Document ID: chunk:federal_register_of_legislation:F2024L01438:reg:9:p4
Version: federal_register_of_legislation:F2024L01438
Segment Type: reg
Provision Reference: reg 9 (pt 4/13)
Character Range: 110543–113470

withdraw or vary that consent, is described in clear, simple and accessible terms.

4.41  Duration of express consent
        (1) This rule applies if an individual gives an accredited entity express consent for the future collection, use or disclosure of the individual's personal information.
        (2) An accredited entity providing public-facing accredited services must provide the individual with a clear and simple process to vary or withdraw any consent given in accordance with subrule (1).
 (3) Consent given in accordance with subrule (1) expires at the earliest of the following:
 (a) the end of the period of consent specified by the individual (if any) when the individual gave their consent or at any time afterwards;
 (b) if the individual has varied their consent—the end of the period of consent specified by the individual (if any) when the individual varied their consent;
 (c) the end of the period of consent specified by the accredited entity when the entity collected the individual's consent;
 (d) 12 months after the consent was initially given.
 (4) An accredited entity must not rely on consent given in accordance with subrule (1) if that consent has been withdrawn or has expired.

4.42  Data minimisation principle
 (1) An accredited entity must only collect personal information that is reasonably necessary for the entity to provide its accredited services.
 (2) If an accredited entity discloses personal information to a relying party for the purposes of the relying party providing a service to an individual, or enabling the individual to access a service, the accredited entity must ensure that the personal information disclosed is limited to the information that is necessary by:
 (a) ensuring that the accredited entity's information technology system allows the relying party to only select the attributes of the individual that the relying party requires to provide the service, or access to the service, to that individual; and
 (b) ensuring that the accredited entity provides only the selected attributes to the relying party.

4.43  Disclosure of personal information for fraud activities
  An accredited entity must notify individuals that the entity may use and disclose the individual's personal information to prevent, detect, manage and investigate digital ID fraud incidents.

4.44  Privacy awareness training
  An accredited entity must ensure that each of its personnel whose duties relate to its accredited services or DI data environment complete privacy awareness training covering the entity's privacy policy, privacy management plan and compliance with the additional privacy safeguards in Chapter 3 of the Act and this Part:
 (a) before starting work on those duties; and
 (b) at least once in every 12-month period thereafter.

4.45  Data breach response plan
 (1) An accredited entity must have, maintain and comply with a data breach response plan that includes