Document ID: chunk:federal_register_of_legislation:F2024L01443:body:0:p44
Version: federal_register_of_legislation:F2024L01443
Segment Type: other
Provision Reference: 
Character Range: 154056–157342

an attribute sets to be requested individually.

1.2   Attribute sharing policy

 All attribute or attribute sets transmitted across the AGDIS MUST be subject to an attribute sharing policy.

 All ASPs, ISPs and IXPs MUST comply with the attribute sharing policies in this Schedule that apply to them.

 If an attribute or attribute set is not subject to an attribute sharing policy in this Schedule, ASPs, ISP and IXPs MUST NOT transmit that attribute or attribute set across the AGDIS.

 An attribute sharing policy MUST outline:

 1.             the attribute or attribute set to which the policy is applied;
 2.             the consent type applied to the attributes;
 3.             the fulfilment requirements;
 4.             the access policy; and
 5.             the data representation.

1.2.1      Consent types

 Consent types prescribe requirements for gathering of express consent from the individual by an accredited entity participating in the AGDIS.

 The consent types outlined in this Schedule are found in Table 1 below.

 An attribute sharing policy MUST include a consent type and assign the management of that consent to either or both:

 1.             a specific entity (which is a named accredited entity such as myGov as an ASP); and
 2.             a specific role (such as the ASP, ISP and IXP).

 Table 1 Attribute profile consent models

Consent type   Description
Not required   Express consent is not required for the attribute or attribute set.

               This consent type MUST only be applied to an attribute or attribute set when:

                     * the attributes are explicitly exempt from the express consent requirements under one or more of the following:
                              + the Act;
                              + the Accreditation Rules;
                              + the Digital ID Rules; and
                              + the Accreditation Data Standards;
                     * the attributes are technical in nature and do not convey personal information on their own or when combined with other attributes; and
                     * the attributes are classified as identity system meta data.
Every use      Express consent is required every time the attribute or attribute set is shared.

               The consent MUST NOT be remembered or reused in subsequent requests for the attribute or attribute set.
Ongoing        Express consent is required at least the first time the attribute or attribute set is bound to the individual or shared.

               The consent MAY be remembered for a fixed duration where determined by one or more of the following:

                    1.             the Act;
                    2.             the Accreditation Rules;
                    3.             the Digital ID Rules;
                    4.             the Accreditation Data Standards.

               If the consent is remembered, the individual MUST:

                     *          be made aware of the use cases they are providing the consent to facilitate;
                     *          have the option for the consent to not be remembered; and
                     *          be provided with a clear and simple process to vary or withdraw the consent.

               If the consent is