1 Short title
1 Section 1
Requires a relation between temporal intervals
Commences within 6 months or on the day after
10 Meaning of attribute of an individual
Conditional commencement of Administrative Review Tribunal (Miscellaneous Measures) Act 2025
10 Dec
10(1) Meaning of attribute of an individual
Defines attributes of an individual for legal purposes.
10(2) Meaning of attribute of an individual
Defines the creation time of a digital ID.
(g) if the individual has a digital ID—the time and date the digital ID was created;
Includes specific attributes in the definition.
(2) Without limiting subsection (1), an attribute of an individual includes...
Defines a subclass for restricted attributes.
(i) information or an opinion about the individual’s: (i) racial or ethnic origin; or (ii) political opinions; or (iii) membership of a political association; or (iv) religious beliefs or affiliations; or (v) philosophical beliefs; or (vi) sexual orientation or practices.
Includes biometric information in the definition.
(h) biometric information of the individual;
Defines the creation interval of a digital ID.
Consultation requirement before making, amending or revoking Digital ID Data Standards
100 Requirement to consult before making
Establishment of Digital ID Data Standards Chair
101 Digital ID Data Standards Chair
Functions of the Digital ID Data Standards Chair
102 Functions of the Digital ID Data Standards Chair
such other functions as are conferred on the Chair by this Act;
to make Digital ID Data Standards; and to review those standards regularly;
Establishment of committees, advisory panels and consultative groups.
103 Powers of the Digital ID Data Standards Chair
104 Directions to the Digital ID Data Standards Chair
The Minister may give written directions to the Digital ID Data Standards Chair.
104(1) Directions to the Digital ID Data Standards Chair
A direction under subsection (1) must be of a general nature only.
104(2) Directions to the Digital ID Data Standards Chair
105 Appointment
The Minister must appoint the Digital ID Data Standards Chair.
105(1) Appointment
105(2) Appointment
Term of appointment must not exceed 3 years.
106 Term of appointment
The Minister may appoint a person to act as Digital ID Data Standards Chair.
107 Acting appointments
108 Application of the finance law etc.
The Digital ID Data Standards Chair is an official of the Department.
108(1) Application of the finance law etc.
Must include information about performance and exercise of Digital ID Data Standards Chair's functions in annual report.
108(2) Application of the finance law etc.
Exempts Digital ID Data Standards Chair from certain provisions when the Minister is also the chair.
108(3) Application of the finance law etc.
Exempts Digital ID Data Standards Chair from certain provisions.
Relates to the subclass of Digital ID Act 2024.
109 Remuneration
Chair must be paid remuneration determined by Remuneration Tribunal or prescribed legislative instrument
109(1) Remuneration
Chair must be paid allowances prescribed by legislative instrument
109(2) Remuneration
Chair has an obligation to be paid allowances
Minister may prescribe remuneration and allowances
109(3) Remuneration
Exemption from subsections (1) and (2) for the Digital ID Data Standards Chair while in office.
109(4) Remuneration
Prohibits application of subsections 7(9) and (13) to the office of the Digital ID Data Standards Chair.
109(5) Remuneration
Remuneration subject to the Remuneration Tribunal Act 1973
109(6) Remuneration
11 Meaning of restricted attribute of an individual
Defines restricted attribute of an individual
11(1) Meaning of restricted attribute of an individual
Includes temporal intervals related to restricted attribute issuance
(i) the Commonwealth, a State or a Territory; or
(1) A restricted attribute of an individual means:
Defines a class hierarchy for restricted attributes
(a) health information (within the meaning of the Privacy Act 1988) about the individual; or
(b) an identifier of the individual that has been issued or assigned by or on behalf of:
Includes diffusion of restricted attribute information
(iii) a government of a foreign country; or
Includes trace of restricted attribute usage
(ii) an authority or agency of the Commonwealth, a State or a Territory; or
Defines what constitutes an individual's identifier.
11(2) Meaning of restricted attribute of an individual
Recreation leave entitlements determined by the Remuneration Tribunal
110 Leave of absence
No paid work outside office without Minister's approval
111 Outside work
112 Resignation of appointment
112(1) Resignation of appointment
Resignation takes effect on specified day
112(2) Resignation of appointment
113 Termination of appointment
Minister may terminate appointment of Digital ID Data Standards Chair
113(1) Termination of appointment
Termination of appointment under certain conditions
113(2) Termination of appointment
Digital ID Data Standards Chair must not be terminated under these conditions
114 Other terms and conditions
Terms and conditions for the Digital ID Data Standards Chair's office
114(1) Other terms and conditions
The Digital ID Data Standards Chair is the Minister.
114(2) Other terms and conditions
115 Arrangements relating to staff
115(1) Arrangements relating to staff
Temporal relation between staff arrangement and Chair's functions
(1) The staff assisting the Digital ID Data Standards Chair are to be:
Staff are subject to the directions of the Chair.
115(2) Arrangements relating to staff
Using digital ID trustmark without authorization is prohibited.
116 Simplified outline of this Chapter
Penalty applies when entity uses unauthorized trustmark.
Temporal relation between entity's actions and penalties
Entity is liable to civil penalty if the entity uses digital ID trustmark without authorization.
Implication of failure to comply with requirements
Entity fails to display digital ID trustmark in circumstances specified in the Digital ID Rules.
Entity uses digital ID trustmark without authorization.
Propagation of penalties through entity's actions
117 Digital ID trustmarks
Specify one or more digital ID trustmarks that may or must be used by accredited entities.
117(1) Digital ID trustmarks
117(2) Digital ID trustmarks
118 Authorised use of digital ID trustmarks etc.
Entity must comply with conditions for using digital ID trustmark.
118(1) Authorised use of digital ID trustmarks etc.
Prohibition on using digital ID trustmark without authorization
118(2) Authorised use of digital ID trustmarks etc.
Entity must not use digital ID trustmark
(2) An entity must not use a digital ID trustmark if the entity is not authorized under subsection (1)
Do not use a digital ID trustmark so closely resembling an accredited entity or participating relying party.
118(3) Authorised use of digital ID trustmarks etc.
Entity must not use a digital ID trustmark...
Failure to display digital ID trustmark in specified circumstances
119 Displaying digital ID trustmark
Prohibits failure to display digital ID trustmark
Entity is required to display digital ID trustmark
12 Fit and proper person considerations
Digital ID Regulator has an obligation to consider this
120 Digital ID Accredited Entities Register
Establish and maintain a register of accredited entities.
120(1) Digital ID Accredited Entities Register
Must contain specific details for each accredited entity
120(2) Digital ID Accredited Entities Register
The Digital ID Accredited Entities Register may contain additional information.
120(3) Digital ID Accredited Entities Register
Entity removal from register after revocation and non-reaccreditation
120(4) Digital ID Accredited Entities Register
Time interval for non-reaccreditation period
(4) If an entity’s accreditation is revoked...
...the Digital ID Regulator must remove the entity from the Digital ID Accredited Entities Register.
Prohibition of entity's continued presence in register
Provision for correction of information in Digital ID Accredited Entities Register and other related matters.
120(5) Digital ID Accredited Entities Register
Publicly available Digital ID Accredited Entities Register
120(6) Digital ID Accredited Entities Register
The Digital ID Accredited Entities Register is not a legislative instrument.
120(7) Digital ID Accredited Entities Register
121 AGDIS Register
Establish and maintain an AGDIS Register of approved entities.
121(1) AGDIS Register
Obligation to establish and maintain a register.
AGDIS Register must contain specific details for each entity.
121(2) AGDIS Register
The AGDIS Register must contain the specified details.
Enforcement action and directions for accredited entities
122 Simplified outline of this Chapter
123 Civil penalty provisions
Civil penalty provisions are enforceable under Part 4 of the Regulatory Powers Act.
123(1) Civil penalty provisions
Prohibits civil penalty provisions from not being enforced under Part 4 of the Regulatory Powers Act.
Authorise Digital ID Regulator and certain staff to make civil penalty applications.
123(2) Civil penalty provisions
List of relevant courts for civil penalty provisions
123(3) Civil penalty provisions
124 Infringement notices
Each civil penalty provision is subject to an infringement notice.
124(1) Infringement notices
Infringement officers designated in the Regulatory Powers Act.
124(2) Infringement notices
Identifies chief executives for specific provisions.
124(3) Infringement notices
Information Commissioner or Digital ID Regulator
125 Enforceable undertakings
Enforces civil penalty provisions under Part 6 of the Regulatory Powers Act.
125(1) Enforceable undertakings
Creates an obligation to enforce civil penalty provisions.
Authorises Information Commissioner and Digital ID Regulator as authorised persons for civil penalty provisions.
125(2) Enforceable undertakings
Information Commissioner and Digital ID Regulator are authorised persons.
List of courts that are relevant for enforcing publishing undertakings.
125(3) Enforceable undertakings
The Information Commissioner may publish an undertaking accepted by the Information Commissioner.
125(4) Enforceable undertakings
The Information Commissioner accepts an undertaking.
126 Injunctions
Each civil penalty provision of this Act is enforceable under Part 7 of the Regulatory Powers Act.
126(1) Injunctions
This Act's civil penalty provisions are enforceable under Part 7 of the Regulatory Powers Act.
(1) Each civil penalty provision of this Act is enforceable under Part 7 of the Regulatory Powers Act.
This part creates a framework for using injunctions to enforce provisions.
Part 7 of the Regulatory Powers Act creates a framework for using injunctions to enforce provisions.
This Act's civil penalty provisions are subject to enforcement under Part 7.
This Act's civil penalty provisions are subject to enforcement by the Regulatory Powers Act.
126(2) Injunctions
List of courts relevant for provisions in subsection (1)
126(3) Injunctions
127 Digital ID Regulator’s power to give directions to entities in
The Digital ID Regulator may give an entity a direction to do or not do something.
127(1) Digital ID Regulator’s power to give directions to entities in
The Digital ID Regulator may give an entity a direction.
Entities must provide information and connect to the Australian Government Digital ID System by a specified date.
