Document ID: chunk:federal_register_of_legislation:F2024L01438:reg:14:p12
Version: federal_register_of_legislation:F2024L01438
Segment Type: reg
Provision Reference: reg 14 (pt 12/17)
Character Range: 169339–172123

in a transaction before conveying, managing or facilitating the flow of information between the participants to that transaction.

5.37  Digital ID system rules
 (1) This rule applies to an IXP operating in a digital ID system:
 (a) other than the Australian Government Digital ID System; and
 (b) where one or more digital ID service providers participating in the digital ID system provides services in the system that are not accredited services.
 (2) The IXP must ensure that the digital ID system in which the IXP operates is subject to system rules which:
 (a) are binding on an identity service provider that provides services in the digital ID system that are not accredited services (unaccredited ISP);
 (b) allow the IXP or another person to revoke the unaccredited ISP's participation in the digital ID system for non‑compliance with the system rules;
 (c) are not inconsistent with the Act and these rules;
 (d) require that all information conveyed or managed within the digital ID system is dealt with in accordance with approved cryptography as if rule 4.21 applied to the unaccredited ISP;
 (e) require that an unaccredited ISP must not disclose an attribute of an individual referred to in section 45 of the Act without the express consent of the individual; and
 (f) prohibit one-to-many matching of biometric information of an individual collected for the purposes of the identity service provider doing either or both of the following:
 (i) verifying the identity of the individual;
 (ii) authenticating the individual to their digital ID.

Chapter 6—Annual reviews

Part 6.1—Accredited entities to conduct annual reviews

6.1  General requirements
 (1) Before the end of each period specified in rule 6.2 for an accredited entity (reporting period), the accredited entity must conduct a review in accordance with this Part (annual review).
 (2) The accredited entity must, in respect of each reporting period:
 (a) prepare a report in accordance with Part 6.2 of this Chapter; and
 (b) give a copy of the report to the Digital ID Regulator within 30 days of the end of the reporting period.
 (3) Assurance assessments, systems testing and any other testing conducted for an annual review must be conducted as close as practicable to the end of the reporting period for that review.

6.2  Reporting periods

Transitioned accredited entities
 (1) A transitioned accredited entity may nominate a first annual review date if the entity:
 (a) nominates a first annual review date that is any date after 30 June 2025 and before 1 July 2026; and
 (b) gives the nomination, in writing, to the Digital ID Regulator on or before 30 January 2025.
 (2) If a transitioned accredited entity has nominated a first annual review date in accordance with subrule (1), the reporting