Section 56EM — Competition and Consumer Act 2010 (Cth)

Disclosures by data holders

(1) If a data holder of CDR data is required or authorised under the consumer data rules to disclose the CDR data to a person, the data holder must:

(a) take the steps specified in the consumer data rules to notify CDR consumers for the CDR data of the disclosure; and

(b) ensure that this notification:

(i) is given to those of the CDR consumers (if there are more than one) that the consumer data rules require to be notified; and

(ii) covers the matters specified in those rules; and

(iii) is given at or before the time specified in those rules.

Note: This subsection is a civil penalty provision (see section 56EU).

Disclosures by accredited data recipients

(2) If an accredited data recipient of CDR data discloses the CDR data, the accredited data recipient must:

(a) take the steps specified in the consumer data rules to notify CDR consumers for the CDR data of the disclosure; and

(b) ensure that this notification:

(i) is given to those of the CDR consumers (if there are more than one) that the consumer data rules require to be notified; and

(ii) covers the matters specified in those rules; and

(iii) is given at or before the time specified in those rules.

Note: This subsection is a civil penalty provision (see section 56EU).

Disclosures to designated gateways

(3) To avoid doubt, subsection (1) or (2) applies even if the disclosure of the CDR data is to a designated gateway for the CDR data as required or authorised under the consumer data rules.

Note: The designated gateway may be subject to a similar notification requirement under the consumer data rules (see paragraph 56BG(1)(c)).

Disclosures by action service providers

(4) If a person as an action service provider for a type of CDR action is required or authorised under the consumer data rules to disclose CDR data to another person, the action service provider must:

(a) take the steps specified in the consumer data rules to notify CDR consumers for the CDR data of the disclosure; and

(b) ensure that this notification:

(i) is given to those of the CDR consumers (if there are more than one) that the consumer data rules require to be notified; and

(ii) covers the matters specified in those rules; and

(iii) is given at or before the time specified in those rules.

Note: This subsection is a civil penalty provision (see section 56EU).

Related sections

• s 56EJ — Privacy safeguard 7—use or disclosure of CDR data for direct marketing by accredited data recipients or designated gateways
• s 56EK — Privacy safeguard 8—overseas disclosure of CDR data by accredited data recipients
• s 56EL — Privacy safeguard 9—adoption or disclosure of government related identifiers by accredited data recipients
• s 56EN — Privacy safeguard 11—quality of CDR data
• s 56EO — Privacy safeguard 12—security of CDR data, and destruction or de‑identification of redundant CDR data
• s 56EP — Privacy safeguard 13—correction of CDR data

Research how courts apply s 56EM

BriefBridge searches Australian caselaw by meaning — every answer cited to the paragraph.