18Conditions relating to restricted attributes of individuals

18 Conditions relating to restricted attributes of individuals

Matters to which the Digital ID Regulator must have regard before authorising disclosure etc. of restricted attributes (1) Subsection (2) applies if the Digital ID Regulator proposes to impose a condition on an entity’s accreditation authorising the entity to collect or disclose a restricted attribute of an individual. (2) In deciding whether to impose the condition, the Digital ID Regulator must have regard to the following matters: (a) whether the entity has provided sufficient justification for the need to collect or disclose the restricted attribute; (b) whether the entity has demonstrated that a similar outcome cannot be achieved without collecting or disclosing the restricted attribute; (c) if the collection or disclosure of the restricted attribute is regulated by other legislative or regulatory requirements—whether the entity would be able to comply with those requirements if the condition were imposed; (d) the potential harm that could result if restricted attributes of that kind were disclosed to an entity that was not authorised to collect them; (e) community expectations as to whether restricted attributes of that kind should be handled more securely than other kinds of attributes; (f) any of the following information provided by the entity seeking authorisation to collect or disclose the restricted attribute: (i) the entity’s risk assessment plan as it relates to the restricted attribute; (ii) the entity’s privacy impact assessment as it relates to the restricted attribute; (iii) the effectiveness of the entity’s protective security (including security governance, information security, personnel security and physical security), privacy arrangements and fraud control arrangements; (iv) if the entity is not a participating relying party—the arrangements in place between the entity and relying parties for the protection of the restricted attribute from further disclosure; (g) any other matter the Digital ID Regulator considers relevant. Requirement to give statement of reasons if authorisation given (3) If the Digital ID Regulator imposes the condition authorising the entity to collect or disclose a restricted attribute of an individual, the Digital ID Regulator must publish on the Digital ID Regulator’s website a statement of reasons for giving the authorisation.