Document ID: chunk:federal_register_of_legislation:F2024C01258:clause:4_4:p49
Version: federal_register_of_legislation:F2024C01258
Segment Type: clause
Provision Reference: sch 4 cl 4 (pt 49/75)
Character Range: 169483–172193

to deletion of redundant data in accordance with rule 4.20M.
Note 1: A CDR representative cannot infer consent, or seek to rely on an implied consent.
Note 2: For paragraph (b), the specified period may not be more than 12 months: see subrule 4.20F(1). After the end of the period, redundant data would need to be dealt with in accordance with subsection 56EO(2) of the Act (privacy safeguard 12) and rules 7.12 and 7.13.
Note 3:  For paragraph (e), a data holder could charge a fee for disclosure of voluntary consumer data, while a CDR representative could charge a fee for the disclosure of any CDR data.
 (2) The CDR representative must not present direct marketing consents or de‑identification consents as pre-selected options to the CDR consumer for the purposes of subrule (1).

Information presented to CDR consumer when asking for consent
 (3) When asking a CDR consumer to give consent, the CDR representative must give the CDR consumer the following information:
 (a) its name;
 (b) the fact that the person is a CDR representative and that the CDR data will be collected by its CDR representative principal at its request;
 (c) if the CDR representative is not located in Australia—the country in which it is located;
 (d) the CDR representative principal's name;
 (e) the CDR representative principal's accreditation number;
 (f) in the case of a collection consent, use consent or disclosure consent—information about how the collection, use or disclosure indicated in a manner consistent with the requirements set out in subrule (1) complies with the data minimisation principle, including:
 (i) in the case of a collection consent in relation to the provision of requested goods or services—an explanation of why that collection is reasonably needed, and relates to a time period that is no longer than is reasonably needed; and
 (ii) in the case of a use consent or disclosure consent—an explanation of why that use or disclosure does not go beyond what is reasonably needed;
  in order to provide the requested goods or services to the CDR consumer, or to effect the permitted uses or disclosures consented to;
 (g) in the case of an insight disclosure consent—an explanation of the CDR insight that will make clear to the CDR consumer what the CDR insight would reveal or describe;
 (ga) in the case of a direct marketing consent—information about how the CDR data may be used or disclosed in accordance with the consent;
 (h) if the CDR representative intends passing a fee on, or charging a fee, to the CDR consumer as described in paragraph (1)(e)―the following information:
 (i) the amount of the fee;
 (ii) the consequences if the CDR consumer does not consent to the collection, or to