Document ID: chunk:federal_register_of_legislation:F2020L01688:clause:1_44:p5
Version: federal_register_of_legislation:F2020L01688
Segment Type: clause
Provision Reference: sch 1 cl 44 (pt 5/9)
Character Range: 43809–46570

The accredited person must not give such an invitation before 1 July 2021.

4.12C  Process for amending consents
 (1) Subject to this rule, if an accredited person allows CDR consumers to amend consents, it must allow them to do so in the same manner that it asks for CDR consumers to give consents.
 (2) Despite subrule 4.11(2), in the case of an amendment to a consent, an accredited person may present, as pre‑selected options, the following details of the current consent:
 (a) the selections or indications referred to in paragraphs 4.11(1)(a), (b) and (ba);
 (b) the election (if any) referred to in paragraph 4.11(1)(e).
 (3) In the case of an amendment to a consent, in addition to the information referred to in subrule 4.11(3), the accredited person must give the CDR consumer:
 (a) a statement that indicates the consequences of amending a consent; and
 (b) a statement that the accredited person will be able to continue to use any CDR data that has already been disclosed to it to the extent allowed by the amended consent.

Subdivision 4.3.2B—Withdrawing consents

4.13  Withdrawal of consents, and notifications
 (1) The CDR consumer who gave a consent may withdraw the consent at any time:
 (a) by using the accredited person's consumer dashboard; or
 (b) by using a simple alternative method of communication to be made available by the accredited person for that purpose.
 (2) The accredited person must:
 (a) if the withdrawal was in accordance with paragraph (1)(b)―give effect to the withdrawal as soon as practicable, and in any case within 2 business days after receiving the communication; and
 (b) if a collection consent was withdrawn, in any case―notify the data holder of the withdrawal in accordance with the data standards.
Note 1: When a data holder is notified of the withdrawal of a collection consent, an authorisation to disclose the CDR data expires: see paragraph 4.26(1)(d).
Note 2: This subrule is a civil penalty provision (see rule 9.8).
 (3) Withdrawal of a consent does not affect an election under rule 4.16 that the CDR consumer's collected CDR data be deleted once it becomes redundant.

Subdivision 4.3.2C—Duration of consent

4.14  Duration of consent
 (1) A consent expires at the earliest of the following:
 (a) if the consent was withdrawn in accordance with paragraph 4.13(1)(b)―the earlier of the following:
 (i) when the accredited person gave effect to the withdrawal;
 (ii) 2 business days after the accredited person received the communication;
 (b) if the consent was withdrawn in accordance with paragraph 4.13(1)(a)―when the consent was withdrawn;
 (d) the end of the period of 12 months after:
 (i) the consent was given; or
 (ii) if the period of the consent has been amended in accordance with this