Digital ID Act 2024
21 February 2025
Compilation information and notes on amendments, applications, saving, transitional provisions, editorial changes, modifications, and self-repealing provisions.
Classifies the text as a compilation of the Digital ID Act 2024.
Requires a relation between identifiable temporal intervals for the compilation date.
1 Short title
2 Commencement
1 Section 1
Requires a relation between temporal intervals
Commences within 6 months or on the day after
30 November
3 Objects
3(1) Objects
3(2) Objects
Establishing an accreditation scheme and providing additional privacy safeguards for digital ID services.
4 Simplified outline of this Act
Entities must comply with privacy safeguards when providing accredited services.
5 Act binds the Crown
The Act binds the Crown in all its capacities.
6 Extension to external Territories
7 Extraterritorial operation
7(1) Extraterritorial operation
Act extends to acts, omissions, matters and things outside Australia.
7(2) Extraterritorial operation
This Act has effect in relation to acts, omissions, matters and things outside Australia subject to certain obligations.
Obligation of Australia under international law
(a) the obligations of Australia under international law, including obligations under any international agreement binding on Australia;
Obligation of Commonwealth giving effect to an international agreement
(b) any law of the Commonwealth giving effect to such an agreement;
Relation between extraterritorial operation and international law obligations
Ordered trace for extraterritorial operation and Commonwealth giving effect to an international agreement
Diffusion for extraterritorial operation and international law obligations
8 Concurrent operation of State and Territory laws
9 Definitions
10 Meaning of attribute of an individual
10(1) Meaning of attribute of an individual
10(2) Meaning of attribute of an individual
Defines attributes of an individual for legal purposes.
Includes specific attributes in the definition.
(2) Without limiting subsection (1), an attribute of an individual includes...
Defines a subclass for restricted attributes.
(i) information or an opinion about the individual’s: (i) racial or ethnic origin; or (ii) political opinions; or (iii) membership of a political association; or (iv) religious beliefs or affiliations; or (v) philosophical beliefs; or (vi) sexual orientation or practices.
Defines the creation time of a digital ID.
(g) if the individual has a digital ID—the time and date the digital ID was created;
Defines the creation interval of a digital ID.
Includes biometric information in the definition.
(h) biometric information of the individual;
11 Meaning of restricted attribute of an individual
11(1) Meaning of restricted attribute of an individual
Defines restricted attribute of an individual
(1) A restricted attribute of an individual means:
Defines a class hierarchy for restricted attributes
(a) health information (within the meaning of the Privacy Act 1988) about the individual; or
(b) an identifier of the individual that has been issued or assigned by or on behalf of:
Includes temporal intervals related to restricted attribute issuance
(i) the Commonwealth, a State or a Territory; or
Includes trace of restricted attribute usage
(ii) an authority or agency of the Commonwealth, a State or a Territory; or
Includes diffusion of restricted attribute information
(iii) a government of a foreign country; or
11(2) Meaning of restricted attribute of an individual
Defines what constitutes an individual's identifier.
12 Fit and proper person considerations
Digital ID Regulator has an obligation to consider this
13 Simplified outline of this Chapter
An entity must comply with conditions imposed by the Digital ID Regulator on its accreditation.
14 Application for accreditation
14(1) Application for accreditation
Entities may apply for accreditation as accredited attribute service providers, identity exchange providers, identity service providers, or entities providing a prescribed service.
14(2) Application for accreditation
List of entities covered by this section
15 Digital ID Regulator must decide whether to accredit an entity
15(1) Digital ID Regulator must decide whether to accredit an entity
Must decide whether to accredit an entity
15(2) Digital ID Regulator must decide whether to accredit an entity
Must decide to accredit or refuse accreditation
15(3) Digital ID Regulator must decide whether to accredit an entity
Entity cannot be accredited without providing required services.
some or all of the services described in the definition of attribute service provider, identity exchange provider, or identity service provider
Prohibits accreditation without required services.
15(4) Digital ID Regulator must decide whether to accredit an entity
The Digital ID Regulator must not accredit an entity under certain conditions.
The Digital ID Regulator must accredit an entity.
The Digital ID Regulator must not accredit an entity.
A direction under subsection 27(1) (about security) directing the Digital ID Regulator to refuse to accredit the entity is in force.
The accreditation refusal occurs during this time.
The Digital ID Regulator must accredit an entity if it can comply with this Act.
The Digital ID Regulator must not accredit an entity if it cannot comply.
16 Accreditation is subject to conditions
16(1) Accreditation is subject to conditions
16(2) Accreditation is subject to conditions
Entity must comply with accreditation conditions.
17 Conditions on accreditation
17(1) Conditions on accreditation
Accredited entity must comply with the Act.
17(2) Conditions on accreditation
17(3) Conditions on accreditation
Conditions may be imposed on application by the entity or on the Digital ID Regulator’s own initiative.
17(4) Conditions on accreditation
18 Conditions relating to restricted attributes of individuals
18(1) Conditions relating to restricted attributes of individuals
Entity must comply with proposed condition on accreditation.
18(2) Conditions relating to restricted attributes of individuals
Digital ID Regulator must consider specific matters when deciding whether to impose a condition.
Digital ID Regulator must consider specific matters.
The Digital ID Regulator must have regard to the following matters:
Digital ID Regulator should consider community expectations.
Entity's risk assessment plan and privacy impact assessment are relevant.
