Document ID: chunk:federal_register_of_legislation:F2020L01688:clause:1_44:p1
Version: federal_register_of_legislation:F2020L01688
Segment Type: clause
Provision Reference: sch 1 cl 44 (pt 1/9)
Character Range: 33891–36644

44  Division 4.3
Repeal the Division, substitute:

Division 4.3—Giving and amending consents

Subdivision 4.3.1—Preliminary

4.8  Purpose of Division
  This Division deals with giving and amending collection consents, use consents and disclosure consents, as well as related matters.

4.9  Object
  The object of this Division is to ensure that a consent is:
 (a) voluntary; and
 (b) express; and
 (c) informed; and
 (d) specific as to purpose; and
 (e) time limited; and
 (f) easily withdrawn.

Subdivision 4.3.2—Giving consents
Note: Under rule 4.3, if an accredited person asks a CDR consumer for their consent to collect and use their CDR data, it must do so in accordance with this Division, and in particular, rules 4.10, 4.11 and 4.12. A failure to do so could contravene one or more civil penalty provisions: see section 56EF of the Act and rule 4.3.

4.10  Requirements relating to accredited person's processes for seeking consent
 (1) An accredited person's processes for asking a CDR consumer to give and amend a consent:
 (a) must:
 (i) accord with any consumer experience data standards; and
 (ia)  subject to subrule (2), accord with any other data standards; and
 (ii) having regard to any consumer experience guidelines developed by the Data Standards Body, be as easy to understand as practicable, including by use of concise language and, where appropriate, visual aids; and
 (b) must not:
 (i) include or refer to the accredited person's CDR policy or other documents so as to reduce comprehensibility; or
 (ii) bundle consents with other directions, permissions, consents or agreements.
 (2) Subparagraph (1)(a)(ia) does not apply to:
 (a) a collection consent for collection of CDR data from an accredited data recipient; or
 (b) a disclosure consent.

4.11  Asking CDR consumer to give consent

Asking CDR consumer to give consent
 (1A) An accredited person must not ask a CDR consumer to give a disclosure consent in relation to CDR data unless the consumer has already given the collection and use consents required to collect the CDR data to be disclosed.
Note: This does not prevent the accredited person from asking for a disclosure consent in relation to CDR data that has yet to be collected.
 (1) When asking a CDR consumer to give a consent, an accredited person must:
 (a) allow the CDR consumer to choose the types of CDR data to which the consent will apply by enabling the CDR consumer to actively select or otherwise clearly indicate:
 (i) in the case of a collection consent or a disclosure consent―the particular types of CDR data to which the consent will apply; and
 (ii) in the case of a use consent―the specific uses of collected data to which they are consenting; and
 (b) allow the CDR consumer to choose the