If the ADR status is 'Suspended' and software product status is 'Inactive', then participants must 'Facilitate Consent Withdrawal'. But if ADR status is 'Suspended' and software product status is 'Removed', then consents need to be 'Invalidated'. What is the difference between 'Facilitate Consent Withdrawal' and 'Invalidate consent'? How are consents invalidated and is it the same as 'Consent Expiry'?
Where the ADR status is 'Suspended' and software product status is 'Inactive' this is referring to an obligation on Data Holders and Accredited Data Recipients in the Rules that require data sharing to cease BUT all consents for the ADR to remain valid during the period of suspension. In this situation, participants must continue to facilitate consent withdrawal at the consumers request during the period of suspension, refer Rule 5.23(3)(b)(ii)(A). When/If the suspension is lifted data sharing can resume using consents for consumers that have not expired during the period of suspension.
Conversely, where an ADR is 'Revoked' or 'Surrendered' data sharing must cease and all consents must expire, or be 'Invalidated', refer Rule 4.14 (2). Notes following the table in the Data Holder Responsibilities section indicate invalidation is suitable to be addressed overnight. The process of 'Invaliding consents' also applies where the ADR status is 'Suspended' and the software product status is 'Removed'.
In the context of the rules 'Consent expiry' would ordinarily occur on the date nominated by the consumer when the consent was established. Invalidation occurs when all consents for an ADR are ‘expired’ at the same time due to an ADR's status changing from Active to either Revoked or Surrendered.
See excerpts of the aforementioned rules below; refer to this Guide on Finding the latest version of the Consumer Data Right Rules.
5.23(3)(b)(ii) in the case of a suspension—of the following:
(A) that any consents to collect and to use CDR data may be withdrawn at any time;
4.14 (2) If an accredited person’s accreditation is revoked or surrendered in accordance with rule 5.17, all consents for the accredited person to collect and use CDR data expire when the revocation or surrender takes effect.