Competition and Consumer (Consumer Data Right) Rules 2020 7.5: Rule 7.5: use and disclose CDR data only for permitted uses and disclosures

For an accredited data recipient that collected data under a Part 4 request, the permitted uses and disclosures are: using the data to provide the requested goods or services within the data minimisation principle and a current use consent; de-identifying under a current de-identification consent for general research or disclosure (including sale); deriving data for those uses; disclosing the consumer's data to the consumer for the service; disclosing under a current disclosure consent (subject to rule 7.5A); disclosing to its OSPs or sponsorship counterparty to the extent needed for those purposes; disclosing data de-identified on becoming redundant; for a recipient acting as OSP, use or disclosure under the outsourcing arrangement; disclosing to an accredited person holding collection and use consents where the recipient holds an AP disclosure consent; and, for a CDR representative principal, disclosing to its representative for uses that would be permitted if the representative were a recipient. Every disclosure must be in accordance with the data standards, and the profiling uses barred by subrule 4.12(3) are never permitted. Uses relating to direct marketing are permitted only under a direct marketing consent: sending information about upgraded or alternative goods or services, renewal offers, benefits of existing services, or other accredited persons' services the consumer might benefit from on a reasonable number of occasions; disclosing to such an accredited person that holds consents; analysing data to choose what to send; and disclosing to OSPs or representatives for those purposes. Under rule 7.5A, insight disclosures that include or reveal sensitive information under the Privacy Act 1988 are never permitted, and the AP, TA, insight and business consumer disclosure consents became usable only from dates now passed.