A data holder must provide: an online direct request service eligible consumers can use to make consumer data requests, no less timely, efficient and convenient than its ordinary online customer channels, disclosing in human-readable form, setting out any fees for voluntary consumer data and conforming with the data standards (reasonable steps suffice for the convenience test); an online accredited person request service that discloses in machine-readable form and conforms with the data standards; for each non-individual eligible consumer and each partnership with a partnership account, a service to nominate and withdraw adult nominated representatives who can give, amend and withdraw authorisations; and, for each account where someone has account privileges, a service for the account holder to make and withdraw a secondary user instruction (civil penalty). A consumer without a nominated representative cannot authorise disclosure, so the data holder is neither required nor permitted to disclose. Primary data holders provide the service for shared responsibility data too (rule 1.20(1)).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.