Section 56EO — Competition and Consumer Act 2010 (Cth)

(1) Each person (a CDR entity) who is:

(a) an accredited data recipient of CDR data; or

(b) a designated gateway for CDR data;

must take the steps specified in the consumer data rules to protect the CDR data from:

(c) misuse, interference and loss; and

(d) unauthorised access, modification or disclosure.

Note: This subsection is a civil penalty provision (see section 56EU).

(2) If:

(a) the CDR entity no longer needs any of that CDR data for either of the following purposes (the redundant data):

(i) a purpose permitted under the consumer data rules;

(ii) a purpose for which the person is able to use or disclose it in accordance with this Division; and

(b) the CDR entity is not required to retain the redundant data by or under an Australian law or a court/tribunal order; and

(c) the redundant data does not relate to any current or anticipated:

(i) legal proceedings; or

(ii) dispute resolution proceedings;

to which the CDR entity is a party;

the CDR entity must take the steps specified in the consumer data rules to destroy the redundant data or to ensure that the redundant data is de‑identified.

Note 1: This subsection is a civil penalty provision (see section 56EU).

Note 2: Australian Privacy Principle 11 will not apply for paragraph (b) (see paragraph 56EC(4)(a) or (d)).

Related sections

• s 56EL — Privacy safeguard 9—adoption or disclosure of government related identifiers by accredited data recipients
• s 56EM — Privacy safeguard 10—notifying of the disclosure of CDR data
• s 56EN — Privacy safeguard 11—quality of CDR data
• s 56EP — Privacy safeguard 13—correction of CDR data
• s 56EQ — Information Commissioner to promote compliance etc.
• s 56ER — Information Commissioner may conduct an assessment relating to the management and handling of CDR data

Research how courts apply s 56EO

BriefBridge searches Australian caselaw by meaning — every answer cited to the paragraph.