Document ID: chunk:federal_register_of_legislation:F2024L01443:schedule:3:p1
Version: federal_register_of_legislation:F2024L01443
Segment Type: schedule
Provision Reference: sch 3 (pt 1/2)
Character Range: 233776–237199

Schedule 3 – AGDIS Attribute Profile. Page 54

    3.        Attribute Service Provider (ASP) Profiles

 This Chapter provides the attribute sharing policies for the attributes and attribute sets provided by ASPs.

 An IXP MUST implement support to broker access to these attributes in accordance with this Chapter's attribute sharing policies.

 An IXP MUST not broker requests for ASP managed attributes or attribute sets to ISPs to ensure AGDIS privacy requirements are maintained.

 Table 37 ASP managed attributes and attribute sets

Attribute Set            Attributes                                                Description
Business Authorisations  Authorisation Schemas Unique Relationship ID Entity ID    The Australian Taxation Office's Relationship Authorisation Manager (RAM) manages the authorisation for a person to act on behalf of a business entity that is registered with the Australian Business Register (ABR) and issued with an Australian Business Number (ABN).
                         Entity Type Entity Name Contact Emails Relationship Type
                         Relationship Start Time Relationship End Time Roles
                         Entitlements
                         Attributes Last Updated
myGov linkID             myGov linkID                                              A pairwise identifier used by the myGov platform. This is attribute is subject to restrictions.

    3.1   Business Authorisations

 Business Authorisations are an attribute set managed by the Australian Taxation Office's Relationship Authorisation Manager (RAM). A Business Authorisation represents a relationship between an individual, an Australian business, and a government service provider.

 Business Authorisations have the following 4 key components:

      1.             the individual or subject of the authorisation;
      2.             the business on behalf of which the authorisation allows the individual to act, represented by an Australian Business Number (ABN);
      3.             the service provider the individual's business authorisation is for; and
      4.             the creator of the authorisation, a principal authority or administrator.

 A summary of the attribute sharing policy for business documents is presented below.

 Business Authorisations are subject to an Open access sharing policy. With the caveat that a PRP SHOULD be established in RAM as a service provider before making an attribute request for Business Authorisations.

 Acting in its capacity as an ASP, RAM:

      1.             MUST request express consent from the individual when they accept a Business Authorisation;
      2.             if the consent is remembered – MUST inform the individual of the terms of the ongoing consent and the use cases it covers, and how consent can be varied or withdrawn;
      3.             if the consent is remembered – MUST provide the individual with a clear and simple process to vary or withdraw consent;
      4.             MAY notify a service provider when an authorisation has been issued, revoked, or expired; and
      5.             SHOULD notify the subject of a Business Authorisation when the authorisation has been revoked or expired.

 An IXP brokering attribute requests to RAM MUST facilitate the mapping of the IXP's issued PRP client identifier(s) to the identifier RAM has assigned to a service provider.

 The data representation