Subdivision 4.2.4—Consumer data requests by accredited persons to accredited data recipients
4.7A Consumer data request by accredited person to accredited data recipient
(1) If:
(a) a CDR consumer has given an accredited person a request under rule 4.3 to seek to collect CDR data from an accredited data recipient; and
(b) the request is valid;
the accredited person may request the accredited data recipient to disclose, to the accredited person, some or all of the CDR data that:
(c) is the subject of the relevant collection consent and use consent; and
(d) it is able to collect and use in compliance with the data minimisation principle.
Note: See rule 1.8 for the definition of the “data minimisation principle”.
(2) Such a request is a consumer data request by an accredited person to an accredited data recipient on behalf of a CDR consumer.
Note: An accredited person might need to make consumer data requests to several CDR participants in order to provide the goods or services requested by the CDR consumer, and might need to make regular consumer data requests over a period of time in order to provide those goods or services.
4.7B Accredited data recipient may ask eligible CDR consumer for AP disclosure consent
(a) an accredited data recipient receives, or reasonably anticipates receiving, a consumer data request under rule 4.7A; and
(b) there is no current AP disclosure consent for the accredited data recipient to disclose the requested data to the person who made the request; and
(c) the accredited data recipient reasonably believes that the request was or will be made by an accredited person on behalf of an eligible CDR consumer.
Note: See subrule 1.7(1) for the meaning of “eligible”. For the banking sector, see clause 2.1 of Schedule 3 for when a CDR consumer is eligible.
(2) The accredited data recipient may, in accordance with Division 4.3, ask the CDR consumer for such an AP disclosure consent.
Note: If the CDR consumer consents to the disclosure, the accredited data recipient is authorised (but not required) to disclose the requested CDR data to the accredited person: see paragraph 7.5(1)(f) and rules 7.6, 7.7 and 7.8.
(3) If an accredited data recipient asks for an AP disclosure consent for the purposes of subrule (2), it must do so in accordance with Division 4.3.
44 Division 4.3
Division 4.3—Giving and amending consents
Subdivision 4.3.1—Preliminary
4.8 Purpose of Division
Section 43 - Competition and Consumer (Consumer Data Right) Amendment Rules (No. 3) 2020 - At the end of Division 4.2 | Zoe
This Division deals with giving and amending collection consents, use consents and disclosure consents, as well as related matters.
4.9 Object
The object of this Division is to ensure that a consent is:
(a) voluntary; and
(b) express; and
(c) informed; and
(d) specific as to purpose; and
(e) time limited; and
(f) easily withdrawn.
Subdivision 4.3.2—Giving consents
Note: Under rule 4.3, if an accredited person asks a CDR consumer for their consent to collect and use their CDR data, it must do so in accordance with this Division, and in particular, rules 4.10, 4.11 and 4.12. A failure to do so could contravene one or more civil penalty provisions: see section 56EF of the Act and rule 4.3.
4.10 Requirements relating to accredited person’s processes for seeking consent
(1) An accredited person’s processes for asking a CDR consumer to give and amend a consent:
(a) must:
(i) accord with any consumer experience data standards; and
(ia) subject to subrule (2), accord with any other data standards; and
(ii) having regard to any consumer experience guidelines developed by the Data Standards Body, be as easy to understand as practicable, including by use of concise language and, where appropriate, visual aids; and
(b) must not:
(i) include or refer to the accredited person’s CDR policy or other documents so as to reduce comprehensibility; or
(ii) bundle consents with other directions, permissions, consents or agreements.
(2) Subparagraph (1)(a)(ia) does not apply to:
(a) a collection consent for collection of CDR data from an accredited data recipient; or
(b) a disclosure consent.
4.11 Asking CDR consumer to give consent
Asking CDR consumer to give consent
(1A) An accredited person must not ask a CDR consumer to give a disclosure consent in relation to CDR data unless the consumer has already given the collection and use consents required to collect the CDR data to be disclosed.
Note: This does not prevent the accredited person from asking for a disclosure consent in relation to CDR data that has yet to be collected.
