Document ID: chunk:federal_register_of_legislation:F2024L01430:reg:3:p7
Version: federal_register_of_legislation:F2024L01430
Segment Type: reg
Provision Reference: reg 3 (pt 7/8)
Character Range: 30571–33298

entities
 (1) This rule prescribes the conditions in relation to the use or display of the Digital ID Accreditation Trustmark by an authorised entity.
 (2) For the purposes of this rule, the following entities are authorised entities:
 (a) the Digital ID Regulator;
 (b) the System Administrator;
 (c) the Information Commissioner; and
 (d) the Secretary.
 (3) The Digital ID Accreditation Trustmark may only be used or displayed by an authorised entity for the following purposes:
 (a) the performance of functions under or in relation to the Act;
 (b) education in relation to 'this Act' (as defined in section 9 of the Act);
 (c) promotion of the objects of 'this Act' (as defined in section 9 of the Act).

Chapter 6—Record-keeping

6.1  Application of this Chapter
 (1) For the purposes of subsection 135(3) of the Act, an entity specified in subrule (2) must keep records of the kind, for the period and in the manner prescribed by this Chapter.
 (2) Subject to subrule (3), this Chapter applies to:
 (a) an entity that holds an approval to participate in the Australian Government Digital ID System;
 (b) an entity whose approval to participate in the Australian Government Digital ID System is suspended; and
 (c) an entity whose approval to participate in the Australian Government Digital ID System has been revoked.
 (3) This Chapter does not apply to a relying party.
 (4) For the avoidance of doubt, if the accreditation of an entity is suspended or revoked, this Chapter continues to apply to the entity after its accreditation has been suspended or revoked.

6.2  Record keeping requirements
 (1) An entity must keep a prescribed record for whichever of the following periods ends later:
 (a) the period of 3 years that starts on the day the record was created;
 (b) the period of 3 years that starts on the day the record was last used by the entity for the purpose of providing a service that the entity is or was accredited to provide.
 (2) An entity must not destroy or de-identify information contained in a prescribed record if:
 (a) the information is personal information; and
 (b) the information is not biometric information; and
 (c) the information was obtained by the entity in the course of providing accredited services; and
 (d) the entity is required or authorised to retain the information by or under:
 (i) the Act, these rules or the Accreditation Rules;
 (ii) a direction issued by the Digital ID Regulator under section 127 of the Act; or
 (iii) a court/tribunal order (within the meaning of the Privacy Act); and
 (e) the information relates to:
 (i) any current or anticipated legal proceedings; or
 (ii) any dispute resolution proceedings; or
 (iii) a current compliance or enforcement