Document ID: chunk:federal_register_of_legislation:F2024L01443:body:0:p45
Version: federal_register_of_legislation:F2024L01443
Segment Type: other
Provision Reference: 
Character Range: 157054–160238

use cases they are providing the consent to facilitate;
                     *          have the option for the consent to not be remembered; and
                     *          be provided with a clear and simple process to vary or withdraw the consent.

               If the consent is remembered, the individual SHOULD be notified:

                     *          if the attribute is an authorisation and the authorisation is revoked by a third party, for example, by the owner or creator of the authorisation; and
                     *          when the consent facilitated use of their attributes in the execution of automated use cases.

Consent type   Description
Every Change   Express consent for the attribute or attribute set is required the first time the attribute or attribute set is shared with the PRP, and every time it is modified.

               Accordingly, subsequent requests for express consent MUST occur when:

                     * the attribute or attribute set has been modified;
                     * the individual has varied or withdrawn any remembered on-going consent; and
                     * the duration of the remembered consent has expired.
               Attribute sharing policies SHOULD only apply this consent type when the underlying attributes support the detection of changes.

1.2.2      Fulfilment requirements

 Not all attributes have guaranteed availability, and some may not be available for the IP level associated with the authenticated session.

 The assertion of attributes in an individual's digital ID account is dependent on the documents available to them, the documents they chose to verify their identity, and any additional linkages an individual has with ASP managed attributes. Accordingly, the fulfilment of some attributes may not be practical however some attributes may still be required.

 The necessity to meet an attributes request is referred to as a fulfilment requirement in this Schedule.

 An attribute sharing policy MUST have a fulfilment policy to inform the behaviours of entities participating in the AGDIS when attribute requests cannot be fulfilled.

 The two fulfilment requirements used in this Schedule are outlined in Table 2 below.

 Table 2 Attribute fulfilment requirement classes

Fulfilment requirement   Criteria and description
Best effort              The attribute or attribute set MUST be fulfilled if the individual has verified or asserted the requested attributes or attribute set and has provided express consent to share them.

                         If the attributes request cannot be fulfilled or the individual has not provided express consent to share, an error SHOULD NOT be raised unless the attribute sharing policy requires it.
Required                 The attribute or attribute set MUST be fulfilled.

                         If the attribute or attribute set cannot be fulfilled or the individual did not provide express consent to share, an error MUST be raised.

1.2.3      Access policy

 Attributes shared with PRPs via the AGDIS are either readily available to PRPs or require approval to access. The rules defining if or why a PRP can request