An accredited data recipient that receives or expects a rule 4.7A request, has no current AP disclosure consent and reasonably believes the request is for an eligible consumer may ask the consumer for an AP disclosure consent, and must do so in accordance with Division 4.3 (civil penalty). If the consumer consents, the recipient is authorised but not required to disclose.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.