What is the difference between 'Withdrawing' and 'Invalidating' consent for an ADR with the status of Suspended and Inactive?

Question

If the ADR status is 'Suspended' and software product status is 'Inactive', then participants must 'Facilitate Consent Withdrawal'. But if ADR status is 'Suspended' and software product status is 'Removed', then consents need to be 'Invalidated'. What is the difference between 'Facilitate Consent Withdrawal' and 'Invalidate consent'? How are consents invalidated and is it the same as 'Consent Expiry'?

See Data Holder Responsibilities  

Answer

Where the ADR status is 'Suspended' and software product status is 'Inactive' this is referring to an obligation on data holders and ADRs in the CDR Rules that require data sharing to cease BUT all consents for the ADR to remain valid during the period of suspension.  In this situation, participants must continue to facilitate consent withdrawal at the consumers request during the period of suspension, refer to Rule 5.23(3)(b)(ii)(A).  When/If the suspension is lifted data sharing can resume using consents for consumers that have not expired during the period of suspension.

Conversely, where an ADR is 'Revoked' or 'Surrendered' data sharing must cease and all consents must expire, or be 'Invalidated', refer Rule 4.14(6).  Notes following the table in the Data Holder Responsibilities section indicate invalidation is suitable to be addressed overnight.  The process of 'Invaliding consents' also applies where the ADR status is 'Suspended' and the software product status is 'Removed'.

In the context of the rules 'Consent expiry' would ordinarily occur on the date nominated by the consumer when the consent was established.  Invalidation occurs when all consents for an ADR are ‘expired’ at the same time due to an ADR's status changing from Active to either Revoked or Surrendered.

See excerpts of the aforementioned rules below. The CDR Rules can be accessed at the Federal Register of Legislation.

5.23(3)(b)(ii)  in the case of a suspension—of the following:
               (A)  that any consents to collect and to use CDR data may be withdrawn at any time; 

4.14(6)   If an accredited person’s accreditation is revoked or surrendered in accordance with rule 5.17, all of the accredited person’s consents expire when the revocation or surrender takes effect.