Document ID: chunk:federal_register_of_legislation:F2024L01438:reg:9:p7
Version: federal_register_of_legislation:F2024L01438
Segment Type: reg
Provision Reference: reg 9 (pt 7/13)
Character Range: 118648–121642

about the useability and accessibility of the entity's public-facing accredited services; and
 (c) if appropriate, incorporate such feedback into the design of its DI data environment.

Part 4.5—Biometric information: testing and fraud activities

4.50  Requirements if biometric information is used for testing activities
 (1) For the purposes of paragraph 49(6)(c) of the Act, an accredited entity that uses biometric information of an individual for the purpose of undertaking testing in relation to the information must comply with this rule.
Note:  Section 51 of the Act specifies when biometric information must be destroyed.

Purposes for which testing may be conducted
 (2) An accredited entity may only undertake testing using biometric information for one or more of the following purposes:
 (a) to identify whether the thresholds of its technology for presentation attack detection are set correctly, including whether active 'spoofing' attacks on the technology will be correctly rejected;
 (b) to identify issues associated with the performance and accuracy of its technology for presentation attack detection;
 (c) to optimise its technology for presentation attack detection to improve its useability, performance and accuracy;
 (d) to optimise controls that account for variances in image quality;
 (e) to identify issues associated with the performance and accuracy of the biometric matching algorithm;
 (f) to optimise the biometric matching algorithm to improve its performance and accuracy; or
 (g) to measure any system demographic biases related to the quality of the biometric information.

Circumstances in which testing is conducted
 (3) Testing using biometric information must be conducted only in the following circumstances:
 (a) if the testing is unable to be conducted effectively using relevant and representative synthetic or anonymised biometric data rather than biometric information of an individual;
 (b) by a person with appropriate skills, experience and qualifications to conduct the testing; and
 (c) in accordance with:
 (i) the entity's system security plan;
 (ii) a policy for working with human test subjects published by a national or international body; and
 (iii) a plan (testing plan) that includes the information specified in subrule (4).
 (4) A testing plan must include the following information:
 (a) the objectives of the testing;
 (b) the methodology to be used to conduct the testing, including:
 (i) the source and type of test data used; and
 (ii) a description of the biometric information and the sample sizes to be used;
 (c) the frequency and duration of the testing;
 (d) how the biometric information will be stored and protected during the period of the testing; and
 (e) how the biometric information will be destroyed at the end of the testing period.
Note: For paragraph (4)(d), ISO/IEC 24745 outlines how to protect biometric information that is stored.
 (5) An accredited entity must ensure that any testing using biometric