Document ID: chunk:federal_register_of_legislation:F2020L01688:clause:1_44:p3
Version: federal_register_of_legislation:F2020L01688
Segment Type: clause
Provision Reference: sch 1 cl 44 (pt 3/9)
Character Range: 38783–41560

presented to CDR consumer when asking for consent
 (3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information:
 (a) its name;
 (b) its accreditation number;
 (c) in the case of a collection consent or a use consent―how the collection or use (as applicable) indicated in accordance with subrule (1) complies with the data minimisation principle, including how:
 (i) in the case of a collection consent―that collection is reasonably needed, and relates to no longer a time period than is reasonably needed; and
 (ii) in the case of a use consent―that use would not go beyond what is reasonably needed;
  in order to provide the requested goods or services to the CDR consumer or make the other uses consented to;
 (d) if the accredited person intends passing a fee on, or charging a fee, to the CDR consumer as described in paragraph (1)(d)―the following information:
 (i) the amount of the fee;
 (ii) the consequences if the CDR consumer does not consent to the collection, or to the disclosure, of that data;
 (e) if the accredited person is seeking a de‑identification consent—the additional information specified in rule 4.15;
 (f) if the CDR data may be disclosed to, or collected by, an outsourced service provider (including one that is based overseas) of the accredited person:
 (i) a statement of that fact; and
 (ii) a link to the accredited person's CDR policy; and
 (iii) a statement that the consumer can obtain further information about such disclosures from the policy if desired;
 (g) the following information about withdrawal of consents:
 (i) a statement that, at any time, the consent can be withdrawn;
 (ii) instructions for how the consent can be withdrawn;
 (iii) a statement indicating the consequences (if any) to the CDR consumer if they withdraw the consent;
 (h) the following information about redundant data:
 (i) a statement, in accordance with rule 4.17, regarding the accredited person's intended treatment of redundant data;
 (ii) a statement outlining the CDR consumer's right to elect that their redundant data be deleted;
 (iii) instructions for how the election can be made.
Note:  For paragraph (c), if the accredited person is seeking the CDR consumer's consent to de‑identification as referred to in paragraph (e), the accredited person would need to indicate how that would comply with the data minimisation principle.

4.12  Restrictions on seeking consent
 (1) An accredited person must not specify a period of time for the purposes of paragraph 4.11(1)(b) that is more than 12 months.
 (2) An accredited person must not ask for a collection consent or a use consent unless it would comply with the data minimisation principle in respect of that collection or those uses.