is related to CDR representative
Diffusion: CDR representative -> CDR consumer
CDR consumer is a type of CDR representative
Request principal is before CDR data collection
Temporal relation: Request must be before CDR data collection
Request for collection and use of CDR data
4(2) Section 4
Temporal overlap exists between collection and use of CDR data
Temporal overlap between collection and use of CDR data
Collection and use of CDR data occur within the same time frame
CDR consumer consents to collection and use of CDR data
Granting permission to collect and use CDR data
CDR representative principal may request collection consent from CDR consumer
CDR consumer consents to use of CDR data for goods or services
Granting permission to use CDR data for goods or services
CDR representative principal may request use consent from CDR consumer
CDR consumer consents to request additional CDR data from multiple participants
Granting permission to request additional CDR data from multiple participants
CDR representative principal may request additional CDR data from multiple participants
No collection or use of CDR data without consent is permitted
Prohibition on collection and use of CDR data without consent
Collection and use of CDR data require consent
Request for disclosure consent may be bundled with collection and use consent.
4(3) Section 4
Disclosure consent must be given at the same time as collection consent or after collection has occurred.
Request for disclosure consent may be made.
Disclosure of CDR data is subject to the data minimisation principle.
Request to collect CDR data must be valid
4(4) Section 4
Request ceases to be valid if collection consent is withdrawn.
4(5) Section 4
Prohibits request validity upon withdrawal of collection consent.
made-under-the-competition-and-consumer-act-2010.pdf, p.63
Rule 4.7A applies to CDR representatives with service data
Must comply with rule 4.7B when receiving consumer data requests
CDR representative must comply with rule 4.7B
CDR representative reasonably anticipates receiving consumer data requests
Rule 4.7B applies in relation to a CDR representative that receives or reasonably anticipates receiving consumer data requests
CDR representative must comply with rule 4.7B when receiving consumer data requests
CDR representative must comply with rule 4.7B in relation to consumer data requests
Consumer data requests are related to Division 4.3A
Consumer data request by accredited person to data holder
Accredited person may request data holder to disclose CDR data under certain conditions.
made-under-the-competition-and-consumer-act-2010.pdf, p.64
Data holder must disclose requested data if no current authorization and reasonable belief of accredited person's request.
The time period between now and when the authorization was last granted is a temporal interval.
There is no current authorisation for the data holder to disclose the requested data to the person who made the request.
The data holder must disclose the requested data.
No current authorisation for the data holder to disclose the requested data
The data holder has a reasonable belief about the request.
The data holder reasonably believes that the request was made by an accredited person on behalf of an eligible CDR consumer.
The person making the request must be an accredited person.
There is no current authorisation for the data holder to disclose the requested data to the person who made the request; and the data holder reasonably believes that the request was made by an accredited person.
There is a recurring trace from when the authorization was last granted to now.
Data holder must ask CDR consumer for authorization before disclosing voluntary consumer data.
Data holder must authorise disclosure of consumer data
Consumer data request made under rule 4.4 for disclosure of CDR data.
Data holder may disclose requested voluntary consumer data to the person who made the request.
Must provide service through accredited person and in accordance with data standards.
Data holder must disclose required consumer data to the requesting person.
made-under-the-competition-and-consumer-act-2010.pdf, p.65
Disclosure of CDR data is not permitted without account holder's approval.
Prohibition of disclosing CDR data without account holder's approval.
request was made on behalf of a secondary user
made-under-the-competition-and-consumer-act-2010.pdf, p.66
Refusal to disclose CDR data under certain circumstances.
data holder considers this to be necessary
Inform accredited person of refusal in accordance with data standards.
Consumer data request by accredited person to accredited data recipient
Accredited person must request CDR data from accredited data recipient.
Accredited person must request CDR data.
made-under-the-competition-and-consumer-act-2010.pdf, p.67
Accredited data recipient must disclose consumer data if requested by an eligible CDR consumer.
Request was or will be made within a certain timeframe
Accredited data recipient reasonably believes that the request was or will be made by an accredited person on behalf of an eligible CDR consumer
Accredited data recipient must disclose consumer data
AP disclosure consent is required for the accredited data recipient to disclose data
Accredited data recipient must provide AP disclosure consent for the requested data
Request must be made by an accredited person on behalf of an eligible CDR consumer
Must provide AP disclosure consent in accordance with Division 4.3.
made-under-the-competition-and-consumer-act-2010.pdf, p.68
Consent must be voluntary, express, informed, specific, time limited, and easily withdrawable.
Must be voluntary, express, informed, specific, time limited, and easily withdrawable.
Request for consent must comply with data standards and be easy to understand.
Accredited persons must obtain consent from CDR consumers for data collection and disclosure.
Accredited persons must obtain consent from CDR consumers.
Consent requirements for data collection and disclosure.
made-under-the-competition-and-consumer-act-2010.pdf, p.71
Accredited person must not specify a period of time more than 12 months.
Accredited person must not specify a period of time more than 7 years and give option to choose 12 months or less if over 12 months.
4(1A) Section 4
(a) not specify a period of time that is more than 7 years;
Must not specify a period of time more than 7 years.
Must give option to choose 12 months or less if over 12 months.
Classify as a business consumer statement.
(1A) In the case of a consent given by a CDR business consumer that includes a business consumer statement...
made-under-the-competition-and-consumer-act-2010.pdf, p.72
Amendment of consent takes effect when amended by the CDR consumer.
Accredited person may invite CDR consumer to amend consent.
Accredited person may give invitation in writing or via consumer dashboard.
Accredited person may invite CDR consumer to amend consent under certain conditions.
Accredited person has permission to invite CDR consumer to amend consent.
Cannot give invitations too early or too frequently.
...give the invitation any earlier than a reasonable period...
Temporal interval for giving invitations too early or too frequently.
Prohibition of giving invitations too early or too frequently.
...give more than a reasonable number of such invitations within this period.
made-under-the-competition-and-consumer-act-2010.pdf, p.73
Accredited person must allow CDR consumers to amend consents in the same manner.
Accredited person must allow CDR consumers to amend consents.
Accredited person must inform CDR consumer of consequences and ability to use existing data after consent amendment.
Accredited person must inform CDR consumer.
Consumer has right to withdraw consent at any time.
Must provide effect to withdrawal within 2 business days after receiving communication.
Must provide effect to withdrawal within specified timeframe.
CDR data must be deleted when redundant.
made-under-the-competition-and-consumer-act-2010.pdf, p.74
Consent expires after withdrawal or 2 business days
2 business days after communication received
Duration for consent given by a CDR business consumer
Collection consent expires upon notification of withdrawal of authorization.
...the collection consent expires when the accredited person receives that notification.
Temporal overlap of consent expiration and notification
(b) the collection consent has not expired in accordance with subrule (1);...
(a) an accredited person is notified by a data holder...
Diffusion of notification to consent expiration
Temporal until relation of consent expiration and notification
If one consent expires, the other expires when notified.
If one consent expires, the other must be notified.
The consents expire during the same period if they are notified at the same time.
The other consent expires when notified.
The obligation to notify continues until both consents expire.
Consents expire if person becomes data holder instead of recipient.
Describes temporal relationship between consent expiration and data holder status
(5) If an accredited person becomes a data holder, rather than an accredited data recipient...
Describes implication of consent expiration on data holder status
Describes inference of consent expiration on data holder status using AI
Describes propagation of consent expiration to related data holders
Consents expire upon revocation or surrender of accreditation.
4(6) Section 4
Prohibits expiration of consents upon revocation or surrender.
(6) If an accredited person’s accreditation is revoked or surrendered in accordance with rule 5.17, all of the accredited person’s consents expire when the revocation or surrender takes effect.
made-under-the-competition-and-consumer-act-2010.pdf, p.75
Must provide additional information to CDR consumer when seeking de-identification consent.
