Document ID: chunk:federal_register_of_legislation:F2020L01688:clause:1_21:p2
Version: federal_register_of_legislation:F2020L01688
Segment Type: clause
Provision Reference: sch 1 cl 21 (pt 2/3)
Character Range: 16623–19226

authorisation is not current—when it expired;
 (f) information relating to CDR data that was disclosed pursuant to the authorisation (see rule 7.9);
 (g) for a disclosure of CDR data that relates to the authorisation but that was pursuant to a request under subsection 56EN(4) of the Act—that fact.
Note 1: For paragraph (d), authorisations to disclose CDR data expire at the latest 12 months after they are given: see paragraph 4.26(1)(e).
Note 2: The consumer dashboard could contain other information too, for example, the written notice referred to in rules 7.10 (which deals with quality of CDR data under privacy safeguard 11, section 56EN of the Act) and 7.15 (which deals with correction requests under privacy safeguard 13, section 56EP of the Act).
 (4) A data holder does not contravene subrule (1) in relation to subparagraphs (1)(c)(ii) and (iii) so long as it takes reasonable steps to ensure that the functionality complies with those subparagraphs.

Secondary users
 (5) If the CDR consumer is a secondary user for an account, the data holder must also provide the account holder with an online service that:
 (a) for each authorisation to disclose CDR data given by the secondary user—contains the details specified in subrule (3); and
 (b) has a functionality that:
 (i) allows for the account holder to, at any time, give the indication referred to in subparagraph 4.6A(a)(ii) in relation to a particular accredited person; and
 (ii) allows for the withdrawal of the secondary user instruction; and
 (iii) is simple and straightforward to use; and
 (iv) is no more complicated to use than the processes for giving the authorisations or instructions; and
 (v) is prominently displayed; and
 (vi) as part of the withdrawal process, displays a message relating to the consequences of the withdrawal in accordance with the data standards.
Note 1: This subrule is a civil penalty provision (see rule 9.8).
Note 2:  If the account holder makes an indication in accordance with subparagraph (5)(b)(i), the data holder will no longer be able to disclose CDR data relating to that account to that accredited person: see subrules 4.6(2) and (4) and subrule 4.6A(1).
 (6) A data holder does not contravene subrule (5) in relation to subparagraphs (5)(b)(iii) and (iv) so long as it takes reasonable steps to ensure that the functionality complies with those subparagraphs.
 (7) If the data holder provides a consumer dashboard for the account holder, the service mentioned in subrule (5) must be included in the consumer dashboard.
Note: This subrule is a civil penalty provision (see rule 9.8).