Document ID: chunk:federal_register_of_legislation:F2024C01258:clause:4_4:p50
Version: federal_register_of_legislation:F2024C01258
Segment Type: clause
Provision Reference: sch 4 cl 4 (pt 50/75)
Character Range: 171964–174694

passing a fee on, or charging a fee, to the CDR consumer as described in paragraph (1)(e)―the following information:
 (i) the amount of the fee;
 (ii) the consequences if the CDR consumer does not consent to the collection, or to the disclosure, of that data;
 (i) if the CDR representative is seeking a de‑identification consent—the additional information specified in rule 4.20L;
 (j) a link to the CDR representative principal's CDR policy;
 (k) if the CDR data may be disclosed to, or collected by, a direct or indirect OSP (including one that is based overseas) of the CDR representative or of the CDR representative principal:
 (i) a statement of that fact; and
 (ii) the name of the OSP; and
 (iii) the OSP's accreditation number (if any); and
 (iv) if the OSP is based overseas—the country in which it is based; and
 (v) a link to a webpage where the CDR representative principal's CDR policy and the OSP's CDR policy (if any) can be directly viewed; and
 (vi) a statement detailing why the OSP needs to access the consumer's CDR data;
 (l) a statement that the CDR consumer can obtain further information about the collections or disclosures for which consent is requested from the CDR representative principal's CDR policy if desired;
 (m) a statement that, at any time, the consent can be withdrawn;
 (n) the following information about redundant data:
 (i) a statement, in accordance with rule 4.20N, regarding the CDR representative's intended treatment of redundant data;
 (ii) a statement outlining the CDR consumer's right to elect that their redundant data be deleted;
 (iii) instructions for how the election can be made.
Note 1:  For paragraph (b), if the CDR representative is seeking the CDR consumer's consent to de‑identification as referred to in paragraph (i), the CDR representative would need to indicate how that would comply with the data minimisation principle.
Note 2: For paragraph (ga), the uses or disclosures that are permitted under a direct marketing consent may be limited under another part of these rules (see subrule 7.5(3)).

4.20F  Restrictions on seeking consent
 (1) A CDR representative must not specify a period of time for the purposes of paragraph 4.11(1)(b) that is more than 12 months.
 (2) A CDR representative must not ask for a collection consent, a use consent or a disclosure consent unless the consent would comply with the data minimisation principle in respect of that collection or those uses or disclosures.
Note: See rule 1.8 for the definition of "data minimisation principle".
  (3) A CDR representative must not ask for a consent:
 (a) that is not in a category of consents; or
 (b) subject to subrule (4), for using the CDR data, including by aggregating the data,