Document ID: chunk:federal_register_of_legislation:F2024L01430:reg:3:p4
Version: federal_register_of_legislation:F2024L01430
Segment Type: reg
Provision Reference: reg 3 (pt 4/8)
Character Range: 22904–25702

Other digital ID systems
 (1) This rule applies to:
 (a) an accredited entity that holds an approval to participate; and
 (b) an accredited entity whose approval to participate is suspended.
 (2) The entity must notify the Digital ID Regulator, in accordance with this rule, if:
 (a) the entity uses an information technology system to provide services within the Australian Government Digital ID System; and
 (b) the entity proposes to use that information technology system to provide or receive services within a digital ID system other than the Australian Government Digital ID System (other digital ID system).
 (3) The notification must include the following information:
 (a) the entity's name;
 (b) the contact details for the entity;
 (c) a description of:
 (i) the services to be provided or received by the entity within the other digital ID system; and
 (ii) any accredited services provided by the entity that are the same as or similar to the services to be provided or received by the entity within the other digital ID system;
 (d)  details of the entity providing or managing the other digital ID system;
 (e) the nature of the proposed use of the other digital ID system;
 (f) the likely effect of the entity's use of the other digital ID system on the levels of the entity's risk of:
 (i) a cyber security incident; and
 (ii) a digital ID fraud incident; and
 (g) details of how the entity:
 (i) will clearly distinguish information flows within the Australian Government Digital ID System from information flows within the other digital ID system;
 (ii) will clearly distinguish between accredited services provided in the Australian Government Digital ID System and services provided within the other digital ID system;
 (iii) will ensure that information held by the entity for the purposes of the Australian Government Digital ID System is able to be located and distinguished from information held by the entity for the purposes of the other digital ID system; and
 (iv) will meet its obligations under the Act, these rules, the Accreditation Rules, the Accreditation Data Standards and the AGDIS Data Standards in respect of its accredited services.
Example: For subparagraphs (g)(i) and (ii), an information barrier.
 (4) The notification must be made no later than 28 days before the proposed use of the other digital ID system.
 (5) In this rule:
other digital ID system has the meaning given in paragraph (2)(b).

4.5  System Administrator may give information
 (1) The System Administrator may give information notified to it under rule 4.2 or subrule 4.3(3) to the Digital ID Regulator, the Minister or to a participating entity.
Note: These notifications relate to cyber security incidents and digital ID fraud incidents, proposed changes to the entity's information