The entity seeking authorisation to collect or disclose the restricted attribute must provide:
18(3) Conditions relating to restricted attributes of individuals
Publish statement of reasons for authorizing collection or disclosure of restricted attribute.
19 Requirements before Accreditation Rules impose conditions
19(1) Requirements before Accreditation Rules impose conditions
Minister must consult Information Commissioner before making Accreditation Rules
Minister must consult Information Commissioner
19(2) Requirements before Accreditation Rules impose conditions
Minister must consider certain matters when deciding to make rules.
(2) In deciding whether to make the rules, the Minister...
20 Variation and revocation of conditions on accreditation
20(1) Variation and revocation of conditions on accreditation
The Digital ID Regulator may vary or revoke conditions on accreditation.
20(2) Variation and revocation of conditions on accreditation
Consider security, reliability and stability of Australian Government Digital ID System when varying or revoking conditions.
Consider the security, reliability and stability of...
20(3) Variation and revocation of conditions on accreditation
Must revoke condition if direction to impose is revoked
Regulator has discretion to revoke condition
21 Applying for variation or revocation of conditions on
21(1) Applying for variation or revocation of conditions on
Entity can apply for variation or revocation of accreditation conditions.
21(2) Applying for variation or revocation of conditions on
Digital ID Regulator must give written notice of refusal to vary or revoke conditions.
Digital ID Regulator must give written notice.
22 Notice before changes to conditions on accreditation
22(1) Notice before changes to conditions on accreditation
The Digital ID Regulator must give a written notice before changing accreditation conditions.
The Digital ID Regulator must give a written notice.
22(2) Notice before changes to conditions on accreditation
Entity must provide written statement within specified period
The notice requests an entity to give a written statement
The entity must provide the written statement
23 Notice of decision of changes to conditions on accreditation
23(1) Notice of decision of changes to conditions on accreditation
Entity must receive written notice of decision on accreditation conditions.
23(2) Notice of decision of changes to conditions on accreditation
No notice required if previous notice given under subsection 15(7)
The Digital ID Regulator is not required to give an entity notice.
No notice is required if the previous notice was given under subsection 15(7).
The decision was made after the previous notice was given under subsection 15(7).
There is a temporal overlap between this provision and the previous notice.
Repeating the condition of previous notice
The decision was made under the same conditions as the previous notice.
This provision repeats the condition of the previous notice.
Diffusing the requirement to provide notice
This provision diffuses the requirement to provide notice.
23(3) Notice of decision of changes to conditions on accreditation
Notice of decision on accreditation condition changes
(a) state the condition or the variation, or state that the condition is revoked; and (b) state the day on which the condition, variation or revocation takes effect.
Specifies effective date of accreditation change
(b) state the day on which the condition, variation or revocation takes effect.
24 Varying accreditation
May vary accreditation of an accredited entity to account for a change in the entity's name.
Implies obligation to vary accreditation.
25 Suspension of accreditation
25(1) Suspension of accreditation
Suspension of accreditation upon direction from the Digital ID Regulator
Prohibits suspension of accreditation without direction from the Digital ID Regulator
(1) The Digital ID Regulator must, in writing, suspend the accreditation of an accredited entity if a direction under subsection 27(1) directing the Digital ID Regulator to do so is in force in relation to the entity.
Justifies prohibition of suspension of accreditation upon direction from the Digital ID Regulator
Implies that suspension of accreditation without direction from the Digital ID Regulator is prohibited
25(2) Suspension of accreditation
Suspension of accreditation for contravention or cyber security incident
26 Revocation of accreditation
26(1) Revocation of accreditation
Revocation of accreditation on Minister's direction
Prohibits revocation without Minister's direction
Minister gives direction under subsection 27(1)
26(2) Revocation of accreditation
Revocation of accreditation for contravention or serious cyber security incident
Digital ID Regulator may revoke accreditation
26(3) Revocation of accreditation
Consideration of an entity's fit and proper person status in accreditation determination.
26(4) Revocation of accreditation
(4) Subsection (3) does not limit paragraph (2)(d)
26(5) Revocation of accreditation
Must revoke accreditation on application
26(6) Revocation of accreditation
Digital ID Regulator determines revocation day and approval revocation
26(7) Revocation of accreditation
Prohibits revoking accreditation approval
(7) If an entity's accreditation is revoked under subsection (1), (2) nor (5); and the entity holds an approval to participate in the Australian Government Digital ID System;
the Digital ID Regulator must at the same time revoke the entity's approval to participate as an accredited entity.
(7) If: (a) an entity’s accreditation is revoked under subsection (1), (2) or (5); and (b) the entity holds an approval to participate in the Australian Government Digital ID System;
Spreads accreditation approval revocation
Recognizes accreditation approval revocation
27 Minister’s directions regarding accreditation
27(1) Minister’s directions regarding accreditation
Minister may refuse accreditation, impose conditions, suspend or revoke accreditation.
27(2) Minister’s directions regarding accreditation
Comply with Minister's direction regarding accreditation.
27(3) Minister’s directions regarding accreditation
The Minister must notify the Digital ID Regulator and the entity if the direction is revoked.
The direction remains in force unless it is revoked by the Minister.
27(4) Minister’s directions regarding accreditation
(4) Despite subsection (3), a direction given under subsection (1) to revoke the accreditation of an accredited entity cannot be revoked.
27(5) Minister’s directions regarding accreditation
A direction given under this section is not a legislative instrument.
