Document ID: chunk:federal_register_of_legislation:F2024L01436:clause:1_3
Version: federal_register_of_legislation:F2024L01436
Segment Type: clause
Provision Reference: sch 1 cl 3
Character Range: 24491–30869

3                                                                                    Makesure Consulting Pty Ltd          Accredited identity service provider   (a) The entity's accredited services must be provided only for the purposes of the RatifyID mobile application, which may only allow users to:
                                                                                                                                                                     (i) create a reusable digital ID up to the IP2 IP level; and
                                                                                                                                                                     (ii) bind an AL2 level authenticator to that digital ID.
                                                                                                                                                                 (b) The entity must only disclose personal information to a relying party that reasonably requires that information to enable the relying party to provide, or provide access to, the service requested by the individual.
                                                                                                                                                                 (c) The entity may only disclose, to any relying party within the class of industry segments specified in sub-column 1 of a sub-item in the following table, the restricted attributes specified in sub-column 2 of that sub-item if the restricted attributes to be disclosed:
                                                                                                                                                                     (i) have been collected and verified by the entity through direct interaction with an individual; and
                                                                                                                                                                     (ii) have been selected by the requesting relying party in the entity's information technology system as a restricted attribute that is necessary for the requesting relying party to provide, or provide access to, a service to an individual.
                                                                                                                                                                 Sub-Item  Sub-column 1                                    Sub-column 2
                                                                                                                                                                           Segment                                         Restricted attributes permitted to be disclosed
                                                                                                                                                                 1         Aviation infrastructure, security & operations  Aviation Security Identity Card reference number.
                                                                                                                                                                 2         Corrective services                             Driver's licence document number.
                                                                                                                                                                                                                           Passport document number.
                                                                                                                                                                                                                           Birth certificate document number.
                                                                                                                                                                 3         Delivery services                               Driver's licence document number.
                                                                                                                                                                 4         Healthcare                                      Medicare card Individual Reference Number and card number.
                                                                                                                                                                 5         International travel                            Passport document number.
                                                                                                                                                                 6         Labour hire                                     Driver's licence document number.
                                                                                                                                                                 7         Maritime infrastructure, security & operations  Maritime Security Identity Card reference number.
                                                                                                                                                                 8         Vehicle hire                                    Driver's licence document number.

                                                                                                                                                                 (d) The entity must ensure, in relation to the entity's accredited services provided through the RatifyID mobile application, that:
                                                                                                                                                                     (i) the accredited services are hosted by infrastructure situated in Australia;
                                                                                                                                                                     (ii) any personal information held by the entity is not disclosed to persons outside of Australia; and
                                                                                                                                                                     (iii) third party access to the entity's server is under the entity's control and time limited.