127(2) Digital ID Regulator’s power to give directions to entities in
Prohibits entities from not providing information and connecting to the Australian Government Digital ID System.
128 Digital ID Regulator’s power to give directions to protect the
The Digital ID Regulator may give a direction to protect the integrity or performance of the Australian Government Digital ID System.
128(1) Digital ID Regulator’s power to give directions to protect the
Digital ID Regulator may give directions to conduct specific assessments or take specified actions.
128(2) Digital ID Regulator’s power to give directions to protect the
Assessment must comply with Accreditation Rules requirements.
128(3) Digital ID Regulator’s power to give directions to protect the
Direction must be in writing and specify reason.
128(4) Digital ID Regulator’s power to give directions to protect the
Comply with direction given under subsection (1)
128(5) Digital ID Regulator’s power to give directions to protect the
A direction under subsection (1) is not a legislative instrument.
128(6) Digital ID Regulator’s power to give directions to protect the
129 Remedial directions to accredited entities etc.
Accredited entities must comply with the Act if believed to have contravened a provision.
129(1) Remedial directions to accredited entities etc.
Entity must take specified action to prevent future contravention of the provision.
129(2) Remedial directions to accredited entities etc.
Entity has an obligation to take specified action.
129(3) Remedial directions to accredited entities etc.
Must comply with direction given under subsection (2)
129(4) Remedial directions to accredited entities etc.
An entity must comply with conditions imposed by the Digital ID Regulator on its accreditation.
13 Simplified outline of this Chapter
130 System Administrator’s power to give directions to protect the
System Administrator has power to give directions to protect the Australian Government Digital ID System.
130(1) System Administrator’s power to give directions to protect the
Directions are given during system integrity or performance protection.
System Administrator has power to give directions.
System Administrator's power to give directions
130(2) System Administrator’s power to give directions to protect the
130(3) System Administrator’s power to give directions to protect the
System Administrator must give written directions with specified reason.
130(4) System Administrator’s power to give directions to protect the
Must comply with direction given by System Administrator.
130(5) System Administrator’s power to give directions to protect the
130(6) System Administrator’s power to give directions to protect the
131 Compliance assessments
The Digital ID Regulator may require an entity to undergo a compliance assessment.
131(1) Compliance assessments
Notice specifying period and method of assessment
Entity must undertake compliance assessment within specified period.
131(2) Compliance assessments
Entity must undertake compliance assessment
Comply with notice within specified period.
131(3) Compliance assessments
Digital ID Rules may make provision for compliance assessments.
131(4) Compliance assessments
Entities must follow specific processes and provide information during compliance assessments.
131(5) Compliance assessments
Entities must follow specific processes and provide information.
131(6) Compliance assessments
Entities must provide assistance to persons undertaking compliance assessments.
132 Entities must provide assistance to persons undertaking
Entity has a duty to provide assistance.
133 Digital ID Regulator’s power to require information or
The Digital ID Regulator may require information or documents from an entity.
133(1) Digital ID Regulator’s power to require information or
The Digital ID Regulator may require information or documents.
Entity must provide information or documents to Digital ID Regulator upon request.
133(2) Digital ID Regulator’s power to require information or
Entity must provide information or documents.
133(3) Digital ID Regulator’s power to require information or
Entity may be liable to civil penalty for non-compliance with notice.
133(4) Digital ID Regulator’s power to require information or
Information or documents as required by the notice.
Comply with requirement within specified period and manner.
133(5) Digital ID Regulator’s power to require information or
Entity must provide a reasonable excuse if required information is not provided.
133(6) Digital ID Regulator’s power to require information or
Entity has an obligation to provide information.
134 System Administrator’s power to require information or
Entity must provide information or documents relevant to the operation of the Australian Government Digital ID System.
134(1) System Administrator’s power to require information or
System Administrator may require entity to provide information or documents.
134(2) System Administrator’s power to require information or
A period specified in a notice must not be less than 28 days.
134(3) System Administrator’s power to require information or
must not be less than 28 days after the notice is given.
(3) A period specified in a notice under subsection (2)
Entity must comply with notice or face civil penalty
134(4) System Administrator’s power to require information or
134(5) System Administrator’s power to require information or
Entity must provide information with a reasonable excuse.
134(6) System Administrator’s power to require information or
135 Record keeping by participating entities and former
135(1) Record keeping by participating entities and former
Exemption from record keeping for relying parties
135(2) Record keeping by participating entities and former
Records of the kind, for the period and in the manner prescribed by the Digital ID Rules.
Entity must keep records in a specified manner.
135(3) Record keeping by participating entities and former
Records of a kind not related to information obtained through the Australian Government Digital ID System are prohibited.
135(4) Record keeping by participating entities and former
...if specified circumstances apply in relation to the record.
Overlap of record retention periods with legal proceedings
(4) may only prescribe a period of retention...
Inference of record retention periods with legal proceedings
...of more than 7 years if specified circumstances apply.
Prohibition of records not related to the Australian Government Digital ID System
Diffusion of record retention periods with legal proceedings
Recurring trace of record retention periods with legal proceedings
Destruction or de-identification of certain information is required for accredited entities.
136 Destruction or de-identification of certain information
Temporal interval for destruction or de-identification
Duty to destroy or de-identify information
A decision by the Digital ID Regulator is a reviewable decision.
137 Reviewable decisions
The decision must occur during the accreditation process.
The accreditation process begins when an entity applies for accreditation.
If the Digital ID Regulator refuses to accredit an entity, then the entity is not accredited.
The Digital ID Regulator has the power to refuse accreditation.
The decision is a type of artificial intelligence decision.
The Digital ID Regulator uses artificial intelligence to make decisions.
The Digital ID Regulator has the power to make decisions.
The decision can only be made if the entity has applied for accreditation.
The entity must apply for accreditation before the Digital ID Regulator can make a decision.
138 Internal review of decisions
Entity can apply for internal review of a decision made by a delegate.
138(1) Internal review of decisions
Entity has the right to apply for internal review.
Application for internal review must be made within 28 days after the decision first came to notice.
138(2) Internal review of decisions
Application must be made within 28 days.
Obligation to apply for internal review within 28 days.
139 Reconsideration by decision-maker
Decision-maker must review and decide on an application for internal review within 90 days.
139(1) Reconsideration by decision-maker
Decision-maker must provide written statement of reasons for decision.
139(2) Reconsideration by decision-maker
Delegate must not have been involved in making the original reviewable decision and hold a position or perform duties of a higher level than the delegate who made the original reviewable decision.
139(3) Reconsideration by decision-maker
Delegate must not have been involved in making the original reviewable decision.
Delegate must hold a position or perform duties of a higher level than the delegate who made the original reviewable decision.
14 Application for accreditation
Entities may apply for accreditation as accredited attribute service providers, identity exchange providers, identity service providers, or entities providing a prescribed service.
14(1) Application for accreditation
List of entities covered by this section
14(2) Application for accreditation
140 Review by the Administrative Review Tribunal
Applications for review of certain decisions can be made to the Administrative Review Tribunal.
140(1) Review by the Administrative Review Tribunal
Application must be made by or on behalf of an affected entity.
140(2) Review by the Administrative Review Tribunal
Review by the Administrative Review Tribunal
140(3) Review by the Administrative Review Tribunal
Despite section 17 of the Administrative Review Tribunal Act 2024.
Section 17 of the Administrative Review Tribunal Act 2024.
141 Requirements for applications
Digital ID Rules, Accreditation Rules, and fee (if applicable)
141(1) Requirements for applications
Acceptance of previously provided information as satisfying a requirement.
141(2) Requirements for applications
Classifies the provision as a permissive rule.
Approval may be given for different forms or a single form for multiple applications.
141(3) Requirements for applications
Different forms for different kinds of applications
A single form for more than one kind of application
142 Powers in relation to applications
Require applicant to provide further information or documents
142(1) Powers in relation to applications
Information or documents within the specified period
Notice period for information or documents must be at least 14 days.
142(2) Powers in relation to applications
Must provide information or documents within a specified period
143 Decisions not required to be made in certain circumstances
No decision required if application is not in approved form.
143(1) Decisions not required to be made in certain circumstances
No decision is required until information or documents are provided.
143(2) Decisions not required to be made in certain circumstances
Information or documents requested by the person requiring them.
Decision on application delayed until information is provided.
143(3) Decisions not required to be made in certain circumstances
Digital ID Regulator not required to make decision until assessment is conducted.
143(4) Decisions not required to be made in certain circumstances
Pay fee before making a decision on an application.
143(5) Decisions not required to be made in certain circumstances
144 Charging of fees by Digital ID Regulator etc.
Provision for charging fees by the Digital ID Regulator and others
144(1) Charging of fees by Digital ID Regulator etc.
144(2) Charging of fees by Digital ID Regulator etc.
No fee can be charged for creating or using a digital ID.
144(3) Charging of fees by Digital ID Regulator etc.
Fee prescribed by Digital ID Rules is payable to Commonwealth
144(4) Charging of fees by Digital ID Regulator etc.
Imposes a duty on Digital ID Regulator etc.
144(5) Charging of fees by Digital ID Regulator etc.
144(6) Charging of fees by Digital ID Regulator etc.
(6) A fee prescribed by the Digital ID Rules must not be such as to amount to taxation.
Fee will not amount to taxation eventually
Service need not be provided while fee remains unpaid
144(7) Charging of fees by Digital ID Regulator etc.
145 Review of fees
Minister must undertake periodic reviews of rules made for the purposes of subsection 144(1).
145(1) Review of fees
Obligation to undertake periodic reviews.
The first review of fees must start within 2 years and be completed within 12 months.
145(2) Review of fees
Subsequent reviews must be completed within 12 months.
145(3) Review of fees
Subsequent reviews contain a temporal interval starting no later than every 2 years after the completion of the previous review
Temporal interval for subsequent reviews
(3) Subsequent reviews must start no later than every 2 years after the completion of the previous review; and be completed within 12 months.
