CDR Rule 4.5 states that a data holder must ask the eligible CDR consumer to authorise disclosure
This rule applies if:
(a) a data holder receives a consumer data request under this Part; and
(b) there is no current authorisation for the data holder to disclose the
requested data to the person who made the request.
Does this prohibit concurrent consent?
Rule 4.5 requires data holders (DHs) to have in place a current authorisation to disclose the requested CDR data to the person who made the request and sets out the process for doing that. If a DH receives a consumer data request from an accredited data recipient (ADR) and the DH has a current authorisation in place to disclose the requested data to that ADR, the DH is not required to go through the process of asking the consumer to authorise disclosure to the ADR again.
If the DH receives a consumer data request from that same ADR, but which is the subject of a new consent from the consumer, the DH will need to ask the consumer to authorise disclosure of that requested data to the ADR to the extent the request is not subject to a current authorisation. Due to the operation of the Consumer Data Standards, this may mean that in practice the consumer will need to authorise all requested data subject to the new consent.