The rules recognise collection, use and disclosure consents (disclosure being to an accredited person under an AP disclosure consent, to an accredited person for direct marketing, to a trusted adviser under a TA disclosure consent, to a specified person under an insight disclosure consent, or, other than for a CDR representative, to a specified person under a business consumer disclosure consent), plus direct marketing and de-identification consents, grouped into eight categories. An insight disclosure consent may authorise disclosure only to verify identity, account balance or the details of credits and debits, and must not reveal the amount or date of any individual transaction where more than one transaction is involved. An accredited person must not make giving an insight disclosure consent, or naming a particular recipient, a condition of supply (subrule (4), civil penalty); a CDR representative must not either, and its principal contravenes subrule (6) if it does. A consumer is a CDR business consumer where the accredited person has taken reasonable steps to confirm it is not an individual or has an active ABN; a business consumer statement certifies that a use, TA, insight or business consumer disclosure consent is given so the accredited person can serve it as a business. An accredited person must not make a business consumer disclosure consent, a business consumer statement or the naming of a recipient a condition of supply (subrule (12), civil penalty); the consent and the statement (but not the choice of recipient) may be required where the only service asked for is collection and provision of the data to the specified person, and the same carve-out applies to insight disclosure consents (subrule (7)). An accredited person could not deal with anyone as a CDR business consumer before 1 December 2023 (subrule (14)).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.