(1) When asking a CDR consumer to give a consent, an accredited person must:
(a) allow the CDR consumer to choose the types of CDR data to which the consent will apply by enabling the CDR consumer to actively select or otherwise clearly indicate:
(i) in the case of a collection consent or a disclosure consent―the particular types of CDR data to which the consent will apply; and
(ii) in the case of a use consent―the specific uses of collected data to which they are consenting; and
(b) allow the CDR consumer to choose the period of the collection consent, use consent, or disclosure consent (as appropriate) by enabling the CDR consumer to actively select or otherwise clearly indicate whether the consent would apply:
(i) on a single occasion; or
(ii) over a specified period of time; and
(ba) in the case of a disclosure consent―allow the CDR consumer to select the person to whom the CDR data may be disclosed;
(c) ask for the CDR consumer’s express consent to the choices referred to in paragraphs (a), (b) and (ba) for each relevant category of consents; and
(d) if the accredited person intends to charge a fee for disclosure of CDR data, or pass on to the CDR consumer a fee charged by a data holder for disclosure of CDR data:
(i) clearly distinguish between the CDR data for which a fee will, and will not, be charged or passed on; and
(ii) allow the CDR consumer to actively select or otherwise clearly indicate whether they consent to the collection or disclosure, as appropriate, of the CDR data for which a fee will be charged or passed on; and
(e) allow the CDR consumer to make an election in relation to deletion of redundant data in accordance with rule 4.16.
Example: For a collection consent, an accredited person could present the CDR consumer with a set of un‑filled boxes corresponding to different types of data, and permit the CDR consumer to select the boxes that correspond to the data they consent to the accredited person collecting.
Note 1: An accredited person could not infer consent, or seek to rely on an implied consent.
Note 2: For paragraph (b), the specified period may not be more than 12 months: see subrule 4.12(1). After the end of the period, redundant data would need to be dealt with in accordance with subsection 56EO(2) of the Act (privacy safeguard 12) and rules 7.12 and 7.13.
Note 3: For paragraph (d), a data holder could charge a fee for disclosure of voluntary consumer data, while an accredited data recipient could charge a fee for the disclosure of any CDR data.
(2) The accredited person must not present pre‑selected options to the CDR consumer for the purposes of subrule (1).
Information presented to CDR consumer when asking for consent
(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information:
(a) its name;
(b) its accreditation number;
(c) in the case of a collection consent or a use consent―how the collection or use (as applicable) indicated in accordance with subrule (1) complies with the data minimisation principle, including how:
(i) in the case of a collection consent―that collection is reasonably needed, and relates to no longer a time period than is reasonably needed; and
(ii) in the case of a use consent―that use would not go beyond what is reasonably needed;
in order to provide the requested goods or services to the CDR consumer or make the other uses consented to;
(d) if the accredited person intends passing a fee on, or charging a fee, to the CDR consumer as described in paragraph (1)(d)―the following information:
(i) the amount of the fee;
(ii) the consequences if the CDR consumer does not consent to the collection, or to the disclosure, of that data;
(e) if the accredited person is seeking a de‑identification consent—the additional information specified in rule 4.15;
(f) if the CDR data may be disclosed to, or collected by, an outsourced service provider (including one that is based overseas) of the accredited person:
(i) a statement of that fact; and
(ii) a link to the accredited person’s CDR policy; and
(iii) a statement that the consumer can obtain further information about such disclosures from the policy if desired;
(g) the following information about withdrawal of consents:
(i) a statement that, at any time, the consent can be withdrawn;
(ii) instructions for how the consent can be withdrawn;
(iii) a statement indicating the consequences (if any) to the CDR consumer if they withdraw the consent;
(h) the following information about redundant data:
(i) a statement, in accordance with rule 4.17, regarding the accredited person’s intended treatment of redundant data;
(ii) a statement outlining the CDR consumer’s right to elect that their redundant data be deleted;
(iii) instructions for how the election can be made.
Note: For paragraph (c), if the accredited person is seeking the CDR consumer’s consent to de‑identification as referred to in paragraph (e), the accredited person would need to indicate how that would comply with the data minimisation principle.