Subsequent reviews contain a CogAI analysis starting no later than every 2 years after the completion of the previous review
Subsequent reviews contain a diffusion starting no later than every 2 years after the completion of the previous review
Subsequent reviews contain a temporal trace starting no later than every 2 years after the completion of the previous review
Minister must provide written report on review of fees within 15 sitting days.
145(4) Review of fees
Recovery of fees charged by the Digital ID Regulator
146 Recovery of fees charged by the Digital ID Regulator
147 Commonwealth not liable to pay fees charged by entities that
Commonwealth not liable to pay fees charged by entities that are part of the Commonwealth.
147(1) Commonwealth not liable to pay fees charged by entities that
However, it is the Parliament’s intention that the Commonwealth should be notionally liable to pay such a fee.
The Commonwealth's liability for fees overlaps with its intention to be notionally liable.
(1) The Commonwealth is not liable to pay a fee that is payable under this Act to a part of the Commonwealth that is not a separate legal entity.
If a fee is payable under this Act, then the Commonwealth is liable to pay it.
The Commonwealth's liability for fees repeats with its intention to be notionally liable.
The Finance Minister may give written directions for carrying out subsection (1)
147(2) Commonwealth not liable to pay fees charged by entities that
Commonwealth must comply with directions despite other laws.
147(3) Commonwealth not liable to pay fees charged by entities that
Directions under subsection (2) are not legislative instruments.
147(4) Commonwealth not liable to pay fees charged by entities that
Commonwealth not liable to pay fees charged by entities that
147(5) Commonwealth not liable to pay fees charged by entities that
Division 2, Fees charged by accredited entities
Fees charged by entities during a specific period
Commonwealth entity within the meaning of the Act
Include Commonwealth entities in definition of Commonwealth
Public Governance, Performance and Accountability Act 2013
148 Charging of fees by accredited entities in relation to the
Accredited entities must charge fees in accordance with Digital ID Rules.
148(1) Charging of fees by accredited entities in relation to the
Accredited entities must charge fees for services related to the Australian Government Digital ID System.
148(2) Charging of fees by accredited entities in relation to the
Accredited entities may charge fees in relation to the Digital ID Rules.
148(3) Charging of fees by accredited entities in relation to the
148(4) Charging of fees by accredited entities in relation to the
Accredited entities can charge fees for their services.
148(5) Charging of fees by accredited entities in relation to the
Minister may establish advisory committees.
149 Simplified outline of this Chapter
Establishing advisory committees is an obligation.
15 Digital ID Regulator must decide whether to accredit an entity
Must decide whether to accredit an entity
15(1) Digital ID Regulator must decide whether to accredit an entity
Must decide to accredit or refuse accreditation
15(2) Digital ID Regulator must decide whether to accredit an entity
some or all of the services described in the definition of attribute service provider, identity exchange provider, or identity service provider
Entity cannot be accredited without providing required services.
15(3) Digital ID Regulator must decide whether to accredit an entity
Prohibits accreditation without required services.
The Digital ID Regulator must not accredit an entity under certain conditions.
15(4) Digital ID Regulator must decide whether to accredit an entity
The accreditation refusal occurs during this time.
A direction under subsection 27(1) (about security) directing the Digital ID Regulator to refuse to accredit the entity is in force.
The Digital ID Regulator must not accredit an entity.
The Digital ID Regulator must accredit an entity.
The Digital ID Regulator must not accredit an entity if it cannot comply.
The Digital ID Regulator must accredit an entity if it can comply with this Act.
150 Advisory committees
Establish advisory committees as deemed necessary by the Minister.
150(1) Advisory committees
Create an obligation to establish advisory committees.
Minister determines composition of advisory committee.
150(2) Advisory committees
Determining condition for advisory committee composition.
Determine committee's terms of reference and appointment conditions.
150(3) Advisory committees
Minister must determine committee's terms of reference and appointment conditions.
An instrument made under subsection (1) or (3) is not a legislative instrument.
150(4) Advisory committees
(4) An instrument made under subsection (1) or (3)
151 Prohibition on entrusted persons using or disclosing certain
Prohibition on entrusted persons using or disclosing certain information.
151(1) Prohibition on entrusted persons using or disclosing certain
...the information is personal information about an individual; or there is a risk that the use or disclosure might substantially prejudice the commercial interests of another person.
Defines a temporal interval for the offence.
...the person uses or discloses the information;
Represents the knowledge that entrusted persons should not use or disclose certain information.
(b) the person obtains protected information in the course of, or for the purposes of, performing functions or exercising powers under this Act;
Prohibits the use or disclosure of protected information.
...the person obtains protected information in the course of, or for the purposes of, performing functions or exercising powers under this Act;
Diffuses the prohibition to entrusted persons.
(a) the person is or has been an entrusted person;
...the use or disclosure might substantially prejudice the commercial interests of another person.
Requires a recurring trace for the offence.
(c) the person uses or discloses the information;
151(2) Prohibition on entrusted persons using or disclosing certain
...or (f) the System Administrator; or ...
...(e) a person engaged under section 27A of the Competition and Consumer Act 2010;
Prohibition on entrusted persons using or disclosing certain information without authorization.
151(3) Prohibition on entrusted persons using or disclosing certain
Prohibits the use or disclosure of certain information.
(3) Subsection (1) does not apply if the use or disclosure is authorised by section 152.
Prohibition on using or disclosing protected information.
151(4) Prohibition on entrusted persons using or disclosing certain
...information that was disclosed or obtained under or for the purposes of this Act.
Restricts access to protected information during its disclosure.
Identifies sensitive data in protected information.
...using or disclosing certain information.
Classifies protected information as sensitive data.
Limits the spread of protected information.
Defines constraints on protected information disclosure.
Authorised uses and disclosures of protected information by entrusted persons.
152 Authorised uses and disclosures of protected information by
153 Disclosing personal or commercially sensitive information to
An entrusted person is not required to produce a document or disclose protected information under certain circumstances.
153(1) Disclosing personal or commercially sensitive information to
Must disclose documents or answer questions to a court, tribunal, authority, or other person with power to require production.
153(2) Disclosing personal or commercially sensitive information to
154 Annual report by the Digital ID Regulator
Annual report by the Digital ID Regulator
154(1) Annual report by the Digital ID Regulator
154(2) Annual report by the Digital ID Regulator
Annual report must be given to the Minister by a certain date.
154(3) Annual report by the Digital ID Regulator
Annual report must include performance information
155 Annual report by Information Commissioner
155A Annual reports by law enforcement agencies etc. on disclosure
Law enforcement agencies and enforcement bodies must request or require accredited entities to disclose biometric information or personal information.
155A(1) Annual reports by law enforcement agencies etc. on disclosure
The disclosure of biometric information or personal information OCCURS BETWEEN the start and end of a financial year.
Disclosure must occur during a financial year.
The law enforcement agency or enforcement body MUST request or require the accredited entity to disclose biometric information or personal information DURING a financial year.
The accredited entity MUST provide biometric information or personal information.
The law enforcement agency or enforcement body must request or require the accredited entity to disclose biometric information or personal information.
The accredited entity MUST use or disclose personal information of an individual for enforcement-related activities.
The enforcement body must request or require the accredited entity to use or disclose personal information of an individual for enforcement-related activities.
The disclosure of personal information of an individual is RECURSIVE for enforcement-related activities.
Disclosure must be recurring for enforcement-related activities.
The enforcement body MUST request or require the accredited entity to use or disclose personal information of an individual FOR ENFORCEMENT-RELATED ACTIVITIES CONDUCTED BY, OR ON BEHALF OF, THE ENFORCEMENT BODY.
Annual report on disclosure of information by law enforcement agencies
155A(2) Annual reports by law enforcement agencies etc. on disclosure
Classification of information in the report
(a) the total number of requests or requirements made by the agency or body during the financial year;
Annual reports must be given to the AFP Minister by a certain date.
155A(3) Annual reports by law enforcement agencies etc. on disclosure
155B Annual report by AFP Minister
The AFP Minister must prepare an annual report.
155B(1) Annual report by AFP Minister
AFP Minister must include a statement if no section 155A reports were provided.
155B(2) Annual report by AFP Minister
Annual report by AFP Minister must include specific information about law enforcement agencies' requests and compliance.
155B(3) Annual report by AFP Minister
(3) If subsection (2) does not apply, the report by the AFP Minister
Classification of information required in the report
(a) the total number of requests or requirements made by the law enforcement agency or enforcement body during the financial year;
156 How this Act applies in relation to non-legal persons
Entities must appoint accountable persons to exercise permissions or rights.
156(1) How this Act applies in relation to non-legal persons
Entities must appoint accountable persons.
Imposes obligation on accountable persons for non-legal entities
156(2) How this Act applies in relation to non-legal persons
at the time the obligation or duty arises or is in operation
Describes temporal interval of obligation
the obligation or duty arises or is in operation
or any person who is authorised by a person referred to in subparagraph (i) to discharge the obligation or duty
Describes mechanism of obligation discharge
any person who is an accountable person for the entity at the time the obligation or duty arises or is in operation
on each person who is an accountable person for the entity at the time the obligation or duty arises or is in operation
Imposes obligation on accountable persons
This Act purports to impose an obligation or duty
Accountable persons for non-legal entities are liable for contraventions.
156(3) How this Act applies in relation to non-legal persons
...or (c) was in any way knowingly concerned in, or party to, the relevant act or omission.
The liability of accountable persons overlaps with that of the entity.
(c) was in any way knowingly concerned in, or party to, the relevant act or omission.
...is instead contravened by each accountable person for the entity who:...
The liability of accountable persons implies that they have a duty to comply.
(3) A provision of this Act (including a civil penalty provision)...
...is instead contravened by each accountable person for the entity...
Accountable persons have an obligation to comply.
(3) A provision of this Act (including a civil penalty provision) that is purportedly contravened by an entity that is not a legal person...
The liability of accountable persons is an obligation.
The liability of accountable persons repeats with each occurrence.
