A CDR representative must not specify a consent period over 12 months, must not ask for a collection, use or disclosure consent unless it complies with the data minimisation principle, and must not ask for a consent outside the categories or for using data, including by aggregation, to identify, compile insights about or profile anyone other than the consumer (except deriving that person's interactions with the consumer for the service). Representatives cannot deal with CDR business consumers, so the 7-year period is not available to them.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.