Document ID: chunk:federal_register_of_legislation:F2020L01688:clause:1_21:p1
Version: federal_register_of_legislation:F2020L01688
Segment Type: clause
Provision Reference: sch 1 cl 21 (pt 1/3)
Character Range: 14152–16866

21  Rule 1.15
Repeal the rule, substitute:

1.15  Consumer dashboard—data holder
 (1) If a data holder receives a consumer data request from an accredited person on behalf of a CDR consumer, the data holder must ensure that the CDR consumer has an online service that:
 (a) can be used by the CDR consumer to manage authorisations to disclose CDR data in response to the request; and
 (b) contains the details of each authorisation to disclose CDR data specified in subrule (3); and
 (ba) contains any information in the data standards that is specified as information for the purposes of this rule; and
 (bb) contains any information on the Register of Accredited Persons that is specified as information for the purposes of this rule; and
 (c) has a functionality that:
 (i) allows for withdrawal, at any time, of authorisations to disclose CDR data; and
 (ii) is simple and straightforward to use; and
 (iii) is no more complicated to use than the process for giving the authorisation to disclose CDR data; and
 (iv) is prominently displayed; and
 (v) as part of the withdrawal process, displays a message relating to the consequences of the withdrawal in accordance with the data standards; and
 (d) contains any other details, and has any other functionality, required by a Schedule to these rules in relation to a particular designated sector.
Note 1: This subrule is a civil penalty provision (see rule 9.8).
Note 2: For paragraph (d), for the banking sector, see clause 4.14 of Schedule 3.
 (2) Such a service is the data holder's consumer dashboard for that consumer.
Note: For the banking sector, if an accredited person makes a consumer data request that relates to a joint account on behalf of a secondary user or one joint account holder, the other joint account holders may also need to be provided with consumer dashboards: see clause 4.14 of Schedule 3.
 (2A) For subrule (1), the online service must allow only nominated representatives to manage authorisations in the following circumstances:
 (a) where the CDR consumer is not an individual;
 (b) where the CDR data relates to a partnership account.
 (3) For paragraph (1)(b) and paragraph (5)(a), the information is the following:
 (a) details of the CDR data that has been authorised to be disclosed;
 (b) when the CDR consumer gave the authorisation;
 (c) the period for which the CDR consumer gave the authorisation;
 (d) if the authorisation is current—when it is scheduled to expire;
 (e) if the authorisation is not current—when it expired;
 (f) information relating to CDR data that was disclosed pursuant to the authorisation (see rule 7.9);
 (g) for a disclosure of CDR data that relates to the authorisation but that was pursuant to a