Privacy Safeguard 5 - dates on the consumer dashboards

Question

The 'Data requested' screens on the Data Holder (DH) and Accredited Data Recipient (ADR) dashboard's individual data clusters display the start and ending sharing dates. Are these dates the same as the consent arrangement start and end dates? If not then what data would populate the start and end dates for each data cluster?

Answer

The dates next to data clusters reflect PS5/10 obligations - that is, for ongoing collections/disclosures:

• The date the data was first collected/disclosed, which may not be the same as the consent/authorisation start date;
• The final collection/disclosure date, which is not necessarily the same as the consent/authorisation end date, Where the entity is unsure of the end date, the consent/authorisation end date may be displayed but should be updated to the actual date of final collection/disclosure when it becomes known.

Question

Are there examples of CX guidelines for PS5/10 in relation to expired consents/authorisations? Would these dates need to be applied to all data clusters for archived consents?

Answer

There are no CX guidelines for PS5/10 in relation to expired consents/authorisations, but the PS5/10 obligations are required for both active and expired sharing arrangements.

Question

Are there scenarios where these start/end dates (and ADR brand names) are different within a sharing arrangement? For example,  an arrangement may be comprised of data clusters from different brands or products under an entity. 

Answer

As collection consents and authorisations have a 1:1 relationship (i.e. there is a single technical consent/authorisation between 1 ADR and 1 DH), the expectation is for the sharing arrangement to similarly display this 1:1 relationship and, as such, the collection/disclosure dates should refer to a single entity either collecting or disclosing the data cluster, and thus, a single date.

In summary, the CX Guidelines are consistent with CDR agency expectations of how PS5/10 should operate. That is, with dates listed per data cluster rather than an overall date reflecting the sharing arrangement commencement and expiry. PS5/10 would not be considered satisfied by listing the date(s) of the consent/authorisation period, particularly where different data clusters are collected/disclosed on different dates.