Reporting on refusal for authorisation

Question

Are data holders required to report on instances where they refuse to ask for authorisation?

Answer

Only refusals to disclose CDR data are required to be reported on under rule 9.4; refusals to ask for authorisation are not required to be reported on under rule 9.4. Similarly, in terms of record keeping requirements, rule 9.3(1)(e) only requires data holders to record instances where CDR data has not been disclosed in reliance on an exemption from the obligation to disclose CDR. This does not include a requirement to record instances of refusing to ask for authorisation.