Delete redundant data after a certain period.
Must delete CDR data when it becomes redundant
Consumer may make election by writing or using consumer dashboard.
Describes temporal relationship between consumer and accredited person
Exemption from rule for accredited persons with general policy of deleting redundant data
(3) This rule does not apply if the accredited person:
made-under-the-competition-and-consumer-act-2010.pdf, p.76
Accredited person must state policy on handling redundant CDR data.
Accredited person must state de-identification process and its implications.
Must provide information about de-identification process.
Subdivision 4.3.5—Notification requirements
Accredited person must notify CDR consumer of changes to consent.
Accredited persons must resolve consumer data requests not yet resolved due to expiring consent.
Notify data holder and accredited data recipient of expired consent.
made-under-the-competition-and-consumer-act-2010.pdf, p.77
Collection consent must be current when use consent is current.
May withdraw use consent or disclosure consent at any time.
Notification must be given in writing, excluding CDR consumer dashboard.
Notification may be included in the CDR consumer's consumer dashboard.
Consumer data request must be resolved if consent is given and AP disclosure consent exists.
...the request has not been completely resolved.
Request must be resolved within the same AP disclosure consent period.
(b) the accredited data recipient has an AP disclosure consent relating to that CDR data...
Must provide resolution for consumer data request.
(a) an accredited person has made a consumer data request to an accredited data recipient...
Accredited data recipient must provide resolution for consumer data request.
Request must be resolved within a certain time frame.
Notify accredited data recipient of expired consent.
made-under-the-competition-and-consumer-act-2010.pdf, p.78
Consumer data request must be resolved if consent is amended
Must provide resolution for amended consent
Notify data holder or accredited data recipient of amended consent.
Information required to be contained on the dashboard
Update CDR consumer dashboard upon change
CDR representative principal may arrange for CDR representative to update consumer dashboard on their behalf.
Consent must be current and not exceed 90 days since last use or notification.
Notification must be given in accordance with data standards.
made-under-the-competition-and-consumer-act-2010.pdf, p.79
Sponsor and affiliate may choose which will give notice to CDR consumer.
made-under-the-competition-and-consumer-act-2010.pdf, p.80
Requires consent to be voluntary, express, informed, specific, time limited, and easily withdrawable
Failure to comply may result in liability for civil penalty provisions.
Liability for civil penalty provisions occurs after failure to comply.
Failure to comply occurs before liability for civil penalty provisions.
CDR representative principal recognizes liability for civil penalty provisions.
CDR representative principal cognizes liability for civil penalty provisions.
Obligation to comply with the Act and rule.
Liability for civil penalty provisions spreads from CDR representative principal.
Failure to comply diffuses liability for civil penalty provisions.
CDR representative principal is liable for civil penalty provisions.
Asserts CDR representative principal is liable for civil penalty provisions.
Must provide consent for data collection, use, and disclosure
Allow CDR consumer to select or indicate types of data
made-under-the-competition-and-consumer-act-2010.pdf, p.81
Redundant data handling after the end of a period
made-under-the-competition-and-consumer-act-2010.pdf, p.83
Cannot specify a period of time more than 12 months
Must not ask for certain consents without complying with data minimisation principle
without complying with data minimisation principle
Cannot ask for consent in certain categories or without subrule (4) for using CDR data.
...for a consent not in a category of consents
(3) A CDR representative must not ask...
made-under-the-competition-and-consumer-act-2010.pdf, p.84
Amendment of consent takes effect when the CDR consumer amends the consent.
A CDR representative may invite a CDR consumer to amend a consent.
Allowance to amend consent via consumer dashboard or in writing
The CDR representative may give the invitation...
CDR representative may invite CDR consumer to amend consent under certain conditions.
...give the invitation any earlier than a reasonable period before the current consent is expected to expire; or...
Must allow CDR consumers to amend consents in the same manner as it asks for them.
Must provide information about consequences of amending consent and ability to use existing CDR data.
made-under-the-competition-and-consumer-act-2010.pdf, p.85
Withdrawal occurs during the Division's applicability
Withdrawal can occur at any time during the Division's applicability
CDR consumer can withdraw consent using different methods
Consumer can withdraw consent using different methods
Consumer has the right to withdraw consent
Must provide a simple method of communication for withdrawal of consent.
Notify other CDR representative of withdrawn consent
Must give effect to withdrawal of consent within 2 business days
Must give effect to withdrawal of consent
made-under-the-competition-and-consumer-act-2010.pdf, p.86
Duration of consent expires at earliest of specified conditions
Withdrawing consent has specific time limits and conditions.
Notification requirement for collection consent expiration
CDR representative principal must provide notification
If one consent expires, the other expires upon notification.
(a) a CDR representative principal has a collection consent...
Consents of CDR representatives expire upon revocation or surrender of accreditation.
...all of the consents of any of the CDR representative principal’s CDR representatives expire when the revocation or surrender takes effect.
Defines a temporal interval for expiration of consents.
(4) If a CDR representative principal’s accreditation is revoked or surrendered...
Describes knowledge representation for de-identification of CDR data.
Subdivision 4.3A.6—Information relating to de-identification of CDR data
Describes information flow regarding de-identification of CDR data.
Defines a temporal trace for expiration of consents.
Additional information relating to de-identification of CDR data
made-under-the-competition-and-consumer-act-2010.pdf, p.87
Provides additional information about de-identification of CDR data
made-under-the-competition-and-consumer-act-2010.pdf, p.21
Data holder has a meaning affected by subrule (2).
Subrule (2) deals with the usage of this term in these rules.
data minimisation principle has the meaning given by rule 1.8.
Definition of data minimisation principle
Data Standards Advisory Committee has the meaning given by rule 8.2.
direct OSP has the meaning given by rule 1.10.
direct request service has the meaning given by subrule 1.13(2).
subrule 1.13(2) deals with the usage of this term in these rules.
disclosure consent has the meaning given by rule 1.10A.
disclosure option has the meaning given by rule 4A.5.
eligible has the meaning given by rule 1.10B.
eligible: (a) in relation to a particular data holder, at a particular time—has the meaning given by rule 1.10B; and
Consumer may opt out of CDR representative's actions
Exemption from rule for CDR representative with general policy of deleting redundant data
made-under-the-competition-and-consumer-act-2010.pdf, p.88
Must state policy on handling redundant CDR data
Must state de-identification process and its implications
Obligation to state de-identification process
Classifies as a subdivision of Notification requirements
Subdivision 4.3A.8—Notification requirements
Must provide notice to CDR consumer upon consent amendment or withdrawal
Failure to comply may result in civil penalty
Temporal relationship between failure to comply and liability
Failure to do this could make the CDR representative principal liable within a certain timeframe
Implication of failure to comply on liability
Failure to do this could make the CDR representative principal liable for a civil penalty (see rule 1.16A)
Failure to do this could make the CDR representative principal liable
Accredited person must resolve consumer data request on behalf of CDR representative within consent expiration.
Request must be resolved within consent expiration.
Temporal interval for consent expiration
Request has not been completely resolved.
Notify data holder or accredited data recipient of expired consent.
made-under-the-competition-and-consumer-act-2010.pdf, p.89
(b) the use consent, or any disclosure consent, is current
Collection consent and use consent overlap in time
but (b) the use consent, or any disclosure consent, is current
CDR representative must provide current collection consent
Collection consent diffuses to all relevant parties
Collection consent must be recurrently provided
CDR representative must notify CDR consumer of withdrawal and deletion options.
Notification must be given in writing, excluding consumer dashboard.
Consumer dashboard may be provided on behalf of the CDR representative principal.
