88Redress framework

88 Redress framework

(1) Within 12 months after the commencement of this Act, the Digital ID Rules must provide for or in relation to a redress framework for incidents that occur in relation to accredited services of accredited entities that are provided within the Australian Government Digital ID System. (2) Without limiting subsection (1), the Digital ID Rules made for the purposes of that subsection must deal with the following matters: (a) the entities that are covered by the framework; (b) the kinds of incidents that are covered by the framework, which may include digital ID fraud incidents and cyber security incidents; (c) procedures for dealing with incidents that are covered by the framework; (d) requirements relating to notifying individuals affected by incidents covered by the framework; (e) the provision of information, support and assistance to individuals affected by incidents covered by the framework; (f) development and publication of policies relating to the identification, management and resolution of incidents covered by the framework; (g) development and publication of policies relating to complaints by individuals relating to incidents covered by the framework. (3) Without limiting subsection (1), the Digital ID Rules made for the purposes of that subsection may deal with the following matters: (a) timeframes relating to the provision of support services to individuals affected by digital ID fraud incidents or cyber security incidents; (b) requirements relating to the kinds of information relating to support services that entities covered by the framework must make available, and the manner in which such information must be made available; (c) information that must be provided by entities covered by the framework to the Digital ID Regulator about the kinds of support services provided to individuals under the framework and the manner and timeframes in which such information must be provided.

Chapter 5—Digital ID Regulator