28 Accreditation Rules
28(1) Accreditation Rules
28(2) Accreditation Rules
Entities must meet specific requirements to become and remain accredited.
Entities must comply with the Accreditation Rules.
(2) Without limiting subsection (1), the Accreditation Rules may deal...
Entities must meet requirements before and after becoming accredited.
29 Digital IDs must be deactivated on request
29(1) Digital IDs must be deactivated on request
Digital IDs must be deactivated on request upon request from an accredited identity service provider.
Digital IDs must be deactivated on request.
29(2) Digital IDs must be deactivated on request
29(3) Digital IDs must be deactivated on request
Digital ID must not be used for verifying identity or authenticating digital ID.
Prohibits use of digital ID for specified purposes.
30 Accredited services must be accessible and inclusive
30(1) Accredited services must be accessible and inclusive
Accredited services must be accessible and inclusive
30(2) Accredited services must be accessible and inclusive
Accredited entities must comply with accessibility standards and guidelines.
Compliance with accessibility standards and guidelines
31 Prohibition on holding out that an entity is accredited
Prohibition on holding out that an entity is accredited
32 Simplified outline of this Chapter
Data profiling of online behavior is prohibited.
Expresses prohibition or negation of an obligation.
33 Chapter applies to accredited entities only to extent entity is
Chapter applies only to accredited entities providing accredited services.
34 APP-equivalent agreements
34(1) APP-equivalent agreements
Prohibits entity from collecting, holding, using or disclosing personal information that would breach Australian Privacy Principle.
Imposes a duty on the entity to not collect, hold, use or disclose personal information.
(2) The entity is covered by subsection (2)
(1) The Minister may enter into an agreement that prohibits the entity from collecting...
Defines the temporal interval for which the prohibition applies
The prohibition applies to all times after the commencement of the APP-equivalent agreement
Defines a recurring trace for the prohibition
The prohibition is repeated every time the entity collects, holds, uses or discloses personal information
Classifies entities as being covered by subsection (2)
The entity is an artificial agent or natural person
Defines the schema for the APP-equivalent agreement
The agreement must include provisions for protecting personal information
34(2) APP-equivalent agreements
List of entities that are departments or authorities of a State or Territory
34(3) APP-equivalent agreements
Provide a copy of an APP-equivalent agreement to the Information Commissioner within 14 days.
Must provide a copy of an APP-equivalent agreement to the Information Commissioner within 14 days.
35 Extended meaning of personal information in relation to
Attributes of individuals in possession or control of accredited entities are considered personal information.
Attributes are taken as personal information.
Meaning is mirrored from the Privacy Act 1988.
35A Small business operator that is an accredited entity
35A(1) Small business operator that is an accredited entity
Applying Privacy Act to small business operators as if they were organisations.
35A(2) Small business operator that is an accredited entity
36 Privacy obligations for non-APP entities
36(1) Privacy obligations for non-APP entities
Accredited entities not APP entities must comply with privacy obligations.
36(2) Privacy obligations for non-APP entities
Entity must comply with Privacy Act 1988 or State/Territory law for personal information protection.
Entity must comply with Privacy Act 1988 or State/Territory law.
37 Contraventions of privacy obligations in APP-equivalent
Entity with APP-equivalent agreement must comply with privacy obligations.
38 Contraventions of Division 2 and section 136 are interferences
38(1) Contraventions of Division 2 and section 136 are interferences
Interference with privacy is prohibited.
38(2) Contraventions of Division 2 and section 136 are interferences
Entity must respond to complaint under Privacy Act 1988
38(3) Contraventions of Division 2 and section 136 are interferences
Entity must be considered an organisation if it is subject to a complaint or investigation under Part V of the Privacy Act 1988.
Entity is considered an organisation if it meets the conditions.
The entity must be taken to be an organisation if...
...it is subject to a complaint or investigation under Part V of the Privacy Act 1988.
Entity is considered an organisation until it meets the conditions.
Entity must meet the conditions to be considered an organisation.
Entity must not meet the conditions to be considered an organisation.
Entity must be taken to be an organisation if it meets the conditions.
38(4) Contraventions of Division 2 and section 136 are interferences
39 Notification of eligible data breaches—accredited entities that are
39(1) Notification of eligible data breaches—accredited entities that are
Accredited entities must notify the Information Commissioner of eligible data breaches.
39(2) Notification of eligible data breaches—accredited entities that are
Entity must notify Digital ID Regulator and Information Commissioner of data breaches.
40 Notification of eligible data breaches—accredited entities that are
40(1) Notification of eligible data breaches—accredited entities that are
Notification of eligible data breaches—accredited entities that are not APP entities.
40(2) Notification of eligible data breaches—accredited entities that are
Exemptions for State and Territory departments/authorities from notification of data breaches.
Exemptions from notification obligations
40(3) Notification of eligible data breaches—accredited entities that are
Applicable provisions of the Privacy Act 1988 apply to accredited entities.
40(4) Notification of eligible data breaches—accredited entities that are
Entity must notify Digital ID Regulator of data breach
copy of statement to Information Commissioner
41 Notification of corresponding data breaches—accredited State or
41(1) Notification of corresponding data breaches—accredited State or
Entity must provide notification of data breaches to another entity.
Entity has a duty to provide notification.
(a) the entity is not an APP entity; and (b) the entity is a department or authority of a State or Territory;
Entity must notify within a certain timeframe.
