42After rule 4.6

42  After rule 4.6

4.6A  Disclosure of CDR data relating to account not permitted if not approved by account holder

  Despite subrules 4.6(2) and (4), the data holder must not disclose requested CDR data that relates to a particular account to the person who made the request if:

 (a) both of the following are satisfied:

 (i) the request was made on behalf of a secondary user of the account;

 (ii) the account holder has indicated, through their consumer dashboard, that they no longer approve CDR data relating to that account being disclosed to that accredited person in response to consumer data requests made by that secondary user; or

 (b) a Schedule to the rules provides that the requested CDR data must not be disclosed.

Note 1: For subparagraph (a)(ii), the account holder is able to indicate this using the functionality referred to in subparagraph 1.15(5)(b)(i).

Note 2:  For paragraph (b), for the banking sector, see clause 4.13 of Schedule 3 to these rules.