Document ID: chunk:federal_register_of_legislation:F2024L01438:reg:9:p10
Version: federal_register_of_legislation:F2024L01438
Segment Type: reg
Provision Reference: reg 9 (pt 10/13)
Character Range: 126687–129117

who is less than 15 years old.
 (2) If the ISP is generating a digital ID for an individual at IP Level 1, the ISP will not breach subrule (1) if it requires the individual seeking to generate a digital ID to confirm that they are 15 years or over and the individual gives that confirmation in writing.
Note: For IP Level 1, the individual is not required to provide identity documentation to the ISP that would allow the ISP to independently verify the individual's age.

5.3  One-off digital IDs
 (1) An ISP accredited to generate a digital ID that is to be used once only must not retain an attribute of an individual once the attribute has been disclosed to the relying party in a transaction, unless the ISP is required or permitted to retain the attribute in accordance with subrule (2).
 (2) For the purpose of subrule (1):
 (a) the ISP may retain the attribute for the purposes of preventing or investigating a digital ID fraud incident for a maximum period of 30 days commencing the day after the attribute is disclosed to the relying party in a transaction; and
 (b) the ISP must retain the attribute if the ISP is required by law (including the Act and these rules) to retain the attribute.

5.4  Use of a reusable digital ID
 (1) An ISP must not use a reuseable digital ID of an individual if more than 5 years have elapsed since the digital ID was created.
 (2) Subrule (1) does not apply if:
 (a) the digital ID was proofed to IP1 Plus or IP2;
 (b) the ISP verified a document or other credential of the individual listed in Schedules 1 to 4 of these rules within 5 years from the date that the digital ID was created; and
 (c) less than 5 years have elapsed since the ISP last verified a document or other credential of the individual listed in Schedules 1 to 4 of these rules.
 (3) Subrule (1) does not apply if:
 (a) the digital ID was proofed to IP2 Plus, IP3 or IP4;
 (b) the ISP conducted biometric binding in respect of the digital ID within 5 years from the date that the digital ID was created; and
 (c) less than 5 years have elapsed since the ISP last conducted biometric binding in respect of the digital ID.
 (4) If a reuseable digital ID was created before the commencement of these rules:
 (a) a reference to an ISP in this rule is taken, for the purpose of this rule, to include a reference to that entity at a time before the entity was accredited in accordance with the Act; and
 (b) a reference to