(d) the statement relates to the accredited services of the entity;
The notification must be provided within a certain timeframe.
Entity must comply with notification requirements.
41(2) Notification of corresponding data breaches—accredited State or
Entity must notify regulator and commissioner of data breaches.
Temporal relation between notification and data breach
(2) The entity must also give a copy of the statement to the Digital ID Regulator and the Information Commissioner at the same time as the statement is given to the notified entity.
Notification spreads to regulator and commissioner
Notification validates regulator and commissioner
42 Additional function of the Information Commissioner
The Information Commissioner must provide advice on matters relating to the operation of this Act upon request by the Digital ID Regulator.
The Information Commissioner must provide advice.
43 Information Commissioner may share information
Sharing of information by Information Commissioner
44 Collection of certain attributes of individuals is prohibited
44(1) Collection of certain attributes of individuals is prohibited
Prohibition on collecting certain attributes of individuals
Prohibits collection of specified attributes
(1) An accredited entity must not collect...
44(2) Collection of certain attributes of individuals is prohibited
Prohibition on collecting certain attributes of individuals without destruction
Prohibits collection of certain attributes
44(3) Collection of certain attributes of individuals is prohibited
Collection of certain attributes is prohibited, but permitted attributes can be collected if not primarily of the kind described in subsection (1)
44(4) Collection of certain attributes of individuals is prohibited
Prohibition on soliciting attributes of individuals
solicits: an accredited entity solicits an attribute of an individual if...
45 Individuals must expressly consent to disclosure of certain
Must provide explicit consent for disclosure of certain attributes.
46 Disclosure of restricted attributes of individuals
46(1) Disclosure of restricted attributes of individuals
Must not disclose restricted attributes without consent.
Prohibits disclosure of restricted attributes.
46(2) Disclosure of restricted attributes of individuals
Do not disclose restricted attributes to non-participating relying parties
47 Restricting disclosure of unique identifiers
47(1) Restricting disclosure of unique identifiers
Disclosing unique identifiers is restricted.
Restricting disclosure of unique identifiers.
47(2) Restricting disclosure of unique identifiers
Prohibits disclosure of unique identifiers
(2) The assigning entity must not disclose...
Prohibits disclosure of unique identifiers to relying parties
if the unique identifier was disclosed to a relying party—the relying party.
47(3) Restricting disclosure of unique identifiers
Must not disclose unique identifier to any other entity.
(3) The accredited entity to whom the unique identifier is disclosed must not disclose the unique identifier to any other entity.
The accredited entity must not disclose the unique identifier to any other entity.
The restriction applies only during the accreditation period.
The restriction prevents the spread of information about the unique identifier.
The restriction limits the knowledge of the accredited entity.
47(4) Restricting disclosure of unique identifiers
Disclosure of unique identifiers is permitted for specific purposes.
Permission to disclose unique identifiers.
47(5) Restricting disclosure of unique identifiers
Disclosure of unique identifiers is permitted for contractors engaged by the accredited entity.
47(6) Restricting disclosure of unique identifiers
A person who wishes to rely on this subsection bears an evidential burden.
48 Restrictions on collecting, using and disclosing biometric
Authorized entities must obtain consent before collecting, using or disclosing biometric information.
Authorized entities must obtain consent.
49 Authorised collection, use and disclosure of biometric
49(1) Authorised collection, use and disclosure of biometric
Accredited entities may collect, use or disclose biometric information under certain conditions.
Accredited entities are permitted to collect, use or disclose biometric information.
(a) the accredited entity’s conditions on accreditation authorise the collection, use, or disclosure of the biometric information;
The accredited entity is permitted to collect, use or disclose biometric information.
Biometric information must be used for verifying identity or authenticating digital ID.
(b) the biometric information of the individual is collected, used or disclosed for the purposes of the accredited entity doing neither or both of the following:
The biometric information must be used for verifying identity or authenticating digital ID.
Biometric information collection and use must overlap with accreditation conditions.
The biometric information collection and use must overlap with accreditation conditions.
Biometric information collection and use are valid until accreditation conditions expire.
The biometric information collection and use are valid until accreditation conditions expire.
Biometric information must be contained within accredited entity’s conditions.
The biometric information must be contained within accredited entity’s conditions.
49(2) Authorised collection, use and disclosure of biometric
Authorized collection, use and disclosure of biometric information under certain conditions.
Permission to collect, use or disclose biometric information.
(a) the biometric information is contained in a verifiable credential that is in the individual’s control;
Biometric information within a verifiable credential.
Collection, use or disclosure until requirements are met.
(b) the Accreditation Rules prescribe requirements relating to the collection, use or disclosure of the biometric information;
Requirements for collection, use or disclosure.
(c) the collection, use or disclosure complies with those requirements.
49(3) Authorised collection, use and disclosure of biometric
Disclosure of biometric information is permitted to law enforcement agencies under certain conditions.
Permission granted by the State to law enforcement agencies.
49(4) Authorised collection, use and disclosure of biometric
Despite certain laws, the subsection applies.
49(5) Authorised collection, use and disclosure of biometric
Authorisation for disclosure of biometric information
Permission to disclose biometric information
Authorization for disclosure of biometric information
(5) An accredited entity is authorised to disclose biometric information of an individual if the disclosure is to the individual to whom the biometric information relates.
Processing of biometric information for disclosure
49(6) Authorised collection, use and disclosure of biometric
Accredited entity may retain, use or disclose biometric information for testing purposes.