Notify accredited data recipient of expired collection consent or AP disclosure consent
made-under-the-competition-and-consumer-act-2010.pdf, p.90
Consumer data request not completely resolved, amend consent required
During the time the request is not completely resolved, amend consent required
Request not completely resolved during amendment period
The request has not been completely resolved
CDR representative principal must amend consent
Collection consent given under this Division relating to particular CDR data and a particular CDR participant
CDR representative principal permitted to amend consent
Notify data holder and accredited data recipient of amended consent.
Inform the CDR representative principal about changes to consumer dashboard information.
Must inform the CDR representative principal
Must make changes to the CDR dashboard as soon as practicable.
made-under-the-competition-and-consumer-act-2010.pdf, p.57
Request for consumer data must be authorized by the CDR consumer.
Request for consumer data must be authorized.
Consent must be current and 90 days have elapsed since the latest of several events.
The consent is current if 90 days have passed since the last event.
90 days have elapsed since the latest of several events.
A 90-day period has elapsed since the latest of several events.
A notification must be provided to the CDR consumer.
The CDR representative or the CDR representative principal last notified the CDR consumer that the consent is still current.
A use must be made of the consumer dashboard.
The CDR consumer last used the CDR representative principal’s consumer dashboard.
made-under-the-competition-and-consumer-act-2010.pdf, p.92
Data holder's processes for seeking authorisation must be easy to understand.
Processes must be easy to understand during consumer experience
Must provide processes for seeking authorisation
Processes must be easy to understand until consumer experience ends
Must invite CDR consumer to amend authorization
Amendment to disclose CDR data not in accordance with subrule (1) is ineffective.
Must provide information to CDR consumer about authorisation or amendment
Data holder must provide specified information to CDR consumer.
made-under-the-competition-and-consumer-act-2010.pdf, p.93
Right to withdraw authorization for disclosure of CDR data
Temporal overlap between withdrawal and disclosure
Withdrawal occurs before or at disclosure
Must provide effect to withdrawal within 2 business days
Duration of authorisation to disclose CDR data
Data holder must respond to withdrawal request within 2 business days.
Within 2 business days after receiving communication.
made-under-the-competition-and-consumer-act-2010.pdf, p.59
Withdrawal of authorisation triggers cessation of data collection.
Notification in accordance with data standards
made-under-the-competition-and-consumer-act-2010.pdf, p.94
Notify accredited person of expired authorization
Update consumer dashboard upon change of required information.
Secondary user must amend or withdraw authorisation upon request.
The secondary user must amend or withdraw authorisation upon request.
(a) an accredited person makes a consumer data request under this Part on behalf of a secondary user for a particular account;
(b) the secondary user amends or withdraws an authorisation, or an authorisation given by the secondary user expires;
Note: The data holder must provide each relevant account holder with a consumer dashboard in accordance with rule 4A.13.
made-under-the-competition-and-consumer-act-2010.pdf, p.101
Account holders must approve disclosure in accordance with rules.
Account holders must approve disclosure.
made-under-the-competition-and-consumer-act-2010.pdf, p.106
Accreditation surrendered if no sponsor for 120 days
4(7) Section 4
(7) If the person has not had a registered sponsor for a period of 120 days, the accreditation is taken to have been surrendered.
Prohibition on accreditation without sponsor
Registered sponsor must notify CDR Accreditor
4(8) Section 4
made-under-the-competition-and-consumer-act-2010.pdf, p.117
Accredited person cannot collect data while suspension is in effect.
Prohibits collecting data during suspension.
made-under-the-competition-and-consumer-act-2010.pdf, p.145
Requirements for a notice to be given to a CDR consumer under subrule
Requirements for CDR participant notification and administrative services
Notification requirements are obligations for CDR participants
made-under-the-competition-and-consumer-act-2010.pdf, p.146
Ensure CDR consumer is aware of data leaving the system.
4(1B) Section 4
Standard must indicate binding and specify commencement and compliance dates.
Consumer testing of data standards is required.
made-under-the-competition-and-consumer-act-2010.pdf, p.60
Accredited person must ask CDR consumer to authorise disclosure of requested data.
Accredited person may request collection and use of CDR data
Request for disclosure consent in relation to CDR data
4(2A) Section 4
Consent for affiliate to collect CDR data is consent for sponsor to collect it.
4(2B) Section 4
Request for collection consent must specify affiliate relationship
Must provide valid request for CDR data collection
Collection consent withdrawal invalidates request.
Notification requirement applies during use of CDR data.
Use of CDR data after consent withdrawal
Accredited person must obtain CDR consumer's consent for data request.
made-under-the-competition-and-consumer-act-2010.pdf, p.150
Records to be kept and maintained by CDR representative principal
Records must contain specific information
made-under-the-competition-and-consumer-act-2010.pdf, p.152
Record must include date and time of creation and, if applicable, event described by the record.
Provide English translation of records upon request
made-under-the-competition-and-consumer-act-2010.pdf, p.214
Permits one agency to act on behalf of another agency.
The energy sector agencies are the AER and the Victorian agency.
Data holder not required to provide product data request service
Data holder must comply with rule 1.12 if providing online service.
Defines SR data and primary data holder for the energy sector.
Defines SR data and primary data holder.
Class hierarchy for SR data and primary data holder.
Retailer must obtain SR data from AEMO upon request.
Civil penalties do not apply to energy sector data.
Prohibits civil penalties for energy sector data.
Amendment history for Competition and Consumer (Consumer Data Right) Rules 2020
4 March 2025
made-under-the-competition-and-consumer-act-2010.pdf, p.20
4A Section 4A
Consumer data request to a data holder under Part 4 must comply with this Division.
4A(1) Section 4A
Separate application for each joint account
4A(2) Section 4A
Consumer data request handling for joint accounts
4A(3) Section 4A
Data holder must offer pre-approval disclosure option.
Must offer pre-approval disclosure option.
Do not disclose further CDR data after withdrawal of approval.
Requester must be asked for authorisation
4A(4) Section 4A
made-under-the-competition-and-consumer-act-2010.pdf, p.102
Account holder must approve disclosure of joint account data.
The approval is part of the request for disclosure of joint account data.
Approval of disclosure of joint account data
Obligation to approve disclosure of joint account data
Relevant account holder approves disclosure
Consumer may withdraw approval at any time using their consumer dashboard.
Data holder must provide online service with specific details and functionality.
Must include service in consumer dashboard if already provided.
Obligation to include service in consumer dashboard.
Data holder must provide consumer dashboard for relevant account holder.
Ensure online service complies with paragraph (1)(g)
The temporal interval is between the time of taking steps and the time of non-compliance
(4) A data holder does not contravene paragraph (1)(g)
The data holder must take reasonable steps to ensure compliance
Obligation to comply with paragraph (1)(g)
The diffusion operator applies to the obligation
The temporal logic includes the between operator
Joint account holders must provide access to approvals under this Division.
4A(5) Section 4A
Joint account holders must provide access to approvals.
made-under-the-competition-and-consumer-act-2010.pdf, p.103
Notification requirements for consumer data requests on joint accounts
made-under-the-competition-and-consumer-act-2010.pdf, p.104
Notify joint account holder of event within a specified timeframe.
Has a part-of relationship with the ordinary means of contacting joint account holders
ordinary means of contacting joint account holders
Must provide alternative notification schedules and allow selection change
Obligation to provide alternative notification schedules
Data holder must have alternative notification schedules
Data holder not liable for failure to comply if necessary to prevent harm.
made-under-the-competition-and-consumer-act-2010.pdf, p.95
Special rules apply for joint accounts in consumer data requests.
made-under-the-competition-and-consumer-act-2010.pdf, p.135
Update consumer dashboard with disclosed CDR data and disclosure time.
CDR data, disclosure time, and trusted adviser information.
Update consumer dashboard with disclosed CDR data and disclosure details.
