Document ID: chunk:federal_register_of_legislation:F2020L01688:clause:1_45:p2
Version: federal_register_of_legislation:F2020L01688
Segment Type: clause
Provision Reference: sch 1 cl 45 (pt 2/3)
Character Range: 58867–61691

at any time, the authorisation can be withdrawn;
 (g) instructions for how the authorisation can be withdrawn.
      (2) The data holder must also give the CDR consumer any information that the Register of Accredited Persons holds in relation to the accredited person that is specified as information for the purposes of this rule.

4.24  Restrictions when asking CDR consumer to authorise disclosure of CDR data
  When asking a CDR consumer to authorise the disclosure of CDR data or to amend a current authorisation, the data holder must not do any of the following:
 (a) add any requirements to the authorisation process beyond those specified in the data standards and these rules;
 (b) provide or request additional information during the authorisation process beyond that specified in the data standards and these rules;
 (c) offer additional or alternative services as part of the authorisation process;
 (d) include or refer to other documents.

4.25  Withdrawal of authorisation to disclose CDR data and notification
 (1) The CDR consumer who gave, to a data holder, an authorisation to disclose particular CDR data to an accredited person may withdraw the authorisation at any time:
 (a) by using the data holder's consumer dashboard; or
 (b) by using a simple alternative method of communication to be made available by the data holder for that purpose.
 (2) The data holder must:
 (a) if the withdrawal was in accordance with paragraph (1)(b)―give effect to the withdrawal as soon as practicable, and in any case within 2 business days after receiving the communication; and
 (b) in any case―notify the accredited person of the withdrawal in accordance with the data standards.
Note 1: Upon notification a consent for the accredited person to collect the CDR data expires: see paragraph 4.14(1)(b).
Note 2: This subrule is a civil penalty provision (see rule 9.8).

4.26  Duration of authorisation to disclose CDR data
 (1) An authorisation to disclose particular CDR data to an accredited person expires at the earliest of the following:
 (a) if the authorisation was withdrawn in accordance with paragraph 4.25(1)(b)―the earlier of the following:
 (i) when the data holder gave effect to the withdrawal;
 (ii) 2 business days after the data holder received the communication;
 (b) if the authorisation was withdrawn in accordance with paragraph 4.25(1)(a)―when the authorisation was withdrawn;
 (c) if the CDR consumer ceases to be eligible in relation to the data holder;
 (d) if the data holder was notified, under paragraph 4.13(2)(b), of the withdrawal of a consent to collect that CDR data―when the data holder received that notification;
 (e) the end of the period of 12 months after the authorisation was given;
 (f) if the authorisation was for disclosure of CDR data on a single occasion—after the CDR