64Conditions on approval to participate in the Australian Government Digital ID System

64 Conditions on approval to participate in the Australian Government Digital ID System

Conditions imposed by the Act (1) The approval of an entity to participate in the Australian Government Digital ID System is subject to the following conditions: (a) unless the entity is a relying party—the entity must be an accredited entity; (b) if the entity is an accredited entity: (i) the entity must participate in the Australian Government Digital ID System only as the kind of accredited entity it is accredited as and approved to participate as; and (ii) the entity must provide only its accredited services in the Australian Government Digital ID System; (c) the entity must begin to participate in the Australian Government Digital ID System on the entity’s participation start day; (d) the entity must comply with this Act. Conditions imposed by the Digital ID Regulator (2) The Digital ID Regulator: (a) may impose conditions on the approval of an entity to participate in the Australian Government Digital ID System, either at the time of approval or at a later time, if the Digital ID Regulator considers that doing so is appropriate in the circumstances; and (b) must impose conditions on the approval of an entity to participate in the Australian Government Digital ID System, either at the time of approval or at a later time, if directed to do so under subsection 73(1). (3) Conditions may be imposed under paragraph (2)(a) on application by the entity or on the Digital ID Regulator’s own initiative. (4) Without limiting paragraph (2)(a), the Digital ID Regulator may impose conditions that relate to any of the following: (a) the kind of accredited entity or participating relying party that the entity must directly connect to in order to participate in the Australian Government Digital ID System; (b) the kinds of attributes of individuals that the entity is authorised to collect or disclose and the circumstances in which such attributes may be collected or disclosed; (c) the kinds of attributes of individuals that the entity must not collect; (d) for an accredited entity—the circumstances in which the entity may or must not provide its accredited services within the Australian Government Digital ID System; (e) for an accredited entity—the accredited services of the entity that the entity must provide within the Australian Government Digital ID System; (f) for a relying party—the services the relying party is approved to provide, or to provide access to, within the Australian Government Digital ID System; (g) actions that the entity must take before the entity’s approval to participate in the Australian Government Digital ID System is suspended or revoked.

Note 1: For the purposes of paragraph (b), the Digital ID Regulator must have regard to the matters in subsection 65(2) before authorising an entity to collect or disclose restricted attributes of individuals within the Australian Government Digital ID System. If the Digital ID Regulator gives such an authorisation, the Digital ID Regulator must publish a statement of reasons (see subsection 65(3)).