21Rule 1.15

21  Rule 1.15

Repeal the rule, substitute:

1.15  Consumer dashboard—data holder

 (1) If a data holder receives a consumer data request from an accredited person on behalf of a CDR consumer, the data holder must ensure that the CDR consumer has an online service that:

 (a) can be used by the CDR consumer to manage authorisations to disclose CDR data in response to the request; and

 (b) contains the details of each authorisation to disclose CDR data specified in subrule (3); and

 (ba) contains any information in the data standards that is specified as information for the purposes of this rule; and

 (bb) contains any information on the Register of Accredited Persons that is specified as information for the purposes of this rule; and

 (c) has a functionality that:

 (i) allows for withdrawal, at any time, of authorisations to disclose CDR data; and

 (ii) is simple and straightforward to use; and

 (iii) is no more complicated to use than the process for giving the authorisation to disclose CDR data; and

 (iv) is prominently displayed; and

 (v) as part of the withdrawal process, displays a message relating to the consequences of the withdrawal in accordance with the data standards; and

 (d) contains any other details, and has any other functionality, required by a Schedule to these rules in relation to a particular designated sector.

Note 1: This subrule is a civil penalty provision (see rule 9.8).

Note 2: For paragraph (d), for the banking sector, see clause 4.14 of Schedule 3.

 (2) Such a service is the data holder’s consumer dashboard for that consumer.

Note: For the banking sector, if an accredited person makes a consumer data request that relates to a joint account on behalf of a secondary user or one joint account holder, the other joint account holders may also need to be provided with consumer dashboards: see clause 4.14 of Schedule 3.

 (2A) For subrule (1), the online service must allow only nominated representatives to manage authorisations in the following circumstances:

 (a) where the CDR consumer is not an individual;

 (b) where the CDR data relates to a partnership account.

 (3) For paragraph (1)(b) and paragraph (5)(a), the information is the following:

 (a) details of the CDR data that has been authorised to be disclosed;

 (b) when the CDR consumer gave the authorisation;

 (c) the period for which the CDR consumer gave the authorisation;

 (d) if the authorisation is current—when it is scheduled to expire;