Definition of accountable person for an entity
156(4) How this Act applies in relation to non-legal persons
Determine whether Commonwealth, State or Territory has contravened the Act
157 Attributing conduct to the Commonwealth, States and
Due diligence obligation for bodies corporate
158 Bodies corporate and due diligence
No contravention if due diligence is exercised
Bodies corporate must take reasonable precautions and exercise due diligence
159 Protection from civil action
List of entities protected from civil action
159(1) Protection from civil action
Entities listed are protected from civil action
Protection from civil action for acts done in good faith
159(2) Protection from civil action
is not liable to an action or other proceeding for damages
Temporal overlap between good faith and liability
(2) A person mentioned in subsection (1)
Obligation to act with good faith in performance of functions
(a) in the performance, or purported performance, of any functions under this Act
Obligation to act with good faith in exercise of powers
(b) in the exercise, or purported exercise, of any powers under this Act
16 Accreditation is subject to conditions
16(1) Accreditation is subject to conditions
Entity must comply with accreditation conditions.
16(2) Accreditation is subject to conditions
Entity must comply with civil penalty provisions within geographical jurisdiction.
160 Geographical jurisdiction of civil penalty provisions
Nothing in this Act affects or limits the operation of certain tax file number offences.
161 Interaction with tax file number offences
162 Review of operation of Act
Minister must undertake review of Act's operation.
162(1) Review of operation of Act
Review of operation of Act must be undertaken within 2 years after commencement.
162(2) Review of operation of Act
Obligation to undertake review within 2 years.
Must provide written report of review to Minister
162(3) Review of operation of Act
Minister must table report in each House of Parliament within 15 sitting days.
162(4) Review of operation of Act
163 Delegation—Minister
Delegation of Minister's functions or powers
163(1) Delegation—Minister
The delegation occurs within a specific temporal interval
The Minister may delegate to the Digital ID Regulator, Secretary, or SES employee/acting SES employee
The Minister delegates all or any of their functions or powers
Delegate must comply with written directions of the Minister.
163(2) Delegation—Minister
Delegation of powers or functions under this Act
164 Delegation—Digital ID Regulator
Delegation of System Administrator's functions is prohibited.
165 Delegation—System Administrator
166 Delegation—Digital ID Data Standards Chair
Delegation of functions or powers to a person assisting the Chair
166(1) Delegation—Digital ID Data Standards Chair
The person assisting the Chair has the delegated function or power
The Chair may delegate functions or powers
Exemption from subsection (1) for Digital ID Data Standards function
166(2) Delegation—Digital ID Data Standards Chair
Delegate must comply with directions of the Digital ID Data Standards Chair.
166(3) Delegation—Digital ID Data Standards Chair
167 Instruments may incorporate etc. material as in force or existing
List of core instruments subject to this section
167(1) Instruments may incorporate etc. material as in force or existing
Incorporation of material from other instruments or writings
167(2) Instruments may incorporate etc. material as in force or existing
Provision for changes to incorporated instruments taking effect for the core instrument
167(3) Instruments may incorporate etc. material as in force or existing
Subsection (2) has effect despite subsection 14(2) of the Legislation Act 2003.
167(4) Instruments may incorporate etc. material as in force or existing
Continues effect despite subsection 14(2)
168 Rules—general matters
Minister may make rules by legislative instrument.
168(1) Rules—general matters
Rules may prescribe different matters for different entities, things or circumstances.
168(2) Rules—general matters
Confer power on Digital ID Regulator, System Administrator or Minister to make an instrument of administrative character.
168(3) Rules—general matters
Granting a power to make an instrument of administrative character.
169 Rules—requirement to consult
Consult persons about draft rules or amendments before making or amending them.
169(1) Rules—requirement to consult
The consultation period IS >= the specified period.
Consultation period is at least 28 days after notice publication.
The notice must be published within a specified period.
The Minister MUST cause to be published a notice inviting persons to make submissions.
Must consult persons about draft rules or amendments.
The Minister must make or amend rules under section 168.
The Minister MUST consider the submissions.
The Minister must consider any submissions received within the specified period.
The Minister MUST consult the Information Commissioner.
The Minister must consult the Information Commissioner if the rules deal with matters related to privacy functions.
Minister must consult Information Commissioner on rules regarding accredited entities and biometric information.
169(2) Rules—requirement to consult
Minister has a duty to consult Information Commissioner.
Consultation requirement for rule-making under section 168
169(2A) Rules—requirement to consult
(2A) Before making or amending any rules under section 168, the Minister must also: (a) consult such organisations representing individuals who may experience barriers when creating or using a digital ID as the Minister considers appropriate; and (b) by written notice, invite such organisations to make comments to the Minister within the period specified in the written notice.
(2A) Before making or amending any rules under section 168, the Minister must...
(2A) Before making or amending any rules under section 168, the Minister must also: (c) consider any comments received within the specified period.
(2A) Before making or amending any rules under section 168, the Minister must also: (b) by written notice, invite such organisations to make comments to the Minister within the period specified in the written notice.
Consider submissions after specified period if appropriate.
169(3) Rules—requirement to consult
Exemptions from subsections (1) and (2A)
169(4) Rules—requirement to consult
169(5) Rules—requirement to consult
17 Conditions on accreditation
Accredited entity must comply with the Act.
17(1) Conditions on accreditation
17(2) Conditions on accreditation
Conditions may be imposed on application by the entity or on the Digital ID Regulator’s own initiative.
17(3) Conditions on accreditation
17(4) Conditions on accreditation
18 Conditions relating to restricted attributes of individuals
Entity must comply with proposed condition on accreditation.
18(1) Conditions relating to restricted attributes of individuals
Digital ID Regulator must consider specific matters when deciding whether to impose a condition.
18(2) Conditions relating to restricted attributes of individuals
Digital ID Regulator must consider specific matters.
The Digital ID Regulator must have regard to the following matters:
Digital ID Regulator should consider community expectations.
Entity's risk assessment plan and privacy impact assessment are relevant.
The entity seeking authorisation to collect or disclose the restricted attribute must provide:
Publish statement of reasons for authorizing collection or disclosure of restricted attribute.
18(3) Conditions relating to restricted attributes of individuals
19 Requirements before Accreditation Rules impose conditions
Minister must consult Information Commissioner before making Accreditation Rules
19(1) Requirements before Accreditation Rules impose conditions
Minister must consult Information Commissioner
Minister must consider certain matters when deciding to make rules.
19(2) Requirements before Accreditation Rules impose conditions
(2) In deciding whether to make the rules, the Minister...
2 Commencement
20 Variation and revocation of conditions on accreditation
20 Feb
The Digital ID Regulator may vary or revoke conditions on accreditation.
20(1) Variation and revocation of conditions on accreditation
Consider security, reliability and stability of Australian Government Digital ID System when varying or revoking conditions.
20(2) Variation and revocation of conditions on accreditation
Consider the security, reliability and stability of...
Must revoke condition if direction to impose is revoked
20(3) Variation and revocation of conditions on accreditation
Regulator has discretion to revoke condition
Compilation information and notes on amendments, applications, saving, transitional provisions, editorial changes, modifications, and self-repealing provisions.
21 February 2025
21 Applying for variation or revocation of conditions on
Entity can apply for variation or revocation of accreditation conditions.
21(1) Applying for variation or revocation of conditions on
Digital ID Regulator must give written notice of refusal to vary or revoke conditions.
21(2) Applying for variation or revocation of conditions on
Digital ID Regulator must give written notice.
Requires a relation between identifiable temporal intervals for the compilation date.
Classifies the text as a compilation of the Digital ID Act 2024.
22 Notice before changes to conditions on accreditation
The Digital ID Regulator must give a written notice before changing accreditation conditions.
22(1) Notice before changes to conditions on accreditation
The Digital ID Regulator must give a written notice.
Entity must provide written statement within specified period
22(2) Notice before changes to conditions on accreditation
The entity must provide the written statement
The notice requests an entity to give a written statement
23 Notice of decision of changes to conditions on accreditation
Entity must receive written notice of decision on accreditation conditions.
23(1) Notice of decision of changes to conditions on accreditation
No notice required if previous notice given under subsection 15(7)
23(2) Notice of decision of changes to conditions on accreditation
There is a temporal overlap between this provision and the previous notice.
The decision was made after the previous notice was given under subsection 15(7).
The Digital ID Regulator is not required to give an entity notice.
No notice is required if the previous notice was given under subsection 15(7).
This provision diffuses the requirement to provide notice.
Diffusing the requirement to provide notice
This provision repeats the condition of the previous notice.
Repeating the condition of previous notice
The decision was made under the same conditions as the previous notice.
(a) state the condition or the variation, or state that the condition is revoked; and (b) state the day on which the condition, variation or revocation takes effect.
Notice of decision on accreditation condition changes
23(3) Notice of decision of changes to conditions on accreditation
Specifies effective date of accreditation change
(b) state the day on which the condition, variation or revocation takes effect.
May vary accreditation of an accredited entity to account for a change in the entity's name.
24 Varying accreditation
Implies obligation to vary accreditation.
25 Suspension of accreditation
Suspension of accreditation upon direction from the Digital ID Regulator
25(1) Suspension of accreditation
Prohibits suspension of accreditation without direction from the Digital ID Regulator
(1) The Digital ID Regulator must, in writing, suspend the accreditation of an accredited entity if a direction under subsection 27(1) directing the Digital ID Regulator to do so is in force in relation to the entity.
Justifies prohibition of suspension of accreditation upon direction from the Digital ID Regulator
Implies that suspension of accreditation without direction from the Digital ID Regulator is prohibited
Suspension of accreditation for contravention or cyber security incident
25(2) Suspension of accreditation
26 Revocation of accreditation
Revocation of accreditation on Minister's direction
26(1) Revocation of accreditation
Prohibits revocation without Minister's direction
Minister gives direction under subsection 27(1)
Revocation of accreditation for contravention or serious cyber security incident
26(2) Revocation of accreditation
Digital ID Regulator may revoke accreditation
Consideration of an entity's fit and proper person status in accreditation determination.
