AustraliaCompetition and Consumer Act 2010 (Cth), Consumer Data Right: Disclosure, Deletion and Correction of CDR Data
In force since .
A data subject rights rule binding public and private bodies.
- Enforcement body
- Office of the Australian Information Commissioner (OAIC), for the privacy safeguards
- Audit expectation
- none
What it requires
- Disclose CDR data to a CDR consumer, or to an accredited person, in response to the consumer's valid request, where the consumer data rules require the disclosure (section 56BC(1)).
- As an accredited data recipient, delete CDR data when a CDR consumer validly requests it, as the consumer data rules must require, unless an Australian law or a court or tribunal order requires the data to be kept (section 56BAA).
- Respond to a CDR consumer's request to correct CDR data by taking the steps the consumer data rules specify, which cover correcting the data or including a statement with it, and giving notice (section 56EP).
These lines are LexLint's reading of the law's text.
If you get it wrong
Private right of actionYes
Penalty structure
Section 56EV(2) sets the maximum penalty for a body corporate that contravenes a privacy safeguard penalty provision at the greater of $10,000,000, three times the value of the benefit obtained where the court can determine it, and 10% of the body corporate's adjusted turnover during the 12-month period ending at the end of the month of the contravention where it cannot.
- Rule
- Higher of
- As of
- Currency
- AUD
- Fixed cap
- 10,000,000
- Turnover percentage cap
- 10
What it makes you log
Logging duty
Sections 56BAA, 56BC and 56EP deal with the disclosure, deletion and correction of CDR data and the steps taken on a correction request. None of the three sections states a duty to create, keep or produce a log or record.
- Kind
- None
- As of
What this law does
Part IVD of the Competition and Consumer Act 2010 sets up the consumer data right, which lets consumers in certain sectors of the Australian economy require information about themselves to be disclosed to themselves or to accredited persons. The consumer data rules may require a CDR participant to disclose CDR data, in response to a valid request by a CDR consumer, to the consumer or to an accredited person.
The consumer data rules must require an accredited data recipient to delete CDR data on a CDR consumer's valid request, unless an Australian law or a court or tribunal order requires it to keep the data. An accredited data recipient that receives a CDR consumer's request to correct CDR data must respond by taking the steps the consumer data rules specify. Those steps cover correcting the CDR data or including a statement with it, and giving notice of the correction or statement.
The maximum civil penalty for a body corporate that contravenes a privacy safeguard is the greater of $10,000,000 and either three times the benefit obtained, where the court can determine it, or 10% of its adjusted turnover, where it cannot. Items 11 to 77 of Schedule 1 to the Treasury Laws Amendment (Consumer Data Right) Act 2019 commenced on .
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .