Document ID: chunk:federal_register_of_legislation:F2024C01258:clause:4_4:p53
Version: federal_register_of_legislation:F2024C01258
Segment Type: clause
Provision Reference: sch 4 cl 4 (pt 53/75)
Character Range: 179578–182403

give effect to the withdrawal as soon as practicable, and in any case within 2 business days after the communication is received in accordance with paragraph (1)(b).
Note: A failure to do this could make the CDR representative principal liable for a civil penalty (see rule 1.16A).
 (7) Withdrawal of a consent does not affect an election under rule 4.20M that the CDR consumer's collected CDR data be deleted once it becomes redundant.

Subdivision 4.3A.5—Duration of consent

4.20K  Duration of consent
 (1) A consent given under this Division expires at the earliest of the following:
 (a) if the consent is withdrawn in accordance with paragraph 4.20J(1)(a)―when the consent is withdrawn;
 (b) if the consent is withdrawn in accordance with paragraph 4.20J(1)(b)―the earlier of the following:
 (i) when the CDR representative principal and CDR representative give effect to the withdrawal;
 (ii) 2 business days after the CDR representative principal or CDR representative receive the communication;
 (c) the end of the period of 12 months after the later of the following:
 (i) the day the consent was given; or
 (ii) if the period of the consent has been amended in accordance with this Division―the day the consent was last amended;
 (d) at the end of the period the CDR consumer consented to in accordance with rule 4.20E;
 (e) if the consent expires as a result of the operation of another provision of these rules that references this paragraph—when the consent expires.
 (2)  If:
 (a) a CDR representative principal is notified by a data holder, under rule 4.26A, of the withdrawal of an authorisation to disclose CDR data that relates to a collection consent given under this Division; and
 (b) the collection consent has not expired in accordance with subrule (1);
  the collection consent expires when the CDR representative principal receives that notification.
Note: This would not result in the use consent relating to any CDR data that had already been collected expiring, so it may continue to be used by the CDR representative in accordance with those consents. However, see the notification requirement of rule 4.20Q.
 (3) If:
 (a) a CDR representative principal has a collection consent given under this Division to collect particular CDR data from a particular accredited data recipient; and
 (b) the accredited data recipient has an AP disclosure consent to disclose that CDR data to that CDR representative principal;
  then if one of those consents expires, the other expires when the CDR representative principal or accredited data recipient is notified of the first‑mentioned expiry.
Note: The notification is required by rule 4.18B.
 (4) If a CDR representative principal's accreditation is revoked or surrendered in accordance with rule 5.17, all of the consents of any of the CDR representative