(6) An accredited entity is authorised to...
...retain, use or disclose biometric information of an individual.
49A Biometric information, testing and continuous improvement
49A(1) Biometric information, testing and continuous improvement
Accredited entities must retain, use or disclose biometric information under certain conditions.
Accredited entities must retain, use or disclose biometric information.
49A(2) Biometric information, testing and continuous improvement
Accredited entity must continuously improve biometric systems to prevent discrimination.
Obligation to improve biometric systems.
50 Accredited entities may collect etc. biometric information for
50(1) Accredited entities may collect etc. biometric information for
Accredited entities must collect biometric information for identity verification if they have verified its legitimacy.
50(2) Accredited entities may collect etc. biometric information for
Entities may collect biometric information for issuing documents with consented personal info.
Permission to collect biometric information
51 Destruction of biometric information of individuals
51(1) Destruction of biometric information of individuals
Destroy biometric information immediately after verification is complete.
Prohibits destruction of biometric information.
51(2) Destruction of biometric information of individuals
Destroy biometric information after authentication is complete.
51(3) Destruction of biometric information of individuals
Accredited entity must destroy biometric information after consent withdrawal.
Accredited entity must destroy biometric information.
(3) Subject to subsections (4) and (5), if...
Biometric information destruction timing.
(c) the individual withdraws their consent;
51(4) Destruction of biometric information of individuals
Destroy biometric information after testing completion
52 Other rules relating to biometric information
52(1) Other rules relating to biometric information
Accredited entities must comply with biometric information rules.
Temporal interval for biometric information collection.
52(2) Other rules relating to biometric information
Accreditation Rules may provide for requirements relating to quality, security or fraud.
53 Data profiling to track online behaviour is prohibited
53(1) Data profiling to track online behaviour is prohibited
Data profiling for tracking online behavior is prohibited.
Prohibits data profiling for tracking online behavior.
(1) An accredited entity must not use or disclose information if:
53(2) Data profiling to track online behaviour is prohibited
53(3) Data profiling to track online behaviour is prohibited
Data profiling for broader business purposes is prohibited.
Prohibits data profiling for broader business purposes.
54 Certain personal information must not be used or disclosed for
Personal information must not be used or disclosed for enforcement purposes unless certain conditions are met.
Prohibition on using or disclosing personal information for enforcement purposes.
The entity must not use or disclose the information.
The use or disclosure of personal information must overlap with the start of proceedings against a person.
At the time the information is used or disclosed, the accredited entity is satisfied that the enforcement body has started proceedings...
Against a person for an offence against a law of the Commonwealth, a State or a Territory.
The use or disclosure of personal information must be until the start of proceedings against a person.
Against a person in relation to a breach of a law imposing a penalty or sanction.
The use or disclosure of personal information must diffuse into the start of proceedings against a person.
The use or disclosure of personal information must be cognizable by AI.
55 Personal information must not be used or disclosed for
55(1) Personal information must not be used or disclosed for
Personal information must not be used or disclosed for specified purposes.
Prohibition of using personal information.
(1) An accredited entity must not use or disclose...
55(2) Personal information must not be used or disclosed for
Disclosure of personal information for advertising or promoting accredited services is permitted with individual consent.
Prohibition on disclosure without consent
(2) Subsection (1) does not apply to the disclosure of personal information about an individual
56 Accredited identity exchange providers must not retain certain
Accredited identity exchange providers must not retain certain attributes of individuals
57 Simplified outline of this Chapter
Entity must meet criteria to participate, including holding approval from Digital ID Regulator.
Participating in Australian Government Digital ID System is subject to conditions.
Entity must hold approval from Digital ID Regulator.
An entity's approval to participate in the Australian Government Digital ID System can also be suspended.
Digital ID Regulator may suspend entity's approval.
Only certain kinds of accredited entities and relying parties can apply to the Digital ID Regulator to participate, and specified criteria must be met before the Digital ID Regulator gives an approval.
Digital ID Regulator may give directions to Minister regarding entity's approval
The Minister may give directions to the Digital ID Regulator regarding the approval of an entity to participate in the Australian Government Digital ID System if, for reasons of security.
Minister may direct Digital ID Regulator on entity's approval.
58 Digital ID Regulator must oversee and maintain the Australian
58(1) Digital ID Regulator must oversee and maintain the Australian
The Digital ID Regulator must oversee and maintain a digital ID system.
Obligation to oversee and maintain a digital ID system.
58(2) Digital ID Regulator must oversee and maintain the Australian
The Digital ID Regulator must oversee and maintain the Australian digital ID system.
The Digital ID System is a subclass of the digital ID system overseen by the Digital ID Regulator.
59 Circumstances in which entities may provide or receive services
Entities may provide or receive services within the Australian Government Digital ID System if they satisfy certain requirements.
Participation start day for attribute service provider must have arrived or passed.
Attribute service provider is mentioned in column 1 of the table.
Entity must hold an approval under section 62 to participate in the system.
Entity must be an accredited attribute service provider.
60 Phasing-in of participation in the Australian Government Digital
60(1) Phasing-in of participation in the Australian Government Digital
Entities may apply for approval to participate in the Australian Government Digital ID System.
The determination may specify entities by temporal interval.