4A(3A) Section 4A
Disclosure of service data by a CDR representative is taken to be a disclosure by the CDR representative principal.
Joint account holders must agree on changes to disclosure options.
Joint account holders have an obligation to agree on changes.
Joint account holders are part of a class that must agree on changes.
made-under-the-competition-and-consumer-act-2010.pdf, p.96
Defines the scope of a consumer data request for joint accounts.
The joint account data includes all CDR data related to the joint account.
Defines the temporal scope of the joint account data.
The joint account data is the CDR data relating to the joint account that was the subject of the request.
Defines the scope of the Competition and Consumer (Consumer Data Right) Rules 2020.
This section defines the scope of Part 4A.
The general provisions apply to customer data related to another joint account holder.
Specifies the applicability of the general provisions in the sector Schedules.
The CDR data that can be requested on behalf a CDR consumer is governed by the relevant general provisions in the sector Schedules.
The relevant account holders are all joint account holders if the requester is a secondary user, or the other joint account holders if the requester is a joint account holder.
Identifies the requester and relevant account holders.
The requester is the person on whose behalf the consumer data request was made.
Customer data that relates to another joint account holder cannot be covered by a consumer data request.
Specifies the type of data that can be requested on behalf of a CDR consumer.
The disclosure options apply to all joint account holders.
Specifies the scope of the disclosure options for joint accounts.
Disclosure options are specified in Division 4A.2.
made-under-the-competition-and-consumer-act-2010.pdf, p.97
Data holder must offer disclosure options to joint account holders.
Data holder must offer disclosure options.
Disclosure of joint account data may be authorised only as permitted by the disclosure option that applies to the joint account.
made-under-the-competition-and-consumer-act-2010.pdf, p.98
Must provide service to joint account holders for changing disclosure options.
Disclosure option management service requirements
Requires disclosure option management service
Service must be provided online and may be included in a data holder's consumer dashboard.
Service must be provided online during the same time as the data holder's consumer dashboard.
Service may be provided other than online.
Service must give effect to a change in disclosure option as soon as practicable.
Do not add requirements, offer additional services, reduce comprehensibility, or pre-select options.
4A(6) Section 4A
Disclosure option must be indicated to joint account holder.
4A(7) Section 4A
Service must comply with data standards.
4A(8) Section 4A
made-under-the-competition-and-consumer-act-2010.pdf, p.99
Joint account holder may choose non-disclosure option for joint account.
Permission to choose non-disclosure option.
Joint account holder may choose to apply co-approval option at any time.
Explanation, information about previous and current options
Notify joint account holders of changes to disclosure option
Explain mechanisms for changing disclosure option
Joint account holder must invite other account holders to respond to proposal.
Invite other account holders to respond.
Joint account holder proposes to change disclosure option.
Inform joint account holders about consumer data right and disclosure option
Classifies information about consumer data right and disclosure option
a consent is current if it has not expired in accordance with rule 4.14 or
Consumer data request made under section 1.7 definition
data standards expressed to be consumer experience data standards
Consumer experience data standards definition
an accredited person on behalf of a CDR consumer
made-under-the-competition-and-consumer-act-2010.pdf, p.108
The person complies with the obligations set out in rule during their term of accreditation if they are accredited
Temporal relationship between accreditation and compliance
If accredited, the person can comply with the obligations set out in rule during their term of accreditation.
The person complies with the obligations set out in rule if they meet the criteria for accreditation
Conditional relationship between accreditation and compliance
If the accreditation applicant meets the criteria for accreditation, then they can comply with the obligations set out in rule.
Implication of meeting accreditation criteria on compliance (cognitive AI)
Meeting the criteria for accreditation implies that the person can comply with the obligations set out in rule.
If accredited, the person can comply with the obligations set out in rule
The accreditation applicant meets the criteria for accreditation.
Implication of meeting accreditation criteria on compliance
Meets criteria for streamlined accreditation
Must give accreditation number to accredited applicant
Notify accreditation applicant of decision to accredit or refuse
Must provide notice with accreditation details
Notice must include applicant's rights to have decision reviewed.
5(3) Section 5
made-under-the-competition-and-consumer-act-2010.pdf, p.109
Accreditation takes effect when the fact is included in the Register of Accredited Persons.
CDR Accreditor has decided to accredit the person
CDR Accreditor may impose conditions on accreditation.
Power to exercise at time of accreditation or after
5(1A) Section 5
Temporal overlap of accreditation and power exercise
(1A) The CDR Accreditor may exercise a power...
Inform and hear accreditation applicant/accredited person before exercising power.
Imposing or varying a condition without complying with subrule (2) may be done, but must provide an opportunity for the accredited person to be heard.
Imposing or varying a condition without complying with subrule (2)
Condition must include effective time or date.
5(4) Section 5
made-under-the-competition-and-consumer-act-2010.pdf, p.110
Notify accredited person of changes to accreditation conditions.
Indicates when the notification must be provided.
Must include condition or variation details and applicant's review rights.
Accredited person must take steps to protect CDR data and meet dispute resolution requirements.
Accredited person must take steps to protect CDR data.
An accredited person must be a fit and proper person to be accredited.
made-under-the-competition-and-consumer-act-2010.pdf, p.111
Accredited person must comply with conditions of accreditation.
Notify the CDR Accreditor within 5 business days of material changes or errors in information.
Accredited person must notify CDR Accreditor within 5 business days of certain events.
made-under-the-competition-and-consumer-act-2010.pdf, p.112
Provide information to the Accreditation Registrar upon specified events
Prohibition of transferring accreditation
Revocation, suspension or surrender of accreditation is prohibited without the accredited person's consent.
Prohibition of accreditation surrender without consent.
CDR Accreditor must accept accredited person's surrender in writing.
made-under-the-competition-and-consumer-act-2010.pdf, p.115
Inform accredited person and associates of proposed revocation.
Notify accredited person and associates of revocation upon request for accreditation revocation.
Associate of the accredited person must be a sponsor or affiliate.
(3) For this rule, each of the following is an associate of the accredited person:
May suspend accreditation under specified conditions.
CDR Accreditor may remove suspension in writing.
This rule applies subject to another rule.
Information about proposed suspension or extension
Inform accredited person of proposed suspension or extension and give reasonable opportunity to be heard.
Suspension or extension must occur within a reasonable timeframe
Accredited person's input is relevant to the decision-making process
CDR Accreditor has permission to suspend accreditation
Accreditor must notify accredited person of suspension and period.
made-under-the-competition-and-consumer-act-2010.pdf, p.116
Suspension or extension of accreditation on urgent grounds may not comply with rule 5.20 prior to the suspension or extension.
suspension or extension may not comply with rule 5.20 prior to the suspension or extension
Temporal relationship between urgency and compliance
CDR Accreditor proposes to suspend accreditation on urgent grounds
suspension may not comply with rule 5.20 prior to the suspension or extension
Permission to suspend accreditation on urgent grounds
CDR Accreditor proposes to suspend accreditation
Obligation to comply with rule 5.20 before suspension or extension
extension may not comply with rule 5.20 prior to the extension
CDR Accreditor proposes to extend suspension
Accreditor may not comply with rule 5.20 before suspending accreditation.
Compliance with rule 5.20 must occur within a specific temporal interval before suspension.
Temporal interval for compliance with rule 5.20 before suspension.
(2) The Accreditor may suspend the accreditation, or extend the suspension, without first complying with rule 5.20.
CogAI classifies rule 5.20 as a prohibition.
Classification of rule 5.20 as a prohibition by CogAI.
The Accreditor must comply with rule 5.20 before suspending accreditation.
Prohibition of non-compliance with rule 5.20 before suspension.
The diffusion of compliance requires the Accreditor to comply with rule 5.20 before suspension.
Diffusion of compliance requirement to Accreditor.
