Copies of records

Question

This question relates to ADR obligations on 'Records to be kept and maintained' and 'Requests from CDR consumers for copies of records' - rule 9.3 and 9.5.
We would like to understand the granularity of information a data holder is required to provide the consumer when they ask for copies of their records.
1. Do we need to provide 'scope' information for the initial consent (i.e. account details, transaction details etc)?
2. If the consumer requests for a renewal with amended scope, then will the data holder be required to provide previous scope vs. current scope details?

Answer

As you are aware, rule 9.3(2)(a) requires ADRs to ‘keep and maintain records that record and explain … all consents, including, if applicable, the uses of the CDR data that the CDR consumer has consented to under any use consents’. For the purposes of a collection or use consent, it is expected that these records will include information such as: the type of data the consumer has consented to sharing (for example, account balance and details, transaction details, customer details, etc.), when the consent was given (date and time), the duration of the initial consent, whether the consumer made an election to delete redundant data, and, where applicable, a description of the ADR’s uses of that CDR data.

In relation to records that record and explain amended consents, rule 9.3(2)(b) requires an ADR to ‘keep and maintain records that record and explain … amendments to or withdrawals of consents by CDR consumers’. In meeting this requirement, it is expected that an ADR’s records will indicate any changes to the original scope of the data the consumer has consented to sharing. For example, if Consumer X decides to amend a consent to include an additional data set, that change in scope should be reflected in the relevant records. The same applies for data holders keeping records regarding amendments to authorisations, which are required to be kept under rule 9.3(1)(b).

A couple of existing articles which may also assist you:

• Consumer access to copies of records
• Rule 9.5 – Requests from CDR consumers for copies of records
• Record Keeping - Collection