60(2) Phasing-in of participation in the Australian Government Digital
Entities must be specified in a certain way when participating in the Australian Government Digital
The determination may specify entities by reference to kinds of accredited entities
Entity types must be specified within a certain temporal interval
(2) The determination may specify entities in any way
Entities must be specified according to the determination
60(3) Phasing-in of participation in the Australian Government Digital
Minister must not revoke determination and may vary it under certain conditions.
Minister may vary the determination under certain conditions.
(i) specify additional kinds of entities that may apply; or (ii) correct an error, defect or irregularity in the determination.
Varying the determination is allowed during a specific period.
Varying the determination is allowed through a process of correction and specification.
61 Applying for approval to participate in the Australian
Approval required for participation in Australian Government Digital ID System
62 Approval to participate in the Australian Government Digital ID
62(1) Approval to participate in the Australian Government Digital ID
Approval to participate in the Australian Government Digital ID System
Digital ID Regulator must approve entity to participate in the Australian Government Digital ID System
(a) the entity has made an application under section 61; and (b) unless the entity is a relying party—the entity is an accredited entity;
The Digital ID Regulator must approve the entity.
Entity must comply with Digital ID Data Standards
(c) the Digital ID Regulator is satisfied that the entity will comply with the Digital ID Data Standards that apply in relation to the entity and that relate to participation in the Australian Government Digital ID System;
The entity must comply with the Digital ID Data Standards.
Entity has been assessed as being able to comply with this Act
(d) if the Digital ID Regulator makes a requirement under paragraph 131(1)(a) in relation to the entity—the entity has been assessed as being able to comply with this Act;
The entity has been assessed as being able to comply with this Act.
Digital ID Regulator must be satisfied that it is appropriate to approve the entity
(e) the Digital ID Regulator is satisfied that it is appropriate to approve the entity to participate in the system;
The Digital ID Regulator must be satisfied that it is appropriate to approve the entity.
Entity must meet other requirements prescribed by the Digital ID Rules
(f) any other requirements prescribed by the Digital ID Rules are met;
The entity must meet other requirements prescribed by the Digital ID Rules.
62(2) Approval to participate in the Australian Government Digital ID
Consideration of matters when approving entity participation in Australian Government Digital ID
(a) whether the entity is a fit and proper person;
the Digital ID Regulator must have regard to...
(2) Without limiting paragraph (1)(e), the Digital ID Regulator may have regard to...
the entity is not appropriate for approval
the entity is not considered for approval
62(3) Approval to participate in the Australian Government Digital ID
Prescribes requirements for the security, reliability and stability of the Australian Government Digital ID System.
Requires security, reliability and stability
The Digital ID Rules may prescribe requirements...
62(4) Approval to participate in the Australian Government Digital ID
Refusal of approval to participate in the Australian Government Digital ID System
Digital ID Regulator cannot approve entity
(4) However, the Digital ID Regulator must not approve an entity to participate in the Australian Government Digital ID System if a direction under subsection 73(1) (about security) directing the Digital ID Regulator to refuse to approve the entity is in force.
The Digital ID Regulator must not approve the entity
Security direction overlaps with approval process
The security direction overlaps with the approval process
Security direction until approval decision
The approval decision will be made after the security direction expires
Digital ID Regulator must not approve entity
The Digital ID Regulator cannot approve the entity
62(5) Approval to participate in the Australian Government Digital ID
The Digital ID Regulator must approve participation in the Australian Government Digital ID System.
63 Approval to participate in the Australian Government Digital ID
63(1) Approval to participate in the Australian Government Digital ID
Approval conditions for participating in the Australian Government Digital ID System
63(2) Approval to participate in the Australian Government Digital ID
Comply with approval conditions for participating in the Australian Government Digital ID System.
64 Conditions on approval to participate in the Australian
64(1) Conditions on approval to participate in the Australian
Entity must comply with Act and conditions imposed by Digital ID Regulator.
Entity must be accredited to participate in the system.
(a) unless the entity is a relying party—the entity must be an accredited entity;
participate only as the kind of accredited entity it is accredited as and approved to participate as
Entity must provide specific services in the system.
(b) if the entity is an accredited entity: (i) the entity must participate in the Australian Government Digital ID System only as the kind of accredited entity it is accredited as and approved to participate as;
begin on the entity’s participation start day
Entity must start participating at a specific time.
(c) the entity must begin to participate in the Australian Government Digital ID System on the entity’s participation start day;
(d) the entity must comply with this Act.
64(2) Conditions on approval to participate in the Australian
Conditions on approval to participate in the Australian Government Digital ID System
65 Conditions relating to restricted attributes of individuals
65(1) Conditions relating to restricted attributes of individuals
Prohibition on collecting or disclosing restricted attributes without approval
entity may not collect or disclose restricted attribute
65(2) Conditions relating to restricted attributes of individuals
Entity must provide justification for collecting or disclosing restricted attribute.
(a) whether the entity has provided sufficient justification for the need to collect or disclose the restricted attribute;
66 Variation and revocation of conditions
66(1) Variation and revocation of conditions
The Digital ID Regulator may vary or revoke conditions imposed on an entity's approval.
66(2) Variation and revocation of conditions
Consider matters relating to security, reliability and stability when varying or revoking conditions.
Consider matters relating to security, reliability and stability.
(2) Without limiting subsection (1), the Digital ID Regulator may have regard to matters relating to the security, reliability and stability of the Australian Government Digital ID System when considering whether it is appropriate to vary or revoke a condition.
Consider matters relating to security, reliability and stability at specific times.
