Document ID: chunk:federal_register_of_legislation:C2024C00830:section:9:p2
Version: federal_register_of_legislation:C2024C00830
Segment Type: section
Provision Reference: s 9 (pt 2/2)
Character Range: 32779–35249

information is involved in the breach; and
 (g) the Department to notify each party to the agreement that is relevant to, or impacted by, a data breach of which the Information Commissioner is informed under paragraph (f); and
 (h) each party notified under paragraph (g) of a data breach, that is impacted by that breach, to take reasonable steps to notify each individual to whom the identification information relates.
 (3) For the purposes of paragraph (2)(c), the matters are as follows:
 (a) how the party seeking express consent uses identity verification services;
 (b) how any facial images of the individual collected by the party from the individual for requesting an identity verification service or from a response to a request for an identity verification service will be used and disposed of;
 (c) whether any such facial images will be retained or used for purposes other than those for which the identity verification service is to be requested;
 (d) what legal obligations the party seeking to collect the identification information has in relation to that collection;
 (e) what rights the individual has in relation to the collection of the identification information;
 (f) the consequences of the individual declining to consent;
 (g) where the individual can get information about making complaints relating to the collection, use and disclosure of the identification information for the purposes of requesting and provision of identity verification services;
 (h) where the individual can get information about the operation and management of the approved identity verification facilities by the Department in connection with the requesting and provision of identity verification services.
 (4) A participation agreement must provide that a party to the agreement is not authorised to use or disclose identification information obtained for the purposes of requesting or providing identity verification services for the purposes of any of the following:
 (a) engaging in activities that would allow the party to create a data profile of the person whose identity is being verified (including where it would allow the person's behaviour to be tracked (whether or not online));
 (b) offering to supply goods or services;
 (c) advertising or promoting goods or services;
 (d) enabling another person or entity to offer to supply goods or services;
 (e) enabling another person or entity to advertise or promote goods or services;
 (f) market research.