45Division 4.4

45  Division 4.4

Division 4.4—Authorisations to disclose CDR data

Note: Under rule 4.5, if a data holder is considering disclosing voluntary consumer data in response to a consumer data request, or if required consumer data was requested, the data holder must seek an authorisation from the CDR consumer to disclose the CDR data in accordance with (among other things) this Division, and in particular, rules 4.23, 4.24 and 4.25. A failure to do so could contravene one or more civil penalty provisions: see rule 4.5.

4.21  Purpose of Division

  This Division deals with authorisations to disclose CDR data for the purposes of rule 4.5, and amendments to authorisations.

4.22  Requirements relating to data holder’s processes for seeking authorisation

  A data holder’s processes for asking a CDR consumer to give or amend an authorisation must:

 (a) accord with the data standards; and

 (b) having regard to any consumer experience guidelines developed by the Data Standards Body, be as easy to understand as practicable, including by use of concise language and, where appropriate, visual aids.

4.22A  Inviting CDR consumer to amend a current authorisation

 (1) If a data holder has received a notice under rule 4.18C, the data holder must, in accordance with this Division, invite the CDR consumer to amend the authorisation to disclose CDR data accordingly.

 (2) An amendment of an authorisation to disclose CDR data other than in accordance with subrule (1) is of no effect.

4.23  Asking CDR consumer to give authorisation to disclose CDR data or inviting CDR consumer to amend a current authorisation

 (1) When asking a CDR consumer to authorise the disclosure of CDR data, or amend a current authorisation, a data holder must give the CDR consumer the following information about the authorisation or amendment:

 (a) subject to subrule (2), the name of the accredited person that made the request;

 (b) the period of time to which the CDR data that was the subject of the request relates;

 (c) the types of CDR data for which the data holder is seeking an authorisation to disclose;

 (d) whether the authorisation is being sought for:

 (i) disclosure of CDR data on a single occasion; or

 (ii) disclosure of CDR data over a period of time of not more than 12 months;

 (e) if authorisation is being sought for disclosure over a period of time―what that period is;

 (f) a statement that, at any time, the authorisation can be withdrawn;

 (g) instructions for how the authorisation can be withdrawn.