Compliance with rule 5.20 must occur within a specific temporal interval before suspension in LTL.
Temporal interval for compliance with rule 5.20 before suspension in LTL.
Inform accredited person of suspension or extension and provide opportunity to be heard.
Duty to inform and provide opportunity for hearing
Surrender, revocation or suspension takes effect when included in the Register of Accredited Persons.
Surrender, revocation or suspension takes effect
Temporal relationship between surrender, revocation or suspension and its effect
The fact that accreditation has been surrendered, revoked or suspended is included in the Register of Accredited Persons.
Condition for surrender, revocation or suspension to take effect
Ongoing obligations following surrender, suspension or revocation of an accreditation
Ongoing obligations are during accreditation
(accreditation surrendered, suspended or revoked) -> (ongoing obligations apply during accreditation)
Entails ongoing obligations after surrender, suspension or revocation
(accreditation surrendered, suspended or revoked) -> (ongoing obligations apply)
Infer ongoing obligations from accreditation status
Continues obligations after surrender, suspension or revocation
(accreditation surrendered, suspended or revoked)
Diffuses to all agents with ongoing obligations
Must comply with specific provisions if accreditation has been surrendered or revoked.
Prohibition on collecting CDR data after accreditation suspension or revocation.
(3) The person must not, after the revocation or surrender...
Obligation to notify CDR consumers of accreditation changes.
(b) if the person has collected any CDR data under these rules—must notify...
Prohibition on withdrawing consents to collect and use CDR data.
(ii) in the case of a suspension—of the following: (A) that any consents...
Prohibition on using CDR data after withdrawal of consent.
Delete or de-identify CDR data if certain conditions apply.
made-under-the-competition-and-consumer-act-2010.pdf, p.105
A person may apply to be an accredited person.
The Accreditation Registrar must enter certain details on the Register of Accredited Persons.
made-under-the-competition-and-consumer-act-2010.pdf, p.118
Maintaining the Register of Accredited Persons
The Accreditation Registrar must create and maintain a database with specific information.
The Accreditation Registrar must create and maintain a database.
The database includes specific information.
Request for data holder or accredited person to provide information
Must comply with a request under subrule (2)
Obligation to inform Accreditation Registrar
Data holder or accredited person must provide updated information to the Accreditation Registrar.
as soon as practicable after becoming aware
Inform Accreditation Registrar of amendment to database
5(5) Section 5
made-under-the-competition-and-consumer-act-2010.pdf, p.120
Must update Register and database upon receiving information from CDR Accreditor and Data Recipient Accreditor.
The Accreditation Registrar updates the Register.
Temporal interval: The Accreditation Registrar must update the Register within a reasonable time frame.
The Accreditation Registrar receives information from CDR Accreditor and Data Recipient Accreditor.
The Accreditation Registrar must update the Register.
Obligation to update Register and database.
The Accreditation Registrar must enter information on the Register.
The Accreditation Registrar may make clerical amendments to entries in the Register or database.
The Accreditation Registrar may amend the database.
Publicly available information must be provided by the Accreditation Registrar.
Must provide information to specified entities on request.
Commission may publish information made available to it by Accreditation Registrar.
Can request data holders or accredited persons to do specified things
Can do things necessary or convenient for performance of functions
made-under-the-competition-and-consumer-act-2010.pdf, p.121
Request to perform a specified action for Register of Accredited Persons or associated database security, integrity and stability.
The Accreditation Registrar may automate processes, including decision-making.
Prevents unauthorized consumer data requests for up to 10 days.
Restricted access period overlaps with consumer data requests
Unauthorized consumer data requests are prohibited
Accreditation Registrar has authority to regulate Register and database
Amending database information for a data holder
Inform data holder of steps taken and give reasonable opportunity to be heard.
Levels of accreditation may be at either of the following levels.
made-under-the-competition-and-consumer-act-2010.pdf, p.122
Directs Accreditation Registrar to prohibit accredited person from making consumer data requests for up to 10 days.
Directs Accreditation Registrar to prohibit action.
Notice must specify direction applicability and period of application.
Must give a reasonable opportunity to be heard before giving a direction.
Must provide an opportunity for hearing.
Accredited person must not make consumer data request contrary to direction received under this rule.
contrary to a direction it has received under this rule.
Prohibition of making consumer data request contrary to direction received under this rule.
Accredited person must not make a consumer data request.
in response to a consumer data request contrary to a direction it has received under this rule.
Data holder must not disclose CDR data in response to consumer data request contrary to direction received under this rule.
A data holder must not disclose CDR data.
made-under-the-competition-and-consumer-act-2010.pdf, p.155
Describe CDR data and changes to goods/services offered
made-under-the-competition-and-consumer-act-2010.pdf, p.215
Internal dispute resolution processes must comply with certain standards.
Retailer must meet internal dispute resolution requirements under National Energy Retail Law or Energy Retail Code (Victoria)
Exempts data holders from Part 6 in energy sector
Relevant provisions for the energy sector
made-under-the-competition-and-consumer-act-2010.pdf, p.216
Accredited persons must meet external dispute resolution requirements.
Membership in the recognised external dispute resolution scheme is required for an AFCA member.
Membership in the recognised external dispute resolution scheme is required.
Must be an EWO member in each relevant jurisdiction
A retailer must use energy sector CDR data only for goods or services within the energy sector.
Retailer must use energy sector CDR data only for goods or services within the energy sector.
(4) A retailer is a limited retailer if: (a) it uses any energy sector CDR data that it collects only in order to provide goods or services within the energy sector; and
Retailer must not use non-energy sector CDR data for goods or services outside the energy sector.
5 February 2020
Schedule 7 Competition and Consumer (Consumer Data Right) Amendment Rules (No. 2)
5 October 2021
This rule applies in relation to a person with sponsored accreditation.
Prohibit making consumer data requests without a registered sponsor.
Prohibit making consumer data requests outside accredited data recipients or registered sponsors.
Prohibition on engaging a provider to collect CDR data
Conditional cessation of registered sponsor
5(6) Section 5
The sponsor must record the person as an affiliate on the Register of Accredited Persons.
The sponsor must record the person as an affiliate.
made-under-the-competition-and-consumer-act-2010.pdf, p.107
Documentation and information required by the approved form
Application requirements for accreditation
Further information to support the application
Further information requested by CDR Accreditor
Consult with relevant authorities when making a decision under this Part.
...the Data Recipient Accreditor may consult with...
Obligation to consult with relevant authorities
(a) other Commonwealth, State or Territory authorities as relevant...
Authority must provide advice or assistance to Data Recipient Accreditor.
Authority must provide advice or assistance.
Duty to disclose information to Data Recipient Accreditor
Temporal overlap between disclosure and consultation
(3) The Australian Securities and Investments Commission may disclose information as reasonably necessary in order to provide the Data Recipient Accreditor with advice or assistance if consulted in accordance with this rule.
Inference of duty from Australian Securities and Investments Commission
Diffusion of information from Australian Securities and Investments Commission
Temporal tracing of disclosure and consultation
made-under-the-competition-and-consumer-act-2010.pdf, p.162
500 Definitions
Amendments apply after a specified period
501 Application—CDR representative arrangements
Amendments apply after 12 months of amending rules commencement
502 Application—information presented to CDR consumer when accredited
Continuation of rule 4.18 for accredited persons
503 Application—CDR receipts given by accredited persons
Continues rule 4.18 for accredited persons
Continuation of rule 4.20 for accredited persons
504 Application—notification of current consents by accredited persons
made-under-the-competition-and-consumer-act-2010.pdf, p.163
505 Application—information presented to CDR consumer when CDR
Amendments apply during specified time period
Continuation of rule 4.20O for CDR representatives
506 Application—CDR receipts given by CDR representatives
Continues to apply rule 4.20U after commencement of amending rules
507 Application—notification of current consents by CDR representatives
Rule 4.20U overlaps with new data standards
Data standards are made for paragraph 8.11(1)(fb)
Rule 4.20U applies to CDR representative
CDR representative is subject to rule 4.20U
Rule 4.20U diffuses to CDR representatives
Accredited persons exempt from amendments to Schedule 3
508 Application—conditions for accredited persons to hold data holders
Accredited persons exempt from amendments
made-under-the-competition-and-consumer-act-2010.pdf, p.123
Data holder must meet internal dispute resolution requirements.
