Withdrawal of authorisation to disclose CDR data and notification

Question

Under CDR Rule 4.25 (Withdrawal of authorisation to disclose CDR data and notification), is it correct to assume it is no longer mandatory for Data Holders to accept authorisation withdrawal requests in writing, but that they can choose to have that feature if they’d like?

Answer

That is correct – CDR Rule 4.25 provides that a Data Holder may allow a CDR consumer to withdraw authorisation to disclose CDR data to an accredited person by using a simple alternative method of communication made available by the Data Holder for that purpose. This rule is intended to reflect existing methods of communication made available by Data Holders to its consumers.

Data Holders must always have two forms of mechanisms available to consumers to withdraw authorisations. One mechanism must be through the consumer dashboard, and the other may be of the Data Holder's choosing, but an alternate method must be in place.