02
(1) This rule applies if an individual gives an accredited entity express consent for the future collection, use or disclosure of the individual’s personal information. (2) An accredited entity providing public-facing accredited services must provide the individual with a clear and simple process to vary or withdraw any consent given in accordance with subrule (1). (3) Consent given in accordance with subrule (1) expires at the earliest of the following: (a) the end of the period of consent specified by the individual (if any) when the individual gave their consent or at any time afterwards; (b) if the individual has varied their consent—the end of the period of consent specified by the individual (if any) when the individual varied their consent; (c) the end of the period of consent specified by the accredited entity when the entity collected the individual’s consent; (d) 12 months after the consent was initially given. (4) An accredited entity must not rely on consent given in accordance with subrule (1) if that consent has been withdrawn or has expired.
4.41 Duration of express consent