Must provide internal dispute resolution requirements.
Data holder must meet external dispute resolution requirements.
Temporal interval for dispute resolution
See subrule 1.7(3) for the interpretation of references to “data holder”.
An accredited person must also meet the external dispute resolution requirements: see paragraph 5.12(1)(c).
Dispute resolution requirement spreads to other sectors
For the banking sector and non-bank lenders sector—clause 5.2 of Schedule 3;
Recurring dispute resolution requirement
A data holder must meet the external dispute resolution requirements for each designated sector in which the data the holder operates.
made-under-the-competition-and-consumer-act-2010.pdf, p.218
Applicable to retailers receiving AEMO data requests
Requester must initiate correction procedures and provide information about contacting the distributor.
6 February 2020
made-under-the-competition-and-consumer-act-2010.pdf, p.132
Prohibit use or disclosure of CDR data except for permitted uses.
Any use or disclosure of service data by an OSP is taken to have been by the accredited data recipient.
Affiliates are obligated to take CDR data collected by accredited persons.
7(3) Section 7
Affiliates are obligated to take CDR data.
Use or disclosure of service data by CDR representative is taken to be by the principal.
7(4) Section 7
Accredited person's collection of service data is taken to have been by the OSP.
7(5) Section 7
made-under-the-competition-and-consumer-act-2010.pdf, p.133
Use or disclosure of CDR data by accredited data recipients is authorised unless otherwise required or authorised.
Authorisation for direct marketing use of CDR data by accredited recipients.
Authorisation for direct marketing use of CDR data.
Failure to comply with section 56EK of the Act in relation to service data of a CDR consumer as if it were an accredited data recipient.
Service data overlaps with accredited data recipient.
Overlapping of service data and accredited data recipient.
CDR representative must comply with section 56EK in relation to service data.
Recognition of CDR representative principal's compliance with section 56EK.
CDR representative principal must comply with section 56EK in relation to service data.
Prohibition of non-compliance with section 56EK.
CDR representative principal must comply with section 56EK.
Diffusion of requirement for CDR representative principal to comply with section 56EK.
Recurring requirement for CDR representative principal to comply with section 56EK.
made-under-the-competition-and-consumer-act-2010.pdf, p.134
Failure to comply with section 56EK of the Act in relation to service data of a CDR consumer as if it were an accredited data recipient of the service data is prohibited.
The key specifies a temporal interval for compliance with section 56EK of the Act in relation to service data of a CDR consumer.
The OSP must not fail to comply with section 56EK of the Act in relation to service data of a CDR consumer as if it were an accredited data recipient of the service data.
Failure to comply with section 56EK of the Act in relation to service data of a CDR consumer as if it were an accredited data recipient of the service data.
The key imposes an obligation on OSPs and CDR representatives to comply with section 56EK of the Act in relation to service data of a CDR consumer.
Obligation on OSPs and CDR representatives
The key specifies a recurring trace for OSPs and CDR representatives that fail to comply with section 56EK of the Act in relation to service data of a CDR consumer.
Recurring trace for OSPs and CDR representatives
Failure to comply with section 56EL of the Act in relation to service data of a CDR consumer as if it were an accredited data recipient of the service data is prohibited.
Failure to comply with section 56EL of the Act in relation to service data of a CDR consumer as if it were an accredited data recipient of the service data.
The failure to comply with section 56EL of the Act in relation to service data of a CDR consumer can be traced.
Tracing the failure to comply with section 56EL of the Act in relation to service data of a CDR consumer.
The action is a failure to comply with section 56EL of the Act in relation to service data of a CDR consumer.
Data holder must update consumer dashboard with disclosed CDR data and recipient information.
CDR participant must provide written notice to CDR consumer upon disclosure of certain information.
Disclose information to accredited person
made-under-the-competition-and-consumer-act-2010.pdf, p.136
Comply with subsection 56EN(2) of the Act in relation to service data of a CDR consumer as if it were an accredited person.
Mandatory compliance with subsection 56EN(2) of the Act.
Fails to comply with subsection 56EN(2) of the Act in relation to service data of a CDR consumer as if it were an accredited person.
Prohibited non-compliance with subsection 56EN(2) of the Act.
Relevance of CDR representative's action is irrelevant.
Steps for an accredited data recipient to implement security governance and manage CDR data.
Steps for an accredited data recipient to implement security governance and manage CDR data over time
(1) For subsection 56EO(1) of the Act, the steps are set out in Schedule 2.
Failure to comply with Schedule 2 is attributed to the accredited data recipient.
Failure to comply with Schedule 2 is attributed to the CDR representative principal.
(a) the CDR representative; (b) any direct or indirect OSP of the CDR representative;
Indicates that the failure to comply with Schedule 2 overlaps with the scope of the CDR representative principal.
(3) For this rule, where an accredited data recipient is a CDR representative principal, a failure by: (a) the CDR representative; or (b) any direct or indirect OSP of the CDR representative; to comply with Schedule 2 in relation to service data is taken to be a failure by the CDR representative principal.
(a) the CDR representative; or (b) any direct or indirect OSP of the CDR representative;
Attributes failure to comply with Schedule 2 to the CDR representative principal.
(b) any direct or indirect OSP of the CDR representative;
Indicates that the failure to comply with Schedule 2 spreads to the CDR representative principal.
Indicates that the failure to comply with Schedule 2 repeats for the CDR representative principal.
made-under-the-competition-and-consumer-act-2010.pdf, p.137
Accredited data recipient must provide CDR consumer with statement before collecting and using CDR data.
The CDR consumer HAS_BETWEEN the time the statement was given and the current time NOT deleted redundant data.
The CDR consumer has not elected to delete redundant data between the time the statement was given and the current time.
The CDR consumer has not elected, in accordance with rule 4.16, that their redundant data should be deleted.
The accredited data recipient MUST provide the statement.
The accredited data recipient gave the CDR consumer the statement referred to in paragraph 4.17(1)(b) or (c).
The accredited person MAY de-identify rather than delete the redundant data.
The accredited person thinks it appropriate in the circumstances to de-identify rather than delete the redundant data.
In the case of a statement referred to in paragraph 4.17(1)(c)―the accredited person THINKS IT IS_A appropriate in the circumstances to de-identify rather than delete the redundant data.
The CDR consumer BUT the time the statement was given and the current time NOT deleted redundant data IF this rule does not apply THEN rule 7.13 applies: see subrule 7.13(1).
If this rule does not apply, rule 7.13 applies: see subrule 7.13(1).
If this rule does not apply, then rule 7.13 applies.
Delete redundant data and notify recipient of deletion.
Failure to comply with subsection 56EO(2) of the Act is taken as a failure by the CDR representative principal.
Failure to comply with subsection 56EO(2) of the Act.
Failure to comply is taken as a failure by the CDR representative principal.
(a) it were a CDR entity; and (b) the references in this rule...
made-under-the-competition-and-consumer-act-2010.pdf, p.124
Privacy safeguards apply to CDR data for which there are one or more CDR consumers.
Privacy safeguards apply until there are no longer one or more CDR consumers.
Privacy safeguards apply during the time there are one or more CDR consumers.
There are one or more CDR consumers at some point in time.
The presence of a consumer implies the application of privacy safeguards.