26(3) Revocation of accreditation
26(4) Revocation of accreditation
(4) Subsection (3) does not limit paragraph (2)(d)
Must revoke accreditation on application
26(5) Revocation of accreditation
Digital ID Regulator determines revocation day and approval revocation
26(6) Revocation of accreditation
26(7) Revocation of accreditation
the Digital ID Regulator must at the same time revoke the entity's approval to participate as an accredited entity.
(7) If: (a) an entity’s accreditation is revoked under subsection (1), (2) or (5); and (b) the entity holds an approval to participate in the Australian Government Digital ID System;
Recognizes accreditation approval revocation
Prohibits revoking accreditation approval
(7) If an entity's accreditation is revoked under subsection (1), (2) nor (5); and the entity holds an approval to participate in the Australian Government Digital ID System;
Spreads accreditation approval revocation
27 Minister’s directions regarding accreditation
Minister may refuse accreditation, impose conditions, suspend or revoke accreditation.
27(1) Minister’s directions regarding accreditation
Comply with Minister's direction regarding accreditation.
27(2) Minister’s directions regarding accreditation
The Minister must notify the Digital ID Regulator and the entity if the direction is revoked.
27(3) Minister’s directions regarding accreditation
The direction remains in force unless it is revoked by the Minister.
27(4) Minister’s directions regarding accreditation
(4) Despite subsection (3), a direction given under subsection (1) to revoke the accreditation of an accredited entity cannot be revoked.
A direction given under this section is not a legislative instrument.
27(5) Minister’s directions regarding accreditation
28 Accreditation Rules
28(1) Accreditation Rules
Entities must meet specific requirements to become and remain accredited.
28(2) Accreditation Rules
Entities must meet requirements before and after becoming accredited.
(2) Without limiting subsection (1), the Accreditation Rules may deal...
Entities must comply with the Accreditation Rules.
29 Digital IDs must be deactivated on request
Digital IDs must be deactivated on request upon request from an accredited identity service provider.
29(1) Digital IDs must be deactivated on request
Digital IDs must be deactivated on request.
29(2) Digital IDs must be deactivated on request
Digital ID must not be used for verifying identity or authenticating digital ID.
29(3) Digital IDs must be deactivated on request
Prohibits use of digital ID for specified purposes.
3 Objects
3(1) Objects
Establishing an accreditation scheme and providing additional privacy safeguards for digital ID services.
3(2) Objects
30 November
30 Accredited services must be accessible and inclusive
Accredited services must be accessible and inclusive
30(1) Accredited services must be accessible and inclusive
Compliance with accessibility standards and guidelines
Accredited entities must comply with accessibility standards and guidelines.
30(2) Accredited services must be accessible and inclusive
30 May
Privacy and Other Legislation Amendment Act 2024
Prohibition on holding out that an entity is accredited
31 Prohibition on holding out that an entity is accredited
Data profiling of online behavior is prohibited.
32 Simplified outline of this Chapter
Expresses prohibition or negation of an obligation.
Chapter applies only to accredited entities providing accredited services.
33 Chapter applies to accredited entities only to extent entity is
34 APP-equivalent agreements
Prohibits entity from collecting, holding, using or disclosing personal information that would breach Australian Privacy Principle.
34(1) APP-equivalent agreements
The prohibition applies to all times after the commencement of the APP-equivalent agreement
Defines the temporal interval for which the prohibition applies
(1) The Minister may enter into an agreement that prohibits the entity from collecting...
The entity is an artificial agent or natural person
Classifies entities as being covered by subsection (2)
(2) The entity is covered by subsection (2)
Imposes a duty on the entity to not collect, hold, use or disclose personal information.
The prohibition is repeated every time the entity collects, holds, uses or discloses personal information
Defines a recurring trace for the prohibition
The agreement must include provisions for protecting personal information
Defines the schema for the APP-equivalent agreement
List of entities that are departments or authorities of a State or Territory
34(2) APP-equivalent agreements
Provide a copy of an APP-equivalent agreement to the Information Commissioner within 14 days.
34(3) APP-equivalent agreements
Must provide a copy of an APP-equivalent agreement to the Information Commissioner within 14 days.
Attributes of individuals in possession or control of accredited entities are considered personal information.
35 Extended meaning of personal information in relation to
Attributes are taken as personal information.
Meaning is mirrored from the Privacy Act 1988.
35A Small business operator that is an accredited entity
Applying Privacy Act to small business operators as if they were organisations.
35A(1) Small business operator that is an accredited entity
35A(2) Small business operator that is an accredited entity
36 Privacy obligations for non-APP entities
Accredited entities not APP entities must comply with privacy obligations.
36(1) Privacy obligations for non-APP entities
Entity must comply with Privacy Act 1988 or State/Territory law for personal information protection.
36(2) Privacy obligations for non-APP entities
Entity must comply with Privacy Act 1988 or State/Territory law.
Entity with APP-equivalent agreement must comply with privacy obligations.
37 Contraventions of privacy obligations in APP-equivalent
38 Contraventions of Division 2 and section 136 are interferences
Interference with privacy is prohibited.
38(1) Contraventions of Division 2 and section 136 are interferences
Entity must respond to complaint under Privacy Act 1988
38(2) Contraventions of Division 2 and section 136 are interferences
Entity must be considered an organisation if it is subject to a complaint or investigation under Part V of the Privacy Act 1988.
38(3) Contraventions of Division 2 and section 136 are interferences
...it is subject to a complaint or investigation under Part V of the Privacy Act 1988.
Entity is considered an organisation if it meets the conditions.
The entity must be taken to be an organisation if...
Entity must meet the conditions to be considered an organisation.
Entity must not meet the conditions to be considered an organisation.
Entity must be taken to be an organisation if it meets the conditions.
Entity is considered an organisation until it meets the conditions.
38(4) Contraventions of Division 2 and section 136 are interferences
39 Notification of eligible data breaches—accredited entities that are
Accredited entities must notify the Information Commissioner of eligible data breaches.
39(1) Notification of eligible data breaches—accredited entities that are
Entity must notify Digital ID Regulator and Information Commissioner of data breaches.
39(2) Notification of eligible data breaches—accredited entities that are
Entities must comply with privacy safeguards when providing accredited services.
4 Simplified outline of this Act
40 Notification of eligible data breaches—accredited entities that are
Notification of eligible data breaches—accredited entities that are not APP entities.
40(1) Notification of eligible data breaches—accredited entities that are
Exemptions for State and Territory departments/authorities from notification of data breaches.
40(2) Notification of eligible data breaches—accredited entities that are
Exemptions from notification obligations
Applicable provisions of the Privacy Act 1988 apply to accredited entities.
40(3) Notification of eligible data breaches—accredited entities that are
copy of statement to Information Commissioner
Entity must notify Digital ID Regulator of data breach
40(4) Notification of eligible data breaches—accredited entities that are
41 Notification of corresponding data breaches—accredited State or
Entity must provide notification of data breaches to another entity.
41(1) Notification of corresponding data breaches—accredited State or
The notification must be provided within a certain timeframe.
Entity must notify within a certain timeframe.
(d) the statement relates to the accredited services of the entity;
Entity has a duty to provide notification.
(a) the entity is not an APP entity; and (b) the entity is a department or authority of a State or Territory;
Entity must comply with notification requirements.
Entity must notify regulator and commissioner of data breaches.
41(2) Notification of corresponding data breaches—accredited State or
Temporal relation between notification and data breach
(2) The entity must also give a copy of the statement to the Digital ID Regulator and the Information Commissioner at the same time as the statement is given to the notified entity.
Notification spreads to regulator and commissioner
Notification validates regulator and commissioner
The Information Commissioner must provide advice on matters relating to the operation of this Act upon request by the Digital ID Regulator.
42 Additional function of the Information Commissioner
The Information Commissioner must provide advice.
Sharing of information by Information Commissioner
43 Information Commissioner may share information
44 Collection of certain attributes of individuals is prohibited
Prohibition on collecting certain attributes of individuals
44(1) Collection of certain attributes of individuals is prohibited
Prohibits collection of specified attributes
(1) An accredited entity must not collect...
Prohibition on collecting certain attributes of individuals without destruction
44(2) Collection of certain attributes of individuals is prohibited
Prohibits collection of certain attributes
Collection of certain attributes is prohibited, but permitted attributes can be collected if not primarily of the kind described in subsection (1)
44(3) Collection of certain attributes of individuals is prohibited
Prohibition on soliciting attributes of individuals
44(4) Collection of certain attributes of individuals is prohibited
solicits: an accredited entity solicits an attribute of an individual if...
Must provide explicit consent for disclosure of certain attributes.
45 Individuals must expressly consent to disclosure of certain
46 Disclosure of restricted attributes of individuals
Must not disclose restricted attributes without consent.
46(1) Disclosure of restricted attributes of individuals
Prohibits disclosure of restricted attributes.
Do not disclose restricted attributes to non-participating relying parties
46(2) Disclosure of restricted attributes of individuals
47 Restricting disclosure of unique identifiers
Disclosing unique identifiers is restricted.
47(1) Restricting disclosure of unique identifiers
Restricting disclosure of unique identifiers.
47(2) Restricting disclosure of unique identifiers
Prohibits disclosure of unique identifiers
(2) The assigning entity must not disclose...
Prohibits disclosure of unique identifiers to relying parties
if the unique identifier was disclosed to a relying party—the relying party.
Must not disclose unique identifier to any other entity.
47(3) Restricting disclosure of unique identifiers
The restriction applies only during the accreditation period.
(3) The accredited entity to whom the unique identifier is disclosed must not disclose the unique identifier to any other entity.
The restriction limits the knowledge of the accredited entity.
The accredited entity must not disclose the unique identifier to any other entity.
The restriction prevents the spread of information about the unique identifier.
Disclosure of unique identifiers is permitted for specific purposes.
47(4) Restricting disclosure of unique identifiers
Permission to disclose unique identifiers.
