Document ID: chunk:federal_register_of_legislation:F2024C01258:clause:4_4:p47
Version: federal_register_of_legislation:F2024C01258
Segment Type: clause
Provision Reference: sch 4 cl 4 (pt 47/75)
Character Range: 164556–167352

consent is current; and
 (b) 90 days have elapsed since the latest of the following:
 (i) the CDR consumer gave the consent;
 (ia) the CDR consumer last amended the consent;
 (ii) the CDR consumer last used their consumer dashboard;
 (iii) the accredited person last notified the CDR consumer that the consent is still current.
 (2) The accredited person must notify the CDR consumer, in relation to each consent given by the CDR consumer that is still current, that the consent is still current.
Note: This subrule is a civil penalty provision (see rule 9.8).
 (3) The notification must be given in accordance with the data standards.
Note: This subrule is a civil penalty provision (see rule 9.8).

4.20A  Application of Subdivision to sponsor and affiliate
  Where this Subdivision would, if not for this rule, require both an affiliate and the affiliate's sponsor to give a notice to a CDR consumer, the sponsor and the affiliate may choose which will give the notice.

Division 4.3A—Giving and amending consents—CDR representatives

Subdivision 4.3A.1—Preliminary

4.20B  Purpose of Division
  This Division deals with:
 (a) giving collection consents, use consents and disclosure consents to CDR representatives; and
 (b) amending such consents; and
 (c) related matters.

4.20C  Object
  The object of this Division is to ensure that a consent is:
 (a) voluntary; and
 (b) express; and
 (c) informed; and
 (d) specific as to purpose; and
 (e) time limited; and
 (f) easily withdrawn.

Subdivision 4.3A.2—Giving consents
Note: Under rule 4.3A, if a CDR representative asks a CDR consumer for their consent to collect and use their CDR data, it must do so in accordance with this Division, and in particular, rules 4.20D, 4.20E and 4.20F. A failure to do so could result in the CDR representative principal being liable for one or more civil penalty provisions: see section 56EF of the Act and rule 1.16A.

4.20D  Requirements relating to seeking consent
  A request by a CDR representative for a CDR consumer to give or amend a consent:
 (a) must comply with any relevant data standards; and
 (b) having regard to any consumer experience guidelines developed by the Data Standards Body—must be reasonably easy to understand, including by use of plain concise language and, where appropriate, visual aids; and
 (c) must not include or refer to the CDR representative principal's CDR policy or other documents in a way that reduces understandability; and
 (d) must not be combined with other requests except for a consent under these rules (other than a request for direct marketing or de-identification consent).

4.20E  Asking CDR consumer to give consent
 (1) When asking a CDR consumer to give a consent, a CDR representative must:
 (a) in the case of a collection consent or a disclosure