Holds true for CDR data with one or more consumers.
Privacy safeguards apply if and only if there is at least one consumer.
Privacy safeguards do not apply after there are no longer one or more CDR consumers.
Privacy safeguards do not apply after the last consumer is removed.
Rule applies if rule 7.12 does not apply.
this rule applies if rule 7.12 does not apply
Temporal interval during which the rule applies
Apply CDR data deletion process to redundant data
made-under-the-competition-and-consumer-act-2010.pdf, p.138
No fee for responding to or actioning a request under subsection 56EP(1) of the Act.
No fee for responding to or actioning a request under subsection 56EP(2) of the Act.
No fee for responding to or actioning a request.
Written notice to requester with explanation for actions taken
Recipient of correction request must acknowledge receipt and correct data within 10 business days.
Data correction must be completed within 10 business days
Recipient must acknowledge receipt and correct data
Recipient may not think it appropriate to correct data or provide notice
Data correction is a subclass of the obligation to respond to correction request
Acknowledgement and data correction are two separate obligations
Comply with subsection 56EP(2) of the Act in relation to service data of a CDR consumer as if it were an accredited person.
Temporal interval for compliance with subsection 56EP(2) of the Act.
Mandatory compliance with subsection 56EP(2) of the Act.
Fails to comply with subsection 56EP(2) of the Act in relation to service data of a CDR consumer as if it were an accredited person.
Prohibited non-compliance with subsection 56EP(2) of the Act.
Recurring obligation for CDR representative principal.
made-under-the-competition-and-consumer-act-2010.pdf, p.219
The Agency must prepare a report for each reporting period that sets out certain information.
The Agency must prepare a report for each reporting period.
made-under-the-competition-and-consumer-act-2010.pdf, p.125
The Information Commissioner may approve a form for a CDR policy.
The Information Commissioner may approve a form.
CDR policy must be in a distinct document from privacy policies.
Must provide a distinct CDR policy document.
Data holder must indicate acceptance of requests for voluntary product and consumer data.
Accredited person must provide information about CDR data collection and use
made-under-the-competition-and-consumer-act-2010.pdf, p.127
Exemption from subsection 56EE(1) of the Act for accredited data recipients dealing with identified CDR consumers under certain conditions.
made-under-the-competition-and-consumer-act-2010.pdf, p.128
Comply with section 56EG of the Act in relation to service data of a CDR consumer
Obligation to comply with section 56EG of the Act
Failure to comply with section 56EG of the Act in relation to service data of a CDR consumer as if it were an accredited person and had collected the service data is prohibited.
the breach occurs when the accredited person or their representative fails to comply with section 56EG of the Act.
(1) An accredited person breaches this subrule if a direct or indirect OSP of: (a) the accredited person; or (b) a CDR representative of the accredited person;
fails to comply with section 56EG of the Act in relation to service data of a CDR consumer as if it were an accredited person and had collected the service data.
Direct or indirect OSP of an accredited person fails to comply with section 56EG of the Act.
(a) the accredited person; or (b) a CDR representative of the accredited person;
this subrule is a civil penalty provision.
This subrule is a civil penalty provision (see rule 9.8).
the breach is prohibited if the accredited person or their representative fails to comply with section 56EG of the Act.
the breach is repeated if the accredited person or their representative continues to fail to comply with section 56EG of the Act.
Irrelevant action of OSP in relation to service data under CDR outsourcing arrangement.
...relation to the service data is in accordance with the CDR outsourcing arrangement.
Excerpt relates to a specific time period.
(2) For subrule (1), it is irrelevant...
...action of the direct or indirect OSP in relation to the service data.
Action of OSP is irrelevant to CDR outsourcing arrangement.
Excerpt has relevance to a specific time period.
made-under-the-competition-and-consumer-act-2010.pdf, p.129
CDR participant, collection date, and type of data
Update consumer dashboard with collected CDR data
Sponsor and affiliate may choose who updates consumer dashboard.
Permitted uses or disclosures of CDR data for non-direct marketing purposes.
made-under-the-competition-and-consumer-act-2010.pdf, p.131
Disclosure of CDR data to an accredited person under an AP disclosure consent is permitted until July 2021 or the day the Data Standards Chair makes the data standard.
Disclosure of CDR data to a trusted adviser under TA disclosure consent is permitted until certain conditions are met.
Permission to disclose CDR data under TA disclosure consent.
made-under-the-competition-and-consumer-act-2010.pdf, p.141
The Data Standards Advisory Committee must advise the Chair on certain matters.
The Data Standards Chair must appoint consumer and privacy representatives to the Committee.
No remuneration for appointment to Data Standards Advisory Committee
Resignation procedure for Committee appointees.
Temporal overlap of resignation and appointment
(2) An appointee to a Committee may resign his or her appointment by giving the Chair a written resignation.
Resignation implies termination of appointment
Resignation procedure can be inferred from appointment rules
Resignation procedure propagates to affected parties
Resignation takes effect on specified day
Written directions to the Data Standards Advisory Committee
made-under-the-competition-and-consumer-act-2010.pdf, p.142
Permits certain entities to be observers on Data Standards Advisory Committees.
Invite other person to act as an observer on a Committee.
made-under-the-competition-and-consumer-act-2010.pdf, p.143
Data Standards Chair must notify Commission and Information Commissioner of proposal to make or amend data standard.
Conditional commencement of notification to Commission and Information Commissioner
Failure to comply does not affect validity or enforceability of data standard.
Consultation and publication requirements for data standard amendments.
Failure to comply does not affect validity or enforceability.
If failure to comply affects validity, then it does not affect enforceability.
Must consider certain advice and submissions when making or amending data standards.
Must consider certain advice and submissions.
The Data Standards Chair must have regard to the following:
made-under-the-competition-and-consumer-act-2010.pdf, p.144
Requires advice from other relevant committees, advisory panels or consultative groups.
Data standards must be made by the Data Standards Chair.
made-under-the-competition-and-consumer-act-2010.pdf, p.220
Defines terms for consumer data requests
The staged application of these rules starts on a specific date
AGL Energy Group and Origin Energy Group are initial retailers
Initial retailer is a specific type of entity
made-under-the-competition-and-consumer-act-2010.pdf, p.221
Definition of larger retailer based on small customers
Obligation to classify as larger retailer
Conditional commencement of Part 2 rules for AER
Part 2 of these rules applies to the Victorian agency on and from the tranche 1 (VA) date.
Part 3 of these rules does not apply in relation to energy sector data.
Part 4 of these rules applies in relation to an initial retailer, except in relation to a complex request.
Conditional commencement of Part 4 rules for AEMO on and from the tranche 1 date.
Part 4 of these rules applies in relation to an initial retailer in relation to a complex request on and from the tranche 2 date.
made-under-the-competition-and-consumer-act-2010.pdf, p.222
Permits disclosure of CDR data under certain conditions.
Classifies data into required and voluntary categories.
Retailer may disclose pre-application CDR data in response to a request.
Data holder must disclose pre-application CDR data in response to relevant data request Part.
The temporal interval for disclosure is between the operation of this Part and the relevant data request Part.
Temporal interval for disclosure of pre-application CDR data.
The data holder would be required or authorised by the relevant data request Part to disclose in response to the request.
The artificial intelligence system is involved in the disclosure of pre-application CDR data.
Artificial intelligence system involved in pre-application CDR data disclosure.
The data holder must disclose pre-application CDR data.
Mandatory disclosure of pre-application CDR data.
Data holder would be required or authorised by the relevant data request Part to disclose in response to the request.
The pre-application CDR data is classified as sensitive information.
Classification of pre-application CDR data as sensitive information.
CDR data that, but for the operation of this Part, the data holder would be required or authorised by the relevant data request Part to disclose in response to the request.
The mechanism for dissemination is through the relevant data request Part.