66(3) Variation and revocation of conditions
Must revoke a condition imposed under paragraph 64(2)(b) if the direction to impose the condition is revoked.
The Digital ID Regulator must revoke a condition...
...if the direction to impose the condition is revoked.
The Digital ID Regulator must revoke a condition imposed under paragraph 64(2)(b) if...
...the direction to impose the condition is revoked.
67 Applying for variation or revocation of conditions on approval
May apply for variation or revocation of conditions on approval
Entity can apply for variation or revocation of conditions on approval
68 Notice before changes to conditions on approval
68(1) Notice before changes to conditions on approval
Entity must be given written notice before changes to conditions on approval.
Digital ID Regulator cannot impose conditions without notice.
68(2) Notice before changes to conditions on approval
Request for written statement from entity regarding proposed condition, variation or revocation.
68(3) Notice before changes to conditions on approval
Consider written statements before making a decision to impose or vary conditions on approval.
Consider written statements before making a decision.
68(4) Notice before changes to conditions on approval
Exemption from notice requirement under urgent circumstances
The need to impose, vary or revoke the condition is serious and urgent.
Temporal interval for 'serious and urgent'
Diffusion of information about exemptions
68(5) Notice before changes to conditions on approval
Entity must receive written statement of reasons from Digital ID Regulator.
68(6) Notice before changes to conditions on approval
Statement of reasons must be provided within 7 days after condition change.
Obligation to provide statement of reasons.
69 Notice of decision of changes of conditions on approval
69(1) Notice of decision of changes of conditions on approval
Entity must receive written notice of decision on conditions.
69(2) Notice of decision of changes of conditions on approval
No notice required if previous condition notice was given
Notice of condition given under subsection 62(5)
69(3) Notice of decision of changes of conditions on approval
Notice of decision of changes of conditions on approval must be provided
70 Varying approval to participate in the Australian Government
May vary approval given to an entity under section 62 to take account of a change in the entity’s name.
71 Suspension of approval to participate in the Australian
71(1) Suspension of approval to participate in the Australian
Suspension of approval to participate in the Australian Digital ID system
Prohibits participation in the Australian Digital ID system
71(2) Suspension of approval to participate in the Australian
(2) The Digital ID Regulator may, in writing...
Temporal intervals for cyber security incidents
(ii) there has been a cyber security incident involving the entity;
71(3) Suspension of approval to participate in the Australian
Consideration of an entity's fit and proper person status when determining approval to participate in the Australian Digital ID system.
Consideration of an entity's fit and proper person status.
...an entity is a fit and proper person.
71(4) Suspension of approval to participate in the Australian
Digital ID Regulator may suspend approval on application
(4) Subsection (3) does not limit paragraph (2)(e)
Implication of subsection (3) on paragraph (2)(e)
Temporal relationship between subsection (3) and paragraph (2)(e)
71(5) Suspension of approval to participate in the Australian
May suspend approval to participate in the Australian Digital ID system.
71(6) Suspension of approval to participate in the Australian
Notice requirement before suspending approval
71(7) Suspension of approval to participate in the Australian
Entity must provide written statement within 28 days after notice is given.
72 Revocation of approval to participate in the Australian
72(1) Revocation of approval to participate in the Australian
Revocation of approval to participate in the Australian Digital ID system
Prohibits revocation of approval without Minister's direction
(1) The Digital ID Regulator must, in writing, revoke an approval given to an entity under section 62 if the Minister gives a direction under subsection 73(1) to do so.
The Digital ID Regulator may not revoke approval without the Minister's direction
Defines temporal interval for revocation of approval
The revocation of approval occurs within a specific temporal interval
Establishes recurring trace for Digital ID Regulator's actions
The Digital ID Regulator's actions create a recurring trace for revocation of approval
Establishes obligation on Digital ID Regulator to revoke approval
The Digital ID Regulator has an obligation to revoke approval upon receipt of Minister's direction
Establishes implication between Minister's direction and revocation of approval
The Minister's direction implies revocation of approval
72(2) Revocation of approval to participate in the Australian
Prohibition of participation in the Australian Digital ID System
Digital ID Regulator may revoke approval
Temporal interval for revocation of approval
73 Minister’s directions regarding participation
73(1) Minister’s directions regarding participation
Minister may refuse, impose conditions on, or revoke approval of an entity to participate in the Australian Government Digital ID System.
73(2) Minister’s directions regarding participation
Comply with Minister's direction regarding participation.
73(3) Minister’s directions regarding participation
(3) The direction remains in force unless it is revoked by the Minister.
Revocation requires notification to regulator and entity
The Minister must notify the Digital ID Regulator and the entity if the Minister revokes the direction.
If the Minister revokes the direction, then the Minister must notify the Digital ID Regulator and the entity.
The direction is valid during its duration.
The direction ends at the time of its revocation.
Revocation requires action from Minister
The Minister must take action to revoke the direction.
73(4) Minister’s directions regarding participation
Cannot revoke approval of entity participation in Australian Government Digital ID System
73(5) Minister’s directions regarding participation
Direction is not a legislative instrument.
74 Creating and using a digital ID is voluntary
74(1) Creating and using a digital ID is voluntary
Participating relying party must not require individual to create or use digital ID.
Note: Participating relying party must provide another means of accessing service that does not involve creation or use of digital ID.
Classifies service as not requiring digital ID.
