Rule 9.5 – Requests from CDR consumers for copies of records

Question

CDR Rule 9.5(1) states that a CDR consumer may request copies of records from a data holder relating to authorisations (and withdrawals of authorisations) to disclose CDR data, disclosures of CDR data and CDR complaint data.

1. Are there any guidelines about how copies of these records may be provided? Is providing this information on the customer's dashboard sufficient?
2. Is providing the consent record on the customer's dashboard sufficient?

Answer

1. The ACCC has not prescribed a form for the purposes of rule 9.5(3) or (4). Instead, the ACCC has left the format for a consumer to make a request to the data holder for copies of these particular records as they relate to the consumer, as well as the format for which the data holder can respond to such requests, open and flexible. The ACCC is open to feedback if participants believe there is a need for the ACCC to consider prescribing forms for the purposes of rule 9.5. If you do have any feedback on this point, please email the ACCC-CDR mailbox ([e-mail]). 
2. Where the ACCC has not prescribed a form for a CDR consumer to make a request for records under rule 9.5, it must be open to the consumer to contact the data holder and request access to such records in a form of their choosing (e.g. contacting the data holder by telephone or attending in-person at a branch). 
   
   If a data holder receives such a request under rule 9.5 for particular records and the ACCC has not prescribed a form for a data holder to respond to such requests, the format for providing the requested records to the CDR consumer is open to the data holder. For example, the data holder may choose to provide the requested records via email, secure file transfer, in hard copy or via the consumer dashboard. However, it is expected that the form will be one that can be accessed by the consumer (e.g. if a CDR consumer no longer has access to a consumer dashboard with the relevant CDR participant, they should have some other means of receiving the requested records) and understood by the consumer (e.g. not only in a machine-readable format).