Collection Consents - Authorisation Amendment

[CDR-CX-Stream]

Description

Under rules 4.18C, 4.20S, and 4.22A, a data holder is required to invite the CDR consumer to amend the authorisation to disclose CDR data when an amendment notice is received. Data holder CX standards currently put these rules into effect for the authorisation flow and dashboard, by linking authorisation amendment processes with the relevant cdr_arrangement_id. However, it is unclear that ADRs must provide the relevant cdr_arrangement_id in order for the authorisation amendment to operate as intended.

The consequence of failing to provide the relevant cdr_arrangement_id is that data sharing arrangements will be disconnected on consumer dashboards. Further, the simplified amending authorisation flow is only triggered when the cdr_arrangement_id is provided by the ADR.

This change request seeks to clarify that if an ADR invites a consumer to amend a collection consent, then they must provide the relevant cdr_arrangement_id to the data holder for the corresponding authorisation to be amended as per the rules.

Area Affected

CX Standards > Consent Standards > Consent: Amendment of Collection Consents and Authorisations

Change Proposed

Add a new CX standard to clarify that ADRs must supply the relevant cdr_arrangement_id to the data holder for corresponding authorisations to be amended as per the rules. Proposed addition to the standards:

Data recipients MUST supply the relevant cdr_arrangement_id to the data holder when seeking to have a current authorisation amended as per rules 4.18C, 4.20S, and 4.22A.

Note: Providing the cdr_arrangement_id is necessary to trigger the data holder authorisation flow simplifications outlined in the Amending Authorisation Standards. A failure to supply the cdr_arrangement_id will result in the full authorisation flow and a disconnected data sharing arrangement history on consumer dashboards.