Document ID: chunk:federal_register_of_legislation:F2024C01258:clause:4_4:p39
Version: federal_register_of_legislation:F2024C01258
Segment Type: clause
Provision Reference: sch 4 cl 4 (pt 39/75)
Character Range: 144372–147068

CDR consumer when asking for consent
 (3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information:
 (a) its name;
 (b) its accreditation number;
 (c) in the case of a collection consent, use consent or disclosure consent—information about how the collection, use or disclosure indicated in a manner consistent with the requirements set out in subrule (1) complies with the data minimisation principle, including:
 (i) in the case of a collection consent in relation to the provision of requested goods or services—an explanation of why that collection is reasonably needed, and relates to a time period that is no longer than is reasonably needed; and
 (ii) in the case of a use consent or disclosure consent—an explanation of why that use or disclosure does not go beyond what is reasonably needed;
  in order to provide the requested goods or services to the CDR consumer, or to effect the permitted uses or disclosures consented to;
 (ca) in the case of an insight disclosure consent—an explanation of the CDR insight that will make clear to the CDR consumer what the CDR insight would reveal or describe;
 (d) if the accredited person intends passing a fee on, or charging a fee, to the CDR consumer as described in paragraph (1)(d)―the following information:
 (i) the amount of the fee;
 (ii) the consequences if the CDR consumer does not consent to the collection, or to the disclosure, of that data;
 (da) if the accredited person is seeking a direct marketing consent—information about how the CDR data may be used or disclosed in accordance with the consent;
 (e) if the accredited person is seeking a de‑identification consent—the additional information specified in rule 4.15;
 (f) if the CDR data may be disclosed to, or collected by, a direct or indirect OSP (including one that is based overseas) of the accredited person:
 (i) a statement of that fact; and
 (ii) the name of the OSP; and
 (iii) the OSP's accreditation number (if any); and
 (iv) if the OSP is based overseas—the country in which it is based; and
 (v) a link to a webpage where the accredited person's CDR policy and the OSP's CDR policy (if any) can be directly viewed; and
 (vi) a statement detailing why the OSP needs to access the consumer's CDR data; and
 (vii) a statement that the consumer can obtain further information about why the OSP needs to access the consumer's CDR data from the policy if desired;
 (g) a statement that, at any time, the consent can be withdrawn;
 (h) the following information about redundant data:
 (i) a statement, in accordance with rule 4.17, regarding the accredited person's intended treatment of redundant data;