A. An identity trust framework operator, identity provider, federation administrator, or federation operator shall be liable if the issuance of an identity credential or assignment of an identity attribute, or a trustmark, is not in compliance with the Commonwealth’s identity management standards in place at the time of issuance. Further, the identity trust framework operator or identity provider shall be liable for noncompliance with applicable terms of any contractual agreement with a contracting party and any written rules and policies of the identity trust framework or federation of which it is a member.

Terms Used In Virginia Code 59.1-552

  • federation: means a digital identity system that (i) utilizes federated identity management to enable the portability of identity information across otherwise autonomous security domains; (ii) is compliant with the Commonwealth's identity management standards and with the provisions of the governing identity trust framework; (iii) has established identity, security, privacy, technology, and enforcement rules and policies adhered to by certified identity providers that are members of the federated digital identity system; (iv) includes as members federation administrators, federation operators, identity trust framework operators, and identity providers; and (v) allows, but does not require, relying parties to be members of the federated digital identity system in order to accept an identity credential issued by a certified identity provider to verify an identity credential holder's identity. See Virginia Code 59.1-550
  • Federation administrator: means a person or entity that certifies compliance with the Commonwealth's identity management standards by either a federation operator or an identity trust framework operator at the time of issuance of identity credentials, identity and entitlement attributes, or trustmarks. See Virginia Code 59.1-550
  • Federation operator: means the entity that (i) defines rule and policies for member parties to a federation; (ii) certifies identity and entitlement attribute providers to be members of and issue identity credentials pursuant to the federation; and (iii) evaluates participation in the federation to ensure compliance by members of the federation with its rules and policies, including the ability to request audits of participants for verification of compliance. See Virginia Code 59.1-550
  • Identity attribute: means identifying information associated with an identity credential holder. See Virginia Code 59.1-550
  • Identity credential: means the data, or the physical object upon which the data may reside, that an identity credential holder may present to verify or authenticate his identity in a digital or online transaction. See Virginia Code 59.1-550
  • Identity credential holder: means a person bound to or in possession of an identity credential who has agreed to the terms and conditions of the identity provider. See Virginia Code 59.1-550
  • identity provider: includes an attribute provider, an identity proofer, and any suppliers, employees, or agents thereof. See Virginia Code 59.1-550
  • Identity trust framework: means a digital identity system with established identity, security, privacy, technology, and enforcement rules and policies adhered to by certified identity providers that are members of the identity trust framework. See Virginia Code 59.1-550
  • Identity trust framework operator: means the entity that (i) defines rules and policies for member parties to an identity trust framework, (ii) certifies identity providers to be members of and issue identity credentials pursuant to the identity trust framework, and (iii) evaluates participation in the identity trust framework to ensure compliance by members of the identity trust framework with its rules and policies, including the ability to request audits of participants for verification of compliance. See Virginia Code 59.1-550
  • Trustmark: means a machine-readable official seal, authentication feature, certification, license, or logo that may be provided by an identity trust framework operator to certified identity providers within its identity trust framework or federation to signify that the identity provider complies with the written rules and policies of the identity trust framework or federation. See Virginia Code 59.1-550

B. An identity trust framework operator, identity provider, federation administrator, or federation operator shall not be liable if the issuance of the identity credential or assignment of an identity attribute or a trustmark was in compliance with (i) the Commonwealth’s identity management standards in place at the time of issuance or assignment, (ii) applicable terms of any contractual agreement with a contracting party, and (iii) any written rules and policies of the identity trust framework or federation of which it is a member, provided such identity trust framework operator or identity provider did not commit an act or omission that constitutes gross negligence or willful misconduct. An identity trust framework operator or identity provider shall not be liable for misuse of an identity credential by the identity credential holder or by any other person who misuses an identity credential.

2015, cc. 482, 483; 2020, c. 736.