4.12 Restrictions on seeking consent
(1) An accredited person must not specify a period of time for the purposes of paragraph 4.11(1)(b) that is more than 12 months.
(2) An accredited person must not ask for a collection consent or a use consent unless it would comply with the data minimisation principle in respect of that collection or those uses.
Note: See rule 1.8 for the definition of “data minimisation principle”.
(3) An accredited person must not ask for a consent:
(a) that is not in a category of consents; or
(b) subject to subrule (4), for using the CDR data, including by aggregating the data, for the purpose of:
(i) identifying; or
(ii) compiling insights in relation to; or
(iii) building a profile in relation to;
any identifiable person who is not the CDR consumer who made the consumer data request.
(4) Paragraph (3)(b) does not apply in relation to a person whose identity is readily apparent from the CDR data, if the accredited person is seeking consent to:
(a) derive, from that CDR data, CDR data about that person’s interactions with the CDR consumer; and
(b) use that derived CDR data in order to provide the requested goods or services.
Subdivision 4.3.2A—Amending consents
4.12A Amendment of consent
An amendment of a consent takes effect when the CDR consumer amends the consent.
Note: It is not possible for the CDR consumer to specify a different day or time.
4.12B Inviting CDR consumer to amend consent
(1) An accredited person may invite a CDR consumer to amend a consent given in accordance with this Division only in accordance with this rule.
(2) The accredited person may give the invitation:
(a) if its consumer dashboard offers the consent amendment functionality referred to in subrule 1.14(2A)―via its consumer dashboard; or
(b) in writing directly to the CDR consumer.
(3) The accredited person may invite a CDR consumer to amend a current consent if:
(a) the amendment would better enable the accredited person to provide the goods or services referred to in paragraph 4.3(1)(a); or
(b) the amendment would:
(i) be consequential to an agreement between the accredited person and the CDR consumer to modify those goods or services; and
(ii) enable the accredited person to provide the modified goods or services.
(4) The accredited person must not, for an invitation to amend the period referred to in paragraph 4.11(1)(b):
(a) give the invitation any earlier than a reasonable period before the current consent is expected to expire; or
(b) give more than a reasonable number of such invitations within this period.
(5) The accredited person must not give such an invitation before 1 July 2021.
4.12C Process for amending consents
(1) Subject to this rule, if an accredited person allows CDR consumers to amend consents, it must allow them to do so in the same manner that it asks for CDR consumers to give consents.
(2) Despite subrule 4.11(2), in the case of an amendment to a consent, an accredited person may present, as pre‑selected options, the following details of the current consent:
(a) the selections or indications referred to in paragraphs 4.11(1)(a), (b) and (ba);
(b) the election (if any) referred to in paragraph 4.11(1)(e).
(3) In the case of an amendment to a consent, in addition to the information referred to in subrule 4.11(3), the accredited person must give the CDR consumer:
(a) a statement that indicates the consequences of amending a consent; and
(b) a statement that the accredited person will be able to continue to use any CDR data that has already been disclosed to it to the extent allowed by the amended consent.
Subdivision 4.3.2B—Withdrawing consents
4.13 Withdrawal of consents, and notifications
(1) The CDR consumer who gave a consent may withdraw the consent at any time:
(a) by using the accredited person’s consumer dashboard; or
(b) by using a simple alternative method of communication to be made available by the accredited person for that purpose.
(2) The accredited person must:
(a) if the withdrawal was in accordance with paragraph (1)(b)―give effect to the withdrawal as soon as practicable, and in any case within 2 business days after receiving the communication; and
(b) if a collection consent was withdrawn, in any case―notify the data holder of the withdrawal in accordance with the data standards.
Note 1: When a data holder is notified of the withdrawal of a collection consent, an authorisation to disclose the CDR data expires: see paragraph 4.26(1)(d).
(3) Withdrawal of a consent does not affect an election under rule 4.16 that the CDR consumer’s collected CDR data be deleted once it becomes redundant.
