Document ID: chunk:federal_register_of_legislation:F2024C01258:clause:4_4:p37
Version: federal_register_of_legislation:F2024C01258
Segment Type: clause
Provision Reference: sch 4 cl 4 (pt 37/75)
Character Range: 139532–142221

representatives; since those consents are given to the CDR representatives, they are covered by Division 4.3A.

4.9  Object
  The object of this Division is to ensure that a consent is:
 (a) voluntary; and
 (b) express; and
 (c) informed; and
 (d) specific as to purpose; and
 (e) time limited; and
 (f) easily withdrawn.

Subdivision 4.3.2—Giving consents
Note: Under rule 4.3, if an accredited person asks a CDR consumer for their consent to collect and use their CDR data, it must do so in accordance with this Division, and in particular, rules 4.10, 4.11 and 4.12. A failure to do so could contravene one or more civil penalty provisions: see section 56EF of the Act and rule 4.3.

4.10  Requirements relating to seeking consent
  A request by an accredited person for a CDR consumer to give or amend a consent:
 (a) must comply with any relevant data standards; and
 (b) having regard to any consumer experience guidelines made by the Data Standards Body—must be reasonably easy to understand, including by use of plain concise language and, where appropriate, visual aids; and
 (c) must not include or refer to the accredited person's CDR policy or other documents in a way that reduces understandability; and
 (d) must not be combined with other requests except for a consent under these rules (other than a request for direct marketing or de-identification consent).

4.11  Asking CDR consumer to give consent
 (1) When asking a CDR consumer to give a consent, an accredited person must:
 (a) in the case of a collection consent or a disclosure consent—either:
 (i) allow the CDR consumer to actively select or otherwise clearly indicate the particular types of CDR data to which the consent will apply; or
 (ii) seek the CDR consumer's agreement to the particular types of CDR data (as presented to the CDR consumer) to which the consent will apply; and
 (aa) in the case of a use consent—either:
 (i) allow the CDR consumer to actively select or otherwise clearly indicate the specific uses of collected data to which the consent will apply; or
 (ii) seek the CDR consumer's agreement to the specific uses of collected data (as presented to the CDR consumer) to which the consent will apply; and
 (b) in relation to the period of the collection consent, use consent, or disclosure consent (as appropriate)—either:
 (i) allow the CDR consumer to actively select or otherwise clearly indicate the period of consent; or
 (ii) seek the CDR consumer's agreement to the period of consent (as presented to the CDR consumer) to which the consent will apply;
  where the period of consent is either:
 (iii) a single occasion; or
 (iv) a specified period of time; and
 (ba) in the case of