Document ID: chunk:federal_register_of_legislation:F2024C01258:clause:4_4:p38
Version: federal_register_of_legislation:F2024C01258
Segment Type: clause
Provision Reference: sch 4 cl 4 (pt 38/75)
Character Range: 142003–144612

the period of consent (as presented to the CDR consumer) to which the consent will apply;
  where the period of consent is either:
 (iii) a single occasion; or
 (iv) a specified period of time; and
 (ba) in the case of a disclosure consent―either:
 (i) allow the CDR consumer to actively select or otherwise clearly indicate the persons to whom the CDR data may be disclosed; or
 (ii) seek the CDR consumer's agreement to the persons (as presented to the CDR consumer) to whom the CDR data may be disclosed; and
 (bb) where the accredited person proposes, or is offering, to deal with a person in their capacity as a CDR business consumer in relation to a consent of a kind mentioned in paragraph 1.10A(10)(a)―invite the CDR business consumer to provide the business consumer statement; and
 (c) seek the CDR consumer's express consent to the matters referred to in paragraphs (a), (aa), (b) and (ba) for each relevant category of consents; and
 (d) if the accredited person intends to charge a fee for disclosure of CDR data, or pass on to the CDR consumer a fee charged by a data holder or accredited data recipient for disclosure of CDR data:
 (i) clearly distinguish between the CDR data for which a fee will, and will not, be charged or passed on; and
 (ii) allow the CDR consumer to clearly indicate whether they consent to the collection or disclosure, as appropriate, of the CDR data for which a fee will be charged or passed on; and
 (e) allow the CDR consumer to make an election in relation to deletion of redundant data in accordance with rule 4.16.
Note 1: An accredited person cannot infer consent, or seek to rely on an implied consent.
Note 2: For paragraph (b), the specified period may not be more than 12 months (or 7 years for certain consents by a CDR business consumer): see subrule 4.12(1). After the end of the period, redundant data would need to be dealt with in accordance with subsection 56EO(2) of the Act (privacy safeguard 12) and rules 7.12 and 7.13.
Note 3:  For paragraph (d), a data holder could charge a fee for disclosure of voluntary consumer data, while an accredited data recipient could charge a fee for the disclosure of any CDR data.
 (2) The accredited person must not request direct marketing consents or de‑identification consents by means of pre-selected options for the purposes of subrule (1).

Information presented to CDR consumer when asking for consent
 (3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information:
 (a) its name;
 (b) its accreditation number;
 (c) in the case of a collection