Disclosure of unique identifiers is permitted for contractors engaged by the accredited entity.
47(5) Restricting disclosure of unique identifiers
A person who wishes to rely on this subsection bears an evidential burden.
47(6) Restricting disclosure of unique identifiers
Authorized entities must obtain consent before collecting, using or disclosing biometric information.
48 Restrictions on collecting, using and disclosing biometric
Authorized entities must obtain consent.
49 Authorised collection, use and disclosure of biometric
Accredited entities may collect, use or disclose biometric information under certain conditions.
49(1) Authorised collection, use and disclosure of biometric
The biometric information collection and use must overlap with accreditation conditions.
Biometric information collection and use must overlap with accreditation conditions.
(a) the accredited entity’s conditions on accreditation authorise the collection, use, or disclosure of the biometric information;
The accredited entity is permitted to collect, use or disclose biometric information.
Accredited entities are permitted to collect, use or disclose biometric information.
The biometric information must be used for verifying identity or authenticating digital ID.
Biometric information must be used for verifying identity or authenticating digital ID.
(b) the biometric information of the individual is collected, used or disclosed for the purposes of the accredited entity doing neither or both of the following:
The biometric information must be contained within accredited entity’s conditions.
Biometric information must be contained within accredited entity’s conditions.
The biometric information collection and use are valid until accreditation conditions expire.
Biometric information collection and use are valid until accreditation conditions expire.
Authorized collection, use and disclosure of biometric information under certain conditions.
49(2) Authorised collection, use and disclosure of biometric
Biometric information within a verifiable credential.
(a) the biometric information is contained in a verifiable credential that is in the individual’s control;
Permission to collect, use or disclose biometric information.
Requirements for collection, use or disclosure.
(b) the Accreditation Rules prescribe requirements relating to the collection, use or disclosure of the biometric information;
(c) the collection, use or disclosure complies with those requirements.
Collection, use or disclosure until requirements are met.
Disclosure of biometric information is permitted to law enforcement agencies under certain conditions.
49(3) Authorised collection, use and disclosure of biometric
Permission granted by the State to law enforcement agencies.
Despite certain laws, the subsection applies.
49(4) Authorised collection, use and disclosure of biometric
Authorisation for disclosure of biometric information
49(5) Authorised collection, use and disclosure of biometric
(5) An accredited entity is authorised to disclose biometric information of an individual if the disclosure is to the individual to whom the biometric information relates.
Processing of biometric information for disclosure
Permission to disclose biometric information
Authorization for disclosure of biometric information
Accredited entity may retain, use or disclose biometric information for testing purposes.
49(6) Authorised collection, use and disclosure of biometric
...retain, use or disclose biometric information of an individual.
(6) An accredited entity is authorised to...
49A Biometric information, testing and continuous improvement
Accredited entities must retain, use or disclose biometric information under certain conditions.
49A(1) Biometric information, testing and continuous improvement
Accredited entities must retain, use or disclose biometric information.
Accredited entity must continuously improve biometric systems to prevent discrimination.
49A(2) Biometric information, testing and continuous improvement
Obligation to improve biometric systems.
The Act binds the Crown in all its capacities.
5 Act binds the Crown
50 Accredited entities may collect etc. biometric information for
Accredited entities must collect biometric information for identity verification if they have verified its legitimacy.
50(1) Accredited entities may collect etc. biometric information for
Entities may collect biometric information for issuing documents with consented personal info.
50(2) Accredited entities may collect etc. biometric information for
Permission to collect biometric information
51 Destruction of biometric information of individuals
Destroy biometric information immediately after verification is complete.
51(1) Destruction of biometric information of individuals
Prohibits destruction of biometric information.
Destroy biometric information after authentication is complete.
51(2) Destruction of biometric information of individuals
Accredited entity must destroy biometric information after consent withdrawal.
51(3) Destruction of biometric information of individuals
Biometric information destruction timing.
(c) the individual withdraws their consent;
Accredited entity must destroy biometric information.
(3) Subject to subsections (4) and (5), if...
Destroy biometric information after testing completion
51(4) Destruction of biometric information of individuals
52 Other rules relating to biometric information
Accredited entities must comply with biometric information rules.
52(1) Other rules relating to biometric information
Temporal interval for biometric information collection.
Accreditation Rules may provide for requirements relating to quality, security or fraud.
52(2) Other rules relating to biometric information
53 Data profiling to track online behaviour is prohibited
Data profiling for tracking online behavior is prohibited.
53(1) Data profiling to track online behaviour is prohibited
Prohibits data profiling for tracking online behavior.
(1) An accredited entity must not use or disclose information if:
53(2) Data profiling to track online behaviour is prohibited
Data profiling for broader business purposes is prohibited.
53(3) Data profiling to track online behaviour is prohibited
Prohibits data profiling for broader business purposes.
Personal information must not be used or disclosed for enforcement purposes unless certain conditions are met.
54 Certain personal information must not be used or disclosed for
Against a person for an offence against a law of the Commonwealth, a State or a Territory.
The use or disclosure of personal information must overlap with the start of proceedings against a person.
At the time the information is used or disclosed, the accredited entity is satisfied that the enforcement body has started proceedings...
Against a person in relation to a breach of a law imposing a penalty or sanction.
The use or disclosure of personal information must be cognizable by AI.
Prohibition on using or disclosing personal information for enforcement purposes.
The entity must not use or disclose the information.
The use or disclosure of personal information must diffuse into the start of proceedings against a person.
The use or disclosure of personal information must be until the start of proceedings against a person.
55 Personal information must not be used or disclosed for
Personal information must not be used or disclosed for specified purposes.
55(1) Personal information must not be used or disclosed for
Prohibition of using personal information.
(1) An accredited entity must not use or disclose...
Disclosure of personal information for advertising or promoting accredited services is permitted with individual consent.
55(2) Personal information must not be used or disclosed for
Prohibition on disclosure without consent
(2) Subsection (1) does not apply to the disclosure of personal information about an individual
Accredited identity exchange providers must not retain certain attributes of individuals
56 Accredited identity exchange providers must not retain certain
Entity must meet criteria to participate, including holding approval from Digital ID Regulator.
57 Simplified outline of this Chapter
Entity must hold approval from Digital ID Regulator.
Participating in Australian Government Digital ID System is subject to conditions.
Digital ID Regulator may suspend entity's approval.
An entity's approval to participate in the Australian Government Digital ID System can also be suspended.
Only certain kinds of accredited entities and relying parties can apply to the Digital ID Regulator to participate, and specified criteria must be met before the Digital ID Regulator gives an approval.
Minister may direct Digital ID Regulator on entity's approval.
Digital ID Regulator may give directions to Minister regarding entity's approval
The Minister may give directions to the Digital ID Regulator regarding the approval of an entity to participate in the Australian Government Digital ID System if, for reasons of security.
58 Digital ID Regulator must oversee and maintain the Australian
The Digital ID Regulator must oversee and maintain a digital ID system.
58(1) Digital ID Regulator must oversee and maintain the Australian
Obligation to oversee and maintain a digital ID system.
The Digital ID Regulator must oversee and maintain the Australian digital ID system.
58(2) Digital ID Regulator must oversee and maintain the Australian
The Digital ID System is a subclass of the digital ID system overseen by the Digital ID Regulator.
Entities may provide or receive services within the Australian Government Digital ID System if they satisfy certain requirements.
59 Circumstances in which entities may provide or receive services
Entity must hold an approval under section 62 to participate in the system.
Participation start day for attribute service provider must have arrived or passed.
Attribute service provider is mentioned in column 1 of the table.
Entity must be an accredited attribute service provider.
6 Extension to external Territories
60 Phasing-in of participation in the Australian Government Digital
Entities may apply for approval to participate in the Australian Government Digital ID System.
60(1) Phasing-in of participation in the Australian Government Digital
The determination may specify entities by temporal interval.
Entities must be specified in a certain way when participating in the Australian Government Digital
60(2) Phasing-in of participation in the Australian Government Digital
Entity types must be specified within a certain temporal interval
The determination may specify entities by reference to kinds of accredited entities
Entities must be specified according to the determination
(2) The determination may specify entities in any way
Minister must not revoke determination and may vary it under certain conditions.
60(3) Phasing-in of participation in the Australian Government Digital
Varying the determination is allowed during a specific period.
(i) specify additional kinds of entities that may apply; or (ii) correct an error, defect or irregularity in the determination.
Minister may vary the determination under certain conditions.
Varying the determination is allowed through a process of correction and specification.
Approval required for participation in Australian Government Digital ID System
61 Applying for approval to participate in the Australian
62 Approval to participate in the Australian Government Digital ID
Approval to participate in the Australian Government Digital ID System
62(1) Approval to participate in the Australian Government Digital ID
The Digital ID Regulator must approve the entity.
Digital ID Regulator must approve entity to participate in the Australian Government Digital ID System
(a) the entity has made an application under section 61; and (b) unless the entity is a relying party—the entity is an accredited entity;
The entity must comply with the Digital ID Data Standards.
Entity must comply with Digital ID Data Standards
(c) the Digital ID Regulator is satisfied that the entity will comply with the Digital ID Data Standards that apply in relation to the entity and that relate to participation in the Australian Government Digital ID System;
The entity has been assessed as being able to comply with this Act.
Entity has been assessed as being able to comply with this Act
(d) if the Digital ID Regulator makes a requirement under paragraph 131(1)(a) in relation to the entity—the entity has been assessed as being able to comply with this Act;
The Digital ID Regulator must be satisfied that it is appropriate to approve the entity.
Digital ID Regulator must be satisfied that it is appropriate to approve the entity
(e) the Digital ID Regulator is satisfied that it is appropriate to approve the entity to participate in the system;
The entity must meet other requirements prescribed by the Digital ID Rules.
Entity must meet other requirements prescribed by the Digital ID Rules
(f) any other requirements prescribed by the Digital ID Rules are met;
Consideration of matters when approving entity participation in Australian Government Digital ID
62(2) Approval to participate in the Australian Government Digital ID
the Digital ID Regulator must have regard to...