Mechanism for dissemination of pre-application CDR data.
The relevant data request Part requires or authorises the disclosure of CDR data.
The temporal limit for disclosure is until the operation of this Part.
Temporal limit for disclosure of pre-application CDR data.
made-under-the-competition-and-consumer-act-2010.pdf, p.140
Establishment of Data Standards Advisory Committees
Establishment of a Data Standards Advisory Committee
May appoint a Data Standards Advisory Committee to cover more than one sector.
Data Standards Advisory Committee may be appointed to cover more than one sector at any time
Committee appointment date overlaps with sector designation date
State may appoint a Data Standards Advisory Committee to cover more than one sector
State has the authority to appoint a committee
9 Section 9
made-under-the-competition-and-consumer-act-2010.pdf, p.157
Request for data holder copies of records
9(1) Section 9
CDR consumer has permission to request data holder copies of records
9(2) Section 9
9(3) Section 9
Provide requested copies within 10 business days after receiving the request.
9(4) Section 9
No fee for making or responding to a request under subrule (1)
9(5) Section 9
No fee for making or responding to a request
9(6) Section 9
made-under-the-competition-and-consumer-act-2010.pdf, p.158
Commission may audit compliance with certain rules and standards.
The Information Commissioner may audit CDR participant compliance with privacy safeguards.
Request to produce records or information within a specified time
Permission to request production of records or information
Audit of data recipient's compliance with certain obligations and conditions.
Request for production of records or information
Obligation to produce records or information
Provide audit report to Commission and Information Commissioner
Audit report contains information about CDR Accreditor's actions
made-under-the-competition-and-consumer-act-2010.pdf, p.159
made-under-the-competition-and-consumer-act-2010.pdf, p.161
Excerpts civil penalty provisions within the Regulatory Powers Act.
made-under-the-competition-and-consumer-act-2010.pdf, p.224
Laws relevant to the management of CDR data in relation to the energy sector.
Includes laws relevant to CDR data management in the energy sector.
Conditions for accredited person to be data holder
made-under-the-competition-and-consumer-act-2010.pdf, p.225
Consultation with authorities for data recipient accreditor
AEMO cannot be treated as a data holder.
The function of the database is to provide information during a specific time period.
Temporal interval for AEMO's treatment in the database.
Prohibition of treating AEMO as a data holder.
Suspension or revocation of accreditation for retailers
The suspension or revocation of accreditation is related to the temporal interval between authorisation and licence suspension.
Establishes temporal relation between accreditation and authorisation
the accredited person ceases to satisfy the condition if its authorisation or licence to sell electricity in the National Electricity Market has been suspended or revoked.
If the accredited person ceases to satisfy the condition, then its authorisation or licence to sell electricity in the National Electricity Market has been suspended or revoked.
Establishes implication between accredited persons and retailer status
The suspension or revocation of accreditation is prohibited.
Prohibits suspension or revocation of accreditation for retailers
The state is obligated to suspend or revoke accreditation for retailers.
Imposes obligation on state to suspend or revoke accreditation for retailers
The accredited person was, at the time of the accreditation, a retailer.
Classifies accredited persons as retailers
Establishes recurring trace between accredited persons and retailers
Grounds for revocation, suspension and surrender of Endnotes
made-under-the-competition-and-consumer-act-2010.pdf, p.147
Miscellaneous matters including decisions reviewable by the Administrative Appeals Tribunal and civil penalty provisions.
made-under-the-competition-and-consumer-act-2010.pdf, p.148
Review of decisions by the Administrative Appeals Tribunal
made-under-the-competition-and-consumer-act-2010.pdf, p.149
Records of authorisations, amendments, notifications, requests, responses, disclosures, agreements, elections, complaints, and processes.
Data holder must keep and maintain records of certain information.
Maintain records of consents, amendments, and notifications.
made-under-the-competition-and-consumer-act-2010.pdf, p.153
Data holder must prepare a report for each reporting period with specific information.
Reports must cover a specific time period
Secondary data holder must prepare a report for each reporting period.
9(1A) Section 9
and (b) sets out the number (if any) of requests for SR data under subrule 1.22(3)nor 1.23(4) received by the data holder from the primary data holder during the reporting period;
Report is required for a specific purpose
made-under-the-competition-and-consumer-act-2010.pdf, p.3
Services for making requests under these rules
Services for managing consumer data requests made by accredited persons
Deletion and de-identification of CDR data
SR data not to be used for other purposes
Prohibits use of SR data for other purposes
made-under-the-competition-and-consumer-act-2010.pdf, p.4
Defines dispute resolution for primary and secondary data holders
Refusal to disclose required product data
Consumer data request process for eligible CDR consumers
Disclosing consumer data in response to a valid request.
made-under-the-competition-and-consumer-act-2010.pdf, p.1
Compilation information and notes on amendments.
Disclosure of CDR data not permitted unless certain conditions are met.
Consumer data requests by accredited persons to accredited data recipients
Consumer data request by accredited person to accredited data
Section outlining eligible CDR consumers and accredited data recipients.
made-under-the-competition-and-consumer-act-2010.pdf, p.5
Information relating to de-identification of CDR data
Notification of data holder or accredited data recipient if collection
Consumer data requests made by accredited persons to CDR
made-under-the-competition-and-consumer-act-2010.pdf, p.6
Request for CDR representative principal to seek to collect CDR
Requirements for data holder's processes
Requires data holder to have certain processes in place
Consumer gives authorisation for disclosure of CDR data
Restrictions on disclosure of CDR consumer authorization
Consumer data requests by accredited persons to CDR
Notification requirements for consumer data requests on behalf of
The temporal interval between the data holder's request and the eligible CDR consumer's authorization contains a request for authorization
Temporal relationship between data holder and eligible CDR consumer
Data holder must ask eligible CDR consumer to authorise
If the data holder requests authorization, then the eligible CDR consumer must authorize
Implication of data holder's request on eligible CDR consumer
The cognitive AI system requires the data holder to request authorization from the eligible CDR consumer
Cognitive AI requirement on data holder's request
The data holder's request for authorization spreads to the eligible CDR consumer
Spread of data holder's request to eligible CDR consumer
The text describes the compilation of the Competition and Consumer (Consumer Data Right) Rules 2020.
Request for approval from account holders to disclose joint information
Notification requirements for consumer data requests
made-under-the-competition-and-consumer-act-2010.pdf, p.7
Obtaining agreement on change to a less restrictive disclosure
Handling of consumer data requests for joint accounts
Transfer, suspension, surrender and revocation of accreditation
Consequences of surrender, suspension or revocation of
This provision requires temporal intervals
Temporal intervals are required for this provision
Other information to be kept in association with Register of
Amendment and correction of entries in Register of Accredited
Publication or availability of specified information in the Register is required.
Must provide publication or availability of specified information in the Register.
Making information available to the Commission
Competition and Consumer (Consumer Data Right) Rules 2020
made-under-the-competition-and-consumer-act-2010.pdf, p.8
Temporary restriction on use of the Register in relation to data
Imposes a prohibition on processing consumer data
Consideration of application to be accredited person
Use or disclosure of CDR is subject to privacy safeguard.
Rule relating to privacy safeguards 8 and 9—failure by CDR
Rule relating to privacy safeguards 8 and 9—failure by direct or
Rules relating to integrity and security of CDR data
Must provide information about the specified topic.
Rules relating to correction of CDR data
Prohibition on destruction of unsolicited privacy data
Rule relating to privacy safeguard 4—destruction of unsolicited CDR data
Requires relation between identifiable temporal intervals for destruction of unsolicited CDR data
Permitted use or disclosure of direct information
Use or disclosure of CDR data by accredited data recipients and others.
made-under-the-competition-and-consumer-act-2010.pdf, p.9