Document ID: chunk:federal_register_of_legislation:F2024L01438:reg:14:p10
Version: federal_register_of_legislation:F2024L01438
Segment Type: reg
Provision Reference: reg 14 (pt 10/17)
Character Range: 164113–166999

individual in clear and simple terms of the following:
 (a) the fact that the individual will receive a digital code from the ISP;
 (b) the method by which the digital code will be issued; and
 (c) what the individual is required to do with the digital code.
 (6) An ISP must notify an individual of the outcome of the identity proofing process as follows:
 (a) if the identity proofing process has been successfully completed—by providing the individual with confirmation of the successful identity proofing and information on the next steps to be taken by the individual (if any);
 (b) if the identity proofing process has been partially completed—by providing the individual with details of:
 (i) any information, documents or other credentials that will be destroyed by the entity;
 (ii) any information, documents or other credentials that will be retained by the entity and the period for which they will be retained; and
 (iii) any additional information, documents or other credentials that the individual would need to provide in order to successfully complete the identity proofing process; and
 (c) if the identity proofing process has been unsuccessful—by providing the individual with:
 (i) details of the ISP's alternative channels or support to complete the proofing process, if applicable;
 (ii) clear and simple instructions about how to use any applicable alternative channels or support; and
 (iii) the option to either:

 1.          continue the proofing process using one or more such alternative channels; or

(B)         not continue with the proofing process.
 (7) An ISP must notify an individual in accordance with subrule (6) as soon as practicable after the outcome of the identity proofing process is known to the ISP.
 (8) If an individual elects:
 (a) to continue with the proofing process, the ISP must ensure, to the extent practicable, that the individual is not required to provide the same information that has already been provided to the ISP during the initial proofing process; and
 (b) not to continue with the proofing process, the ISP must:
 (i) ensure that any information provided by the individual during the proofing process is destroyed as soon as practicable after the ISP becomes aware of the individual's decision, unless it is necessary to retain the information to investigate a digital ID fraud incident; and
 (ii) notify the individual that the information will be destroyed.

5.31  Authentication services
  An ISP providing services involving authentication of an individual must provide individuals with information about the use and maintenance of their authenticator, including:
 (a) instructions on how to use the authenticator;
 (b) if the ISP issues authenticators that expire, when the authenticator will expire; and
 (c) what do to if the authenticator is forgotten, lost or stolen.

Part 5.2—Accredited attribute service