(a) whether the entity is a fit and proper person;
(2) Without limiting paragraph (1)(e), the Digital ID Regulator may have regard to...
the entity is not appropriate for approval
the entity is not considered for approval
Prescribes requirements for the security, reliability and stability of the Australian Government Digital ID System.
62(3) Approval to participate in the Australian Government Digital ID
The Digital ID Rules may prescribe requirements...
Requires security, reliability and stability
Refusal of approval to participate in the Australian Government Digital ID System
62(4) Approval to participate in the Australian Government Digital ID
The security direction overlaps with the approval process
Security direction overlaps with approval process
(4) However, the Digital ID Regulator must not approve an entity to participate in the Australian Government Digital ID System if a direction under subsection 73(1) (about security) directing the Digital ID Regulator to refuse to approve the entity is in force.
The Digital ID Regulator must not approve the entity
Digital ID Regulator cannot approve entity
Digital ID Regulator must not approve entity
The Digital ID Regulator cannot approve the entity
The approval decision will be made after the security direction expires
Security direction until approval decision
The Digital ID Regulator must approve participation in the Australian Government Digital ID System.
62(5) Approval to participate in the Australian Government Digital ID
63 Approval to participate in the Australian Government Digital ID
Approval conditions for participating in the Australian Government Digital ID System
63(1) Approval to participate in the Australian Government Digital ID
Comply with approval conditions for participating in the Australian Government Digital ID System.
63(2) Approval to participate in the Australian Government Digital ID
64 Conditions on approval to participate in the Australian
Entity must comply with Act and conditions imposed by Digital ID Regulator.
64(1) Conditions on approval to participate in the Australian
(d) the entity must comply with this Act.
Entity must be accredited to participate in the system.
(a) unless the entity is a relying party—the entity must be an accredited entity;
Entity must provide specific services in the system.
participate only as the kind of accredited entity it is accredited as and approved to participate as
(b) if the entity is an accredited entity: (i) the entity must participate in the Australian Government Digital ID System only as the kind of accredited entity it is accredited as and approved to participate as;
Entity must start participating at a specific time.
begin on the entity’s participation start day
(c) the entity must begin to participate in the Australian Government Digital ID System on the entity’s participation start day;
Conditions on approval to participate in the Australian Government Digital ID System
64(2) Conditions on approval to participate in the Australian
65 Conditions relating to restricted attributes of individuals
Prohibition on collecting or disclosing restricted attributes without approval
65(1) Conditions relating to restricted attributes of individuals
entity may not collect or disclose restricted attribute
(a) whether the entity has provided sufficient justification for the need to collect or disclose the restricted attribute;
Entity must provide justification for collecting or disclosing restricted attribute.
65(2) Conditions relating to restricted attributes of individuals
66 Variation and revocation of conditions
The Digital ID Regulator may vary or revoke conditions imposed on an entity's approval.
66(1) Variation and revocation of conditions
Consider matters relating to security, reliability and stability when varying or revoking conditions.
66(2) Variation and revocation of conditions
Consider matters relating to security, reliability and stability at specific times.
(2) Without limiting subsection (1), the Digital ID Regulator may have regard to matters relating to the security, reliability and stability of the Australian Government Digital ID System when considering whether it is appropriate to vary or revoke a condition.
Consider matters relating to security, reliability and stability.
Must revoke a condition imposed under paragraph 64(2)(b) if the direction to impose the condition is revoked.
66(3) Variation and revocation of conditions
...the direction to impose the condition is revoked.
The Digital ID Regulator must revoke a condition imposed under paragraph 64(2)(b) if...
...if the direction to impose the condition is revoked.
The Digital ID Regulator must revoke a condition...
May apply for variation or revocation of conditions on approval
67 Applying for variation or revocation of conditions on approval
Entity can apply for variation or revocation of conditions on approval
68 Notice before changes to conditions on approval
Entity must be given written notice before changes to conditions on approval.
68(1) Notice before changes to conditions on approval
Digital ID Regulator cannot impose conditions without notice.
Request for written statement from entity regarding proposed condition, variation or revocation.
68(2) Notice before changes to conditions on approval
Consider written statements before making a decision to impose or vary conditions on approval.
68(3) Notice before changes to conditions on approval
Consider written statements before making a decision.
Exemption from notice requirement under urgent circumstances
68(4) Notice before changes to conditions on approval
Temporal interval for 'serious and urgent'
The need to impose, vary or revoke the condition is serious and urgent.
Diffusion of information about exemptions
Entity must receive written statement of reasons from Digital ID Regulator.
68(5) Notice before changes to conditions on approval
Statement of reasons must be provided within 7 days after condition change.
68(6) Notice before changes to conditions on approval
Obligation to provide statement of reasons.
69 Notice of decision of changes of conditions on approval
Entity must receive written notice of decision on conditions.
69(1) Notice of decision of changes of conditions on approval
No notice required if previous condition notice was given
69(2) Notice of decision of changes of conditions on approval
Notice of condition given under subsection 62(5)
Notice of decision of changes of conditions on approval must be provided
69(3) Notice of decision of changes of conditions on approval
7 Extraterritorial operation
Act extends to acts, omissions, matters and things outside Australia.
7(1) Extraterritorial operation
This Act has effect in relation to acts, omissions, matters and things outside Australia subject to certain obligations.
7(2) Extraterritorial operation
Relation between extraterritorial operation and international law obligations
(a) the obligations of Australia under international law, including obligations under any international agreement binding on Australia;
Obligation of Australia under international law
Obligation of Commonwealth giving effect to an international agreement
(b) any law of the Commonwealth giving effect to such an agreement;
Diffusion for extraterritorial operation and international law obligations
Ordered trace for extraterritorial operation and Commonwealth giving effect to an international agreement
May vary approval given to an entity under section 62 to take account of a change in the entity’s name.
70 Varying approval to participate in the Australian Government
71 Suspension of approval to participate in the Australian
Suspension of approval to participate in the Australian Digital ID system
71(1) Suspension of approval to participate in the Australian
Prohibits participation in the Australian Digital ID system
71(2) Suspension of approval to participate in the Australian
Temporal intervals for cyber security incidents
(ii) there has been a cyber security incident involving the entity;
(2) The Digital ID Regulator may, in writing...
Consideration of an entity's fit and proper person status when determining approval to participate in the Australian Digital ID system.
71(3) Suspension of approval to participate in the Australian
...an entity is a fit and proper person.
Consideration of an entity's fit and proper person status.
Digital ID Regulator may suspend approval on application
71(4) Suspension of approval to participate in the Australian
Temporal relationship between subsection (3) and paragraph (2)(e)
(4) Subsection (3) does not limit paragraph (2)(e)
Implication of subsection (3) on paragraph (2)(e)
May suspend approval to participate in the Australian Digital ID system.
71(5) Suspension of approval to participate in the Australian
Notice requirement before suspending approval
71(6) Suspension of approval to participate in the Australian
Entity must provide written statement within 28 days after notice is given.
71(7) Suspension of approval to participate in the Australian
72 Revocation of approval to participate in the Australian
Revocation of approval to participate in the Australian Digital ID system
72(1) Revocation of approval to participate in the Australian
The revocation of approval occurs within a specific temporal interval
Defines temporal interval for revocation of approval
(1) The Digital ID Regulator must, in writing, revoke an approval given to an entity under section 62 if the Minister gives a direction under subsection 73(1) to do so.
The Minister's direction implies revocation of approval
Establishes implication between Minister's direction and revocation of approval
The Digital ID Regulator may not revoke approval without the Minister's direction
Prohibits revocation of approval without Minister's direction
The Digital ID Regulator has an obligation to revoke approval upon receipt of Minister's direction
Establishes obligation on Digital ID Regulator to revoke approval
The Digital ID Regulator's actions create a recurring trace for revocation of approval
Establishes recurring trace for Digital ID Regulator's actions
72(2) Revocation of approval to participate in the Australian
Temporal interval for revocation of approval
Prohibition of participation in the Australian Digital ID System
Digital ID Regulator may revoke approval
73 Minister’s directions regarding participation
Minister may refuse, impose conditions on, or revoke approval of an entity to participate in the Australian Government Digital ID System.
73(1) Minister’s directions regarding participation
Comply with Minister's direction regarding participation.
73(2) Minister’s directions regarding participation
73(3) Minister’s directions regarding participation
The direction is valid during its duration.
(3) The direction remains in force unless it is revoked by the Minister.
If the Minister revokes the direction, then the Minister must notify the Digital ID Regulator and the entity.
Revocation requires notification to regulator and entity
The Minister must notify the Digital ID Regulator and the entity if the Minister revokes the direction.
The Minister must take action to revoke the direction.
Revocation requires action from Minister
The direction ends at the time of its revocation.
Cannot revoke approval of entity participation in Australian Government Digital ID System
73(4) Minister’s directions regarding participation
73(5) Minister’s directions regarding participation
Direction is not a legislative instrument.
74 Creating and using a digital ID is voluntary
Note: Participating relying party must provide another means of accessing service that does not involve creation or use of digital ID.
Participating relying party must not require individual to create or use digital ID.
74(1) Creating and using a digital ID is voluntary
Classifies service as not requiring digital ID.
Participating relying party must use digital ID through Australian Government Digital ID System
74(1A) Creating and using a digital ID is voluntary
Prohibits using non-digital ID for service provision
(1A) A participating relying party is taken to contravene subsection (1)
Exemption from digital ID requirement for certain services
74(2) Creating and using a digital ID is voluntary
Allows participating relying party to provide service without digital ID
(a) the service provides access to another service; and (b) the individual can access the other service by means other than the creation or use of a digital ID through the Australian Government Digital ID System;
(c) the other means is reasonably accessible;
Cannot collect restricted attributes without approval
75 Restriction on collection of restricted attributes of individuals by
Prohibition on collecting restricted attributes
76 Notice before exemption is revoked
76(1) Notice before exemption is revoked
76(2) Notice before exemption is revoked
77 Holding etc. information outside Australia
The Digital ID Rules may make provision in relation to the holding, storing, handling or transfer of information outside Australia.
