Document ID: chunk:federal_register_of_legislation:F2024L01438:reg:14:p9
Version: federal_register_of_legislation:F2024L01438
Segment Type: reg
Provision Reference: reg 14 (pt 9/17)
Character Range: 161429–164333

An ISP must revoke an authenticator, as soon as practicable, if:
 (a) an individual's digital ID associated with that authenticator ceases to exist;
 (b) an individual requests that the authenticator be revoked; or
 (c) the ISP determines that the individual no longer meets its eligibility requirements.
Note: For paragraph (1)(c), this may be because the individual has died or the digital ID is fraudulent.
 (2) As soon as practicable after the revocation of an attribute certificate or termination of the individual's authenticator, the ISP must ensure the individual is no longer able to use the authenticator by taking appropriate action considering the authenticator type.
 (3) For the purpose of subrule (2), appropriate action may include ensuring the individual has:
 (a) surrendered, or proved destruction of, a physical authenticator containing attribute certificates signed by the ISP; or
 (b) deactivated the authenticator, uninstalled the authenticator from the device, or had their access to the authenticator revoked.

Division 4—Accessibility and useability

5.29  Application
  This Division applies for the purposes of section 30 of the Act.

5.30  Verification services
 (1) An ISP must provide support to individuals who need assistance during the identity proofing process, including by providing clear instructions about how the individual can update their personal information held by the ISP.
 (2) An ISP must provide individuals who are undergoing the identity proofing process with a clear and simple description of each step of the process, including a description of what the individual needs to do to complete each step and the technical requirements that must be met to complete identity proofing.
 (3) An ISP must provide individuals with information about the technical requirements for using the ISP's accredited services.
Note: Technical requirements may include access to a mobile phone or webcam.
 (4) An ISP must:
 (a) provide individuals with information about the documents or other credentials that may be requested to verify the individual's identity at a particular identity proofing level, including information about the combinations of documents or other credentials that will satisfy the request if more than one document or other credential is required;
 (b) notify individuals as to whether the provision of a requested document or other credential is mandatory; and
 (c) notify individuals of the consequences to the individual if they do not provide particular documents or other credentials.
 (5) If a digital code is to be issued by the ISP to an individual as part of the identity proofing process, the ISP must first inform the individual in clear and simple terms of the following:
 (a) the fact that the individual will receive a digital code from the ISP;
 (b) the method by which the digital code will be issued; and
 (c) what the individual is