Document ID: chunk:federal_register_of_legislation:F2024C01258:clause:4_4:p45
Version: federal_register_of_legislation:F2024C01258
Segment Type: clause
Provision Reference: sch 4 cl 4 (pt 45/75)
Character Range: 159341–162186

how it could use the redundant data once de‑identified.
Note:  For the CDR data de‑identification process, see rule 1.17.

Subdivision 4.3.5—Notification requirements

4.18  CDR receipts
  An accredited person must give the CDR consumer a notice that complies with the data standards as soon as practicable after the CDR consumer:
 (a) gives the accredited person a collection consent, use consent or disclosure consent; or
 (b) amends a collection consent, use consent or disclosure consent given to an accredited person in accordance with this Division; or
 (c) withdraws a collection consent, use consent or disclosure consent given to an accredited person in accordance with rule 4.13.
Note: This rule is a civil penalty provision (see rule 9.8).

4.18AA  Notification of data holder or accredited data recipient if collection consent expires
 (1) This rule applies if:
 (a) an accredited person has made a consumer data request to a CDR participant, based on a collection consent given under this Division relating to particular CDR data and that CDR participant; and
 (b) the request has not been completely resolved; and
 (c) the consent expires for any reason.
 (2) The accredited person must notify:
 (a) if the CDR participant is a data holder―the data holder, in accordance with the data standards, that the consent has expired; and
 (b) if the CDR participant is an accredited data recipient―the accredited data recipient as soon as practicable that the consent has expired.
Note: This subrule is a civil penalty provision (see rule 9.8).

4.18A  Notification of CDR consumer if collection consent expires
 (1) This rule applies if, in relation to particular goods or services an accredited person is providing as referred to in subrule 4.3(1):
 (a) the collection consent expires; but
 (b) the use consent, or any disclosure consent, is current.
 (2) The accredited person must notify the CDR consumer as soon as practicable after the collection consent expires that, at any time, they:
 (a) may withdraw the use consent or disclosure consent; and
 (b) may make the election to delete redundant data in respect of that CDR data under rule 4.16.
Note: This subrule is a civil penalty provision (see rule 9.8).
 (3) The notification must be given in writing otherwise than through the CDR consumer's consumer dashboard.
 (4) The notification may also be included in the CDR consumer's consumer dashboard.

4.18B  Notification if collection consent or AP disclosure consent expires
 (1) This rule applies if:
 (a) an accredited person has made a consumer data request to an accredited data recipient on behalf of a CDR representative, based on a collection consent given under this Division relating to particular CDR data and that accredited data recipient; and
 (b) the accredited data recipient has an AP disclosure consent relating