[ARCHIVE] Withdrawal of authorisation

Note: This article is out of date and has been archived.

For the latest information, please see article on authorisation and consent.

Archived Text

Question

If a consumer withdraws their authorisation directly with a Data Holder (DH)(in writing or perhaps via phone), it isn’t specifically stated, but should the DH also reflect that withdrawal in the consumer dashboard by marking the associated consent as inactive/withdrawn?  Furthermore, should the dashboard entry reflect the fact that the withdrawal occurred as a result of a manual request from the consumer?

Answer

Yes, in line with Rule 1.15, we'd expect any withdrawal/expiry of authorisation to be reflected on the consumer dashboard, whether the consumer withdraws via the dashboard or directly with the data holder. 

There's nothing in the rules to require the method of withdrawal to be shown on the consumer dashboard.  DHs may wish to do this, if it's helpful for consumers, both on the dashboard and/or in any CDR Receipt they choose to provide in accordance with the CX Guidelines.

Finally, the DH must keep and maintain records of withdrawals of authorisations in accordance with Rule 9.3(1)(b).  We expect this to include how the withdrawal was requested by the customer (e.g. via the dashboard, over the phone, in writing, etc).