Competition and Consumer (Consumer Data Right) Rules 2020 7.6: Rule 7.6: never use or disclose CDR data other than for a permitted use or disclosure

Subject to the Act and the rules, an accredited data recipient that collected CDR data under a Part 4 request must not use or disclose it, or data derived from it, other than for a permitted use or disclosure, whether or not relating to direct marketing (civil penalty). Use or disclosure of service data by its OSPs or its representatives' OSPs, and by its CDR representatives, is taken to be its own, and so is collection of service data by its OSPs, whether or not in accordance with the arrangements; data collected at an affiliate's request is also taken to be collected by the affiliate.