Document ID: chunk:federal_register_of_legislation:F2024L01438:reg:8:p3
Version: federal_register_of_legislation:F2024L01438
Segment Type: reg
Provision Reference: reg 8 (pt 3/4)
Character Range: 201290–204013

to cease providing accredited services, the entity must inform the Digital ID Regulator of its intention and details of its plans, as soon as practicable after forming that intent.
Note: Intent may arise if an accredited entity intends to sell, or otherwise dispose of, part of its business that includes provision of its accredited services.

Part 7.4—Data standards relating to accreditation

7.7  Digital ID Data Standards Chair to make standards
 (1) For the purposes of paragraph 99(1)(c) of the Act, the Digital ID Data Standards Chair must make standards, being one or more of technical, data or design standards relating to accreditation, for the matters specified in subrule (2).
 (2) The matters are:
 (a) the authentication of individuals or information, including the kinds of authenticators and authentication levels to be bound to a digital ID;
 (b) the verification of information relating to an individual using biometric information of the individual;
 (c) the authentication of an individual to their digital ID using biometric information of the individual;
 (d) test standards for an entity's information technology system utilising the entity's biometric matching algorithm, including the testing metrics, evaluation and required minimum pass test results, and who may conduct the testing; and
 (e) test standards for an entity's information technology system utilising the entity's technology for presentation attack detection, including the testing metrics, evaluation and required minimum pass test results, and who may conduct the testing.
Note: Accredited entities must comply with the Accreditation Data Standards applicable to the accredited service being provided and the manner of providing that service (see subparagraph 5.1(1)(a)(ii)).

Part 7.5—Record keeping

7.8  General record keeping requirement
  An accredited entity must not destroy or de-identify information in the possession or control of the entity if:
 (a) the information is personal information; and
 (b) the information is not biometric information; and
 (c) the information was obtained by the entity in the course of providing accredited services; and
 (d) the entity is required or authorised to retain the information by or under:
 (i) the Act, these rules or the Digital ID Rules;
 (ii) a direction issued by the Digital ID Regulator under section 127 of the Act; or
 (iii) a court/tribunal order (within the meaning of the Privacy Act); and
 (e) the information relates to:
 (i) any current or anticipated legal proceedings; or
 (ii) any dispute resolution proceedings; or
 (iii) a current compliance or enforcement investigation under 'this Act' (as defined in section 9 of the Act);
  to which the entity is a party.