Document ID: chunk:federal_register_of_legislation:F2024C01258:clause:4_4:p40
Version: federal_register_of_legislation:F2024C01258
Segment Type: clause
Provision Reference: sch 4 cl 4 (pt 40/75)
Character Range: 146807–149487

the policy if desired;
 (g) a statement that, at any time, the consent can be withdrawn;
 (h) the following information about redundant data:
 (i) a statement, in accordance with rule 4.17, regarding the accredited person's intended treatment of redundant data;
 (ii) a statement outlining the CDR consumer's right to elect that their redundant data be deleted;
 (iii) instructions for how the election can be made;
 (i) if the accredited person is an affiliate and the CDR data will be collected by a sponsor at its request:
 (i) a statement of that fact; and
 (ii) the sponsor's name; and
 (iii) the sponsor's accreditation number; and
 (iv) if the sponsor is based overseas—the country in which it is based; and
 (v) a link to a webpage where the sponsor's CDR policy can be directly viewed; and
 (vi) a statement detailing why the sponsor needs to access the consumer's CDR data; and
 (vii) a statement that the CDR consumer can obtain further information about collections or disclosures of CDR data from the sponsor's CDR policy if desired.
Note 1:  For paragraph (c), if the accredited person is seeking the CDR consumer's consent to de‑identification as referred to in paragraph (e), the accredited person would need to indicate how that would comply with the data minimisation principle.
Note 2: For paragraph (da), the uses or disclosures that are permitted under a direct marketing consent may be limited under another part of these rules (see subrule 7.5(3)).

4.12  Restrictions on seeking consent
 (1) Subject to subrule (1A), an accredited person must not specify a period of time for the purposes of paragraph 4.11(1)(b) that is more than 12 months.
 (1A) In the case of a consent given by a CDR business consumer that includes a business consumer statement, an accredited person must:
 (a) not specify a period of time that is more than 7 years; and
 (b) if specifying a period of time of more than 12 months, give the CDR business consumer the option of choosing a period for the consent of 12 months or less.
 (2) An accredited person must not ask for a collection consent, use consent or disclosure consent unless the collection, use or disclosure of CDR data in accordance with the consent would comply with the data minimisation principle.
Note: See rule 1.8 for the definition of "data minimisation principle".
  (3) An accredited person must not ask for a consent:
 (a) that is not in a category of consents; or
 (b) subject to subrule (4), for using the CDR data, including by aggregating the data, for the purpose of:
 (i) identifying; or
 (ii) compiling insights in relation to; or
 (iii) building a profile in relation to;
  any identifiable person who