Subdivision 4.3.2C—Duration of consent
4.14 Duration of consent
(1) A consent expires at the earliest of the following:
(a) if the consent was withdrawn in accordance with paragraph 4.13(1)(b)―the earlier of the following:
(i) when the accredited person gave effect to the withdrawal;
(ii) 2 business days after the accredited person received the communication;
(b) if the consent was withdrawn in accordance with paragraph 4.13(1)(a)―when the consent was withdrawn;
(d) the end of the period of 12 months after:
(i) the consent was given; or
(ii) if the period of the consent has been amended in accordance with this Subdivision―the consent was last amended;
(e) at the end of the period the CDR consumer consented to in accordance with rule 4.11;
(f) if the consent expires as a result of the operation of another provision of these rules that references this paragraph.
Note: Clause 7.2 of Schedule 3 is an example of a provision referencing paragraph (f). This relates to when an accredited data recipient of CDR data becomes instead a data holder of that CDR data.
(1A) If:
(a) an accredited person is notified, under paragraph 4.25(2)(b), of the withdrawal of an authorisation to disclose CDR data; and
(b) the collection consent has not expired in accordance with subrule (1);
the collection consent to collect that CDR data expires when the accredited person receives that notification.
Note: This would not result in the use consent relating to any CDR data that had already been collected expiring. However, see the notification requirement of rule 4.18A.
(1B) If:
(a) an accredited person has a collection consent to collect particular CDR data from a particular accredited data recipient; and
(b) the accredited data recipient has an AP disclosure consent to disclose that CDR data to that accredited person;
then if one of those consents expires, the other expires when the accredited person or accredited data recipient is notified of the first‑mentioned expiry.
(1C) If an accredited person becomes a data holder, rather than an accredited data recipient, of particular CDR data as a result of subsection 56AJ(4) of the Act, all of that accredited person’s consents given under these rules that relate to that CDR data expire.
(2) If an accredited person’s accreditation is revoked or surrendered in accordance with rule 5.17, all of the accredited person’s consents expire when the revocation or surrender takes effect.
Subdivision 4.3.3—Information relating to de‑identification of CDR data
4.15 Additional information relating to de‑identification of CDR data
For paragraph 4.11(3)(e), the additional information relating to de‑identification is the following:
(a) what the CDR data de‑identification process is;
(b) if it would disclose (by sale or otherwise) the de‑identified data to one or more other persons;
(i) that fact; and
(ii) the classes of persons to which it would disclose that data;
(iii) why it would so disclose that data;
(c) if the accredited person would use the de‑identified data for general research―that fact, together with a link to a description in the accredited person’s CDR policy of:
(i) the research to be conducted; and
(ii) any additional benefit to be provided to the CDR consumer for consenting to the use;
(e) that the CDR consumer would not be able to elect, in accordance with rule 4.16, to have the de‑identified data deleted once it becomes redundant data.
Subdivision 4.3.4—Election to delete redundant data
4.16 Election to delete redundant data
(1) The CDR consumer who gave a consent relating to particular CDR data may elect that the collected data, and any data derived from it, be deleted when it becomes redundant data:
(a) when giving the consent; or
(b) at any other time before the consent expires.
Note: See rule 7.12 for the effect of an election.
(2) The CDR consumer may make the election:
(a) by communicating it to the accredited person in writing; or
(b) by using the accredited person’s consumer dashboard.
(3) This rule does not apply if, when seeking the consent, the accredited person informs the CDR consumer that they have a general policy of deleting CDR data when it becomes redundant data.
Note: See paragraph 4.17(1)(a).
(4) This rule does not require the deletion of derived CDR data that was de‑identified in accordance with the CDR data de‑identification process before the collected data from which it was derived became redundant.
4.17 Information relating to redundant data
(1) For subparagraph 4.11(3)(h)(i), the accredited person must state whether they have a general policy, when collected CDR data becomes redundant data, of:
(a) deleting the redundant data; or
(b) de‑identifying the redundant data; or
(c) deciding, when the CDR data becomes redundant data, whether to delete it or de‑identify it.
