Document ID: chunk:federal_register_of_legislation:F2024C01258:clause:4_4:p16
Version: federal_register_of_legislation:F2024C01258
Segment Type: clause
Provision Reference: sch 4 cl 4 (pt 16/75)
Character Range: 87304–90123

to manage authorisations to disclose CDR data in response to consumer data requests; and
 (b) contains the details of each authorisation to disclose CDR data specified in subrule (3); and
 (ba) contains any information in the data standards that is specified as information for the purposes of this rule; and
 (bb) contains any information on the Register of Accredited Persons that is specified as information for the purposes of this rule; and
 (c) allows the CDR consumer, at any time, to withdraw a current authorisation; and
 (d) as part of the process of withdrawing an authorisation, displays a message, in accordance with the data standards, about the consequences of proceeding with withdrawing an authorisation; and
 (e) is simple and straightforward to use, and is no more complicated to use than the process for giving the authorisation to disclose CDR data; and
 (f) is prominently displayed and readily accessible to the CDR consumer; and
 (g) contains any other details, and does anything else, required by these rules.
Note 1: This subrule is a civil penalty provision (see rule 9.8).
Note 2: The circumstances are specified in the following provisions of the sector Schedules:
                for the banking sector—clause 2.3 of Schedule 3;
                for the energy sector—clause 2.3 of Schedule 4.
 (2) Such a service is the data holder's consumer dashboard for that consumer.
Note: If the consumer data request relates to a joint account, there may be an obligation to provide all joint account holders with consumer dashboards:  see rule 4A.13.
 (2A) For subrule (1), the online service must allow only nominated representatives to manage authorisations in the following circumstances:
 (a) where the CDR consumer is not an individual;
 (b) where the CDR data relates to a partnership account.
 (3) For paragraph (1)(b) and paragraph (5)(a), the information is the following for each authorisation:
 (a) details of the CDR data that has been authorised to be disclosed;
 (b) when the CDR consumer gave the authorisation;
 (c) the period for which the CDR consumer gave the authorisation;
 (d) if the authorisation is current—when it is scheduled to expire;
 (e) if the authorisation is not current—when it expired;
 (f) information relating to CDR data that was disclosed pursuant to the authorisation (see rule 7.9);
 (g) for a disclosure of CDR data that relates to the authorisation but that was pursuant to a request under subsection 56EN(4) of the Act—that fact;
 (h) details of each amendment (if any) that has been made to the authorisation.
Note 1: For paragraph (d), authorisations to disclose CDR data expire at the latest 12 months after they are given: see paragraph 4.26(1)(e).
Note 2: The consumer dashboard could contain other information too, for example, the written notice