Document ID: chunk:federal_register_of_legislation:F2024L01438:reg:9:p8
Version: federal_register_of_legislation:F2024L01438
Segment Type: reg
Provision Reference: reg 9 (pt 8/13)
Character Range: 121386–124423

how the biometric information will be destroyed at the end of the testing period.
Note: For paragraph (4)(d), ISO/IEC 24745 outlines how to protect biometric information that is stored.
 (5) An accredited entity must ensure that any testing using biometric information is conducted in accordance with the requirements of one or more policies covering the ethical use of biometric information, being policies and guidelines that ensure biometric systems do not selectively disadvantage or discriminate against any group.

Reporting of test results
 (6) For each reporting period, the accredited entity must prepare a report detailing the results of any testing using biometric information conducted in that reporting period and containing the following information:
 (a) the total number of transactions involving biometric information;
 (b) the number of transactions that were tested;
 (c) the number of individuals whose biometric information was used for testing;
 (d) whether the testing resulted in the entity taking any action to respond to issues identified during the testing;
 (e) an assessment of whether the retention, use and disclosure of the biometric information for testing continues to be an effective mitigation measure against digital ID fraud risks, when balanced against the cyber security risk of retaining the biometric information; and
 (f) in respect of testing conducted for a purpose specified in paragraph (2)(c), (d) or (f)—whether the testing effectively and ethically detected and corrected any bias identified in the biometric matching algorithm or presentation attack detection technology so as not to selectively disadvantage or discriminate against any group whose biometric information is used.
Example: For paragraph (e), the entity's assessment could include consideration as to whether tests using biometric information has improved the thresholds of the presentation attack detection system to effectively reject malicious actors.

4.51  Requirements if biometric information is used for fraud activities
  For the purposes of paragraph 49(8)(c) of the Act, an accredited entity that uses biometric information of an individual for the purposes of preventing or investigating a digital ID fraud incident must conduct the digital ID fraud risk management activities in accordance with written ethical principles aimed at avoiding disadvantage to, or discrimination against, individuals.
Note:  Section 51 of the Act specifies when biometric information must be destroyed.

Part 4.6—Review of DI data environment and statement of scope and applicability

4.52  DI data environment
  At least once in each reporting period, an accredited entity must review the boundaries of its DI data environment:
 (a) in accordance with rule 2.1 as if the references in that rule to 'applicant' were to the 'accredited entity'; and
 (b) update the documented boundaries of its DI data environment to ensure it has correctly and completely defined and documented the boundaries of the DI data environment as at the