(2) An accredited person that gives the statement referred to in paragraph (1)(b) or (c) must also state:
(a) that, if it de‑identifies the redundant data:
(i) it would apply the CDR data de‑identification process; and
(ii) it would be able to use or, if applicable, disclose (by sale or otherwise) the de‑identified redundant data without seeking further consent from the CDR consumer; and
(b) what de‑identification of CDR data in accordance with the CDR data de‑identification process means; and
(c) if applicable, examples of how it could use the redundant data once de‑identified.
Note: For the CDR data de‑identification process, see rule 1.17.
Subdivision 4.3.5—Notification requirements
4.18 CDR receipts
(1) The accredited person must give the CDR consumer a notice that complies with this rule (a CDR receipt) as soon as practicable after:
(a) the CDR consumer gives the accredited person a collection consent, a use consent or a disclosure consent; or
(aa) the CDR consumer amends such a consent in accordance with this Part; or
(b) the CDR consumer withdraws such a consent in accordance with rule 4.13
(2) A CDR receipt given for the purposes of paragraph (1)(a) must set out:
(a) the details that relate to the consent that are listed in paragraphs 1.14(3)(a) to (f); and
(b) in the case of a collection consent―the name of each CDR participant the CDR consumer has consented to the collection of CDR data from; and
(ba) in the case of a disclosure consent―the name of the person the CDR consumer has consented to the disclosure of CDR data to; and
(c) any other information the accredited person provided to the CDR consumer when obtaining the consent (see rule 4.11).
(2A) A CDR receipt given for the purposes of paragraph (1)(aa) must set out details of each amendment that has been made to the consent.
(3) A CDR receipt given for the purposes of paragraph (1)(b) must set out when the consent expired.
(4) A CDR receipt must be given in writing otherwise than through the CDR consumer’s consumer dashboard.
(5) A copy of the CDR receipt may be included in the CDR consumer’s consumer dashboard.
4.18A Notification if collection consent expires
(1) This rule applies if, in relation to particular goods or services an accredited person is providing as referred to in subrule 4.3(1):
(a) the collection consent expires; but
(b) the use consent is current.
(2) The accredited person must notify the CDR consumer as soon as practicable that, at any time, they:
(a) may withdraw the use consent; and
(b) may make the election to delete redundant data in respect of that CDR data under rule 4.16.
(3) The notification must be given in writing otherwise than through the CDR consumer’s consumer dashboard.
(4) The notification may also be included in the CDR consumer’s consumer dashboard.
4.18B Notification if collection consent or AP disclosure consent expires
(1) This rule applies if:
(a) an accredited person has a collection consent relating to particular CDR data and a particular accredited data recipient; and
(b) the accredited data recipient has an AP disclosure consent relating to that CDR data and that accredited person.
(2) If the collection consent expires in accordance with these rules, the accredited person must notify the accredited data recipient as soon as practicable of the expiry.
(3) If the AP disclosure consent expires in accordance with these rules, the accredited data recipient must notify the accredited person as soon as practicable of the expiry.
4.18C Notification if collection consent is amended
(a) an accredited person has a collection consent relating to particular CDR data and a particular CDR participant; and
(b) the CDR consumer amends the consent.
(2) The accredited person must notify:
(a) if the CDR participant is a data holder―the data holder, in accordance with the data standards, that the consent has been amended; and
(b) if the CDR participant is an accredited data recipient―the accredited data recipient as soon as practicable that the consent has been amended.
4.19 Updating consumer dashboard
An accredited person must update a CDR consumer’s consumer dashboard as soon as practicable after the information required to be contained on the dashboard changes.
Note: This rule is a civil penalty provision (see rule 9.8).
4.20 Ongoing notification requirement—collection consents and use consents
(1) This rule applies in relation to a collection consent or a use consent if:
(a) the consent is current; and
(b) 90 days have elapsed since the latest of the following:
(i) the CDR consumer gave the consent;
(ia) the CDR consumer last amended the consent;
(ii) the CDR consumer last used their consumer dashboard;
(iii) the accredited person last sent the CDR consumer a notification in accordance with this rule.
(2) The accredited person must notify the CDR consumer in accordance with this rule that the consent is still current.
(3) The notification must be given in writing otherwise than through the CDR consumer’s consumer dashboard.
(4) A copy of the notification may be included in the CDR consumer’s consumer dashboard.