77(1) Holding etc. information outside Australia
...the holding, storing, handling or transfer of information outside Australia.
Describes the temporal relationship between entities
(1) The Digital ID Rules may make provision in relation to...
Establishes a condition for the provision
Prohibits holding, storing, handling or transferring of information outside Australia.
77(2) Holding etc. information outside Australia
Prohibition applies during specified circumstances
(a) prohibit (either absolutely or unless particular circumstances are met or conditions are complied with)
Failure to comply with Digital ID Rules results in civil penalty.
77(3) Holding etc. information outside Australia
An entity is liable to a civil penalty if: (a) the entity is subject to a requirement under the Digital ID Rules made for the purposes of subsection (1); and (b) the entity fails to comply with the requirement.
Defines the temporal scope of civil penalty.
(3) An entity is liable to a civil penalty if: (a) the entity is subject to a requirement under the Digital ID Rules made for the purposes of subsection (1); and (b) the entity fails to comply with the requirement.
Defines the scope of entities liable to civil penalty.
Prohibits failure to comply with Digital ID Rules.
(a) the entity is subject to a requirement under the Digital ID Rules made for the purposes of subsection (1); and (b) the entity fails to comply with the requirement.
Defines the recurring nature of civil penalty.
78 Reportable incidents
Prescribes arrangements for reporting and managing incidents related to the Australian Government Digital ID System.
78(1) Reportable incidents
Notification of reportable incidents, information about incidents
Entities must notify reportable incidents and follow specific procedures
78(2) Reportable incidents
79 Interoperability
Interoperability requirement within Australian Government Digital ID System
79(1) Interoperability
Individuals with a choice of accredited identity service providers, Accredited services to other entities.
Interoperability obligation on participating relying parties and accredited entities.
79(2) Interoperability
Obligation on participating relying parties and accredited entities.
Class hierarchy for accredited identity service providers and accredited services.
Specify circumstances for interoperability obligation
79(3) Interoperability
Classifies circumstances for interoperability obligation
8 Concurrent operation of State and Territory laws
May determine service levels for accredited entities and participating relying parties
80 Service levels for accredited entities and participating relying
81 Entities may conduct testing in the Australian Government
Authorise entities to conduct testing in the Australian Government Digital ID System.
81(1) Entities may conduct testing in the Australian Government
Entities may conduct testing in the Australian Government
81(2) Entities may conduct testing in the Australian Government
The authorisation is in force for a period not exceeding 3 months.
Temporal interval during which authorisation is valid
(c) may be granted unconditionally or subject to conditions.
The authorisation may be granted unconditionally or subject to conditions.
(2) The authorisation must be in writing; and (b) must specify the period for which it is in force, which must not exceed 3 months;
The System Administrator may vary or revoke the authorisation.
Diffusion of information about testing authorisation
Note: The System Administrator may vary or revoke the authorisation: see subsection 33(3) of the Acts Interpretation Act 1901.
Temporal interval until which authorisation remains valid
Authorisation ceases if condition not met
81(3) Entities may conduct testing in the Australian Government
82 Use and disclosure of personal information to conduct testing
Use and disclosure of personal information for testing purposes with consent.
82(1) Use and disclosure of personal information to conduct testing
the individual to whom the information relates has expressly consented to the use or disclosure of the information for that purpose.
Use of personal information for testing.
(a) the accredited entity uses or discloses the information for the purposes of conducting testing in the Australian Government Digital ID System;
Disclosure of personal information for testing.
(b) the accredited entity or another entity is authorised under section 81 to conduct the testing using the information;
Authorisation for testing under section 81.
Express consent for use and disclosure of personal information.
(c) the individual to whom the information relates has expressly consented to the use or disclosure of the information for that purpose.
Expressed consent for use and disclosure of personal information.
This section applies despite anything else in this Act.
82(2) Use and disclosure of personal information to conduct testing
Obligation to apply despite other provisions
Prohibition on holding out that an entity holds an approval
83 Prohibition on holding out that an entity holds an approval
Prohibits holding out that an entity holds an approval
84 Accredited entities participating in the Australian Government
Accredited entities are not liable for provision of services to other accredited entities or relying parties.
84(1) Accredited entities participating in the Australian Government
The provision defines a temporal interval for the action or proceeding.
(1) An action or other proceeding, whether civil or criminal, for or in relation to the provision or non-provision of an accredited service.
If an action is brought by another entity, then the first entity is not liable.
(a) The action or other proceeding is brought by the other entity or the participating relying party.
The action or other proceeding is brought by the other entity or the participating relying party.
If subsections (1A) and (1B) apply, then the first entity is not liable.
The provision defines a duty for the first entity.
The provision defines a recurring trace for the action or proceeding.
Must provide accredited service in good faith and compliance with the Act.
84(1A) Accredited entities participating in the Australian Government
Must provide service in good faith and compliance.
Non-compliance with service levels is not the ground or cause for an action.
84(1B) Accredited entities participating in the Australian Government
The non-compliance overlaps with the action.
If non-compliance is not the ground or cause for an action, then it is not a breach.
The non-compliance is not a breach of the service level obligation.
Entity bears evidential burden in relation to action or proceeding.
84(2) Accredited entities participating in the Australian Government
85 Statutory contract between entities participating in the
Accredited entities must provide services and comply with intellectual property rights.
85(1) Statutory contract between entities participating in the
Mandatory obligation on accredited entities.
Entities participating in the Australian Government Digital ID System are part of a class.
85(2) Statutory contract between entities participating in the
Application to the Federal Circuit and Family Court of Australia (Division 2) may be made if an accredited entity breaches the contract.
85(3) Statutory contract between entities participating in the
During breach of contract, application to Federal Circuit and Family Court of Australia (Division 2) may be made
(3) If an accredited entity breaches the contract, an application to the Federal Circuit and Family Court of Australia (Division 2) may be
May make application to Federal Circuit and Family Court of Australia (Division 2)
Must make application to Federal Circuit and Family Court of Australia (Division 2)
86 Participating entities to maintain insurance as directed by the
Directs accredited entities to maintain insurance against liabilities arising from section 85 obligations.
86(1) Participating entities to maintain insurance as directed by the
Condition imposed on entity's approval to participate in Australian Government Digital ID System
86(2) Participating entities to maintain insurance as directed by the
Entity's approval to participate in Australian Government Digital ID System is subject to condition
Condition imposed on participation approval
Digital ID Regulator gives direction to entity under subsection (1)
Entity must maintain insurance as directed by the Digital ID Regulator
Participation approval implies compliance with insurance requirement
Entity under subsection (1) has approved participation in Australian Government Digital ID System
Participation approval requires compliance with insurance requirement
Entity's approval to participate in Australian Government Digital ID System
Entity must comply with insurance requirement
Digital ID Regulator's direction influences entity's behavior
86(3) Participating entities to maintain insurance as directed by the
Entities must comply with dispute resolution procedures before applying for an order.
87 Dispute resolution procedures
Entities must comply with dispute resolution procedures.
88 Redress framework
Digital ID Rules must provide a redress framework within 12 months.
88(1) Redress framework
Obligation to provide a redress framework
procedures for dealing with incidents, requirements relating to notifying individuals affected by incidents
88(2) Redress framework
Entities must provide information about support services to the Digital ID Regulator.
88(3) Redress framework
The Digital ID Regulator has certain functions, including to promote compliance with this Act.
89 Simplified outline of this Chapter
The Digital ID Regulator has certain functions.
9 Definitions
Establishes the Digital ID Regulator as the Australian Competition and Consumer Commission.
90 Digital ID Regulator
91 Functions of the Digital ID Regulator
Power to perform functions under this Act
92 Powers of the Digital ID Regulator
Ability to do things necessary or convenient
The Minister may give general directions to the System Administrator.
93 Simplified outline of this Chapter
The Chief Executive Centrelink is the System Administrator.
94 System Administrator
The Chief Executive Centrelink is assigned the role of System Administrator.
95 Functions of the System Administrator
Power to perform necessary or convenient actions for system administration functions.
96 Powers of the System Administrator
System Administrator has the power to perform necessary or convenient actions.
97 Directions to the System Administrator
The Minister may give written directions to the System Administrator.
97(1) Directions to the System Administrator
97(2) Directions to the System Administrator
(2) A direction under subsection (1) must be of a general nature only.
System Administrator must comply with direction under subsection (1).
97(3) Directions to the System Administrator
97(4) Directions to the System Administrator
Must consult Minister and invite public comments before making, amending or revoking Digital ID Data Standards.
98 Simplified outline of this Chapter
Must consult Minister and invite public comments.
99 Digital ID Data Standards
May make standards about technical integration requirements, design features, and accreditation standards.
99(1) Digital ID Data Standards
Digital ID Data Standards may provide differently for different kinds of entities, things or circumstances.
99(2) Digital ID Data Standards
Digital ID Data Standards must be consistent with Accreditation Rules to the extent possible.
99(3) Digital ID Data Standards
Digital ID Data Standards can operate concurrently with Accreditation Rules.
(3) Digital ID Data Standards that are inconsistent with the Accreditation Rules have no effect to the extent of the inconsistency, but Digital ID Data Standards are taken to be consistent with the Accreditation Rules to the extent that Digital ID Data Standards are capable of operating concurrently with the Accreditation Rules.
Digital ID Data Standards are taken to be consistent with the Accreditation Rules to the extent that Digital ID Data Standards are capable of operating concurrently with the Accreditation Rules.
Digital ID Data Standards must be consistent with Accreditation Rules.
(3) Digital ID Data Standards that are inconsistent with the Accreditation Rules have no effect to the extent of the inconsistency.
Digital ID Data Standards are legislative instruments.
99(4) Digital ID Data Standards
Section 42 (disallowance) does not apply to Digital ID Data Standards.
Digital ID Act 2024