What happens to CDR data an ADR holds when a data holder brand is removed from the CDR Register?

From time-to-time data holder brands may be removed from the CDR Register. This may occur for various reasons, such as a merger, or the discontinuation of a brand.

When this happens, the CDR data disclosed by the data holder brand to a data recipient will continue to be CDR data under the Competition and Consumer Act 2010 (Cth). Further, the protections provided by the Privacy Safeguards, CDR Rules and Standards will continue to apply to the data for the period that the ADR continues to hold it. This includes any election made by the CDR consumer under Rule 4.16 that the collected CDR data be deleted once it becomes redundant.

When a data holder brand is removed from the CDR Register, a data recipient will no longer be able to collect CDR data from the data holder brand. However, a consumer’s ‘use consent’ will be unaffected and the data recipient can continue to use the CDR data it has already collected to provide the requested goods or services (see the Note under Rule 4.3(4)). This will continue until the ‘use consent’ expires in line with the original consent or is otherwise withdrawn by the consumer.