74(1A) Creating and using a digital ID is voluntary
Participating relying party must use digital ID through Australian Government Digital ID System
Prohibits using non-digital ID for service provision
(1A) A participating relying party is taken to contravene subsection (1)
74(2) Creating and using a digital ID is voluntary
Exemption from digital ID requirement for certain services
Allows participating relying party to provide service without digital ID
(a) the service provides access to another service; and (b) the individual can access the other service by means other than the creation or use of a digital ID through the Australian Government Digital ID System;
(c) the other means is reasonably accessible;
75 Restriction on collection of restricted attributes of individuals by
Cannot collect restricted attributes without approval
Prohibition on collecting restricted attributes
76 Notice before exemption is revoked
76(1) Notice before exemption is revoked
76(2) Notice before exemption is revoked
77 Holding etc. information outside Australia
77(1) Holding etc. information outside Australia
The Digital ID Rules may make provision in relation to the holding, storing, handling or transfer of information outside Australia.
Describes the temporal relationship between entities
(1) The Digital ID Rules may make provision in relation to...
...the holding, storing, handling or transfer of information outside Australia.
Establishes a condition for the provision
77(2) Holding etc. information outside Australia
Prohibits holding, storing, handling or transferring of information outside Australia.
(a) prohibit (either absolutely or unless particular circumstances are met or conditions are complied with)
Prohibition applies during specified circumstances
77(3) Holding etc. information outside Australia
Failure to comply with Digital ID Rules results in civil penalty.
Prohibits failure to comply with Digital ID Rules.
(a) the entity is subject to a requirement under the Digital ID Rules made for the purposes of subsection (1); and (b) the entity fails to comply with the requirement.
An entity is liable to a civil penalty if: (a) the entity is subject to a requirement under the Digital ID Rules made for the purposes of subsection (1); and (b) the entity fails to comply with the requirement.
Defines the temporal scope of civil penalty.
(3) An entity is liable to a civil penalty if: (a) the entity is subject to a requirement under the Digital ID Rules made for the purposes of subsection (1); and (b) the entity fails to comply with the requirement.
Defines the recurring nature of civil penalty.
Defines the scope of entities liable to civil penalty.
78 Reportable incidents
78(1) Reportable incidents
Prescribes arrangements for reporting and managing incidents related to the Australian Government Digital ID System.
78(2) Reportable incidents
Entities must notify reportable incidents and follow specific procedures
Notification of reportable incidents, information about incidents
79 Interoperability
79(1) Interoperability
Interoperability requirement within Australian Government Digital ID System
79(2) Interoperability
Interoperability obligation on participating relying parties and accredited entities.
Individuals with a choice of accredited identity service providers, Accredited services to other entities.
Obligation on participating relying parties and accredited entities.
Class hierarchy for accredited identity service providers and accredited services.
79(3) Interoperability
Specify circumstances for interoperability obligation
Classifies circumstances for interoperability obligation
80 Service levels for accredited entities and participating relying
May determine service levels for accredited entities and participating relying parties
81 Entities may conduct testing in the Australian Government
81(1) Entities may conduct testing in the Australian Government
Authorise entities to conduct testing in the Australian Government Digital ID System.
81(2) Entities may conduct testing in the Australian Government
Entities may conduct testing in the Australian Government
(2) The authorisation must be in writing; and (b) must specify the period for which it is in force, which must not exceed 3 months;
The authorisation may be granted unconditionally or subject to conditions.
Temporal interval during which authorisation is valid
(c) may be granted unconditionally or subject to conditions.
The authorisation is in force for a period not exceeding 3 months.
Temporal interval until which authorisation remains valid
Diffusion of information about testing authorisation
Note: The System Administrator may vary or revoke the authorisation: see subsection 33(3) of the Acts Interpretation Act 1901.
The System Administrator may vary or revoke the authorisation.
81(3) Entities may conduct testing in the Australian Government
Authorisation ceases if condition not met
82 Use and disclosure of personal information to conduct testing
82(1) Use and disclosure of personal information to conduct testing
Use and disclosure of personal information for testing purposes with consent.
Use of personal information for testing.
(a) the accredited entity uses or discloses the information for the purposes of conducting testing in the Australian Government Digital ID System;
the individual to whom the information relates has expressly consented to the use or disclosure of the information for that purpose.
Disclosure of personal information for testing.
(b) the accredited entity or another entity is authorised under section 81 to conduct the testing using the information;
Authorisation for testing under section 81.
Express consent for use and disclosure of personal information.
(c) the individual to whom the information relates has expressly consented to the use or disclosure of the information for that purpose.
Expressed consent for use and disclosure of personal information.
82(2) Use and disclosure of personal information to conduct testing
This section applies despite anything else in this Act.
Obligation to apply despite other provisions
83 Prohibition on holding out that an entity holds an approval
Prohibition on holding out that an entity holds an approval
Prohibits holding out that an entity holds an approval
84 Accredited entities participating in the Australian Government
84(1) Accredited entities participating in the Australian Government
Accredited entities are not liable for provision of services to other accredited entities or relying parties.
If an action is brought by another entity, then the first entity is not liable.
(a) The action or other proceeding is brought by the other entity or the participating relying party.
If subsections (1A) and (1B) apply, then the first entity is not liable.
The action or other proceeding is brought by the other entity or the participating relying party.
The provision defines a temporal interval for the action or proceeding.
(1) An action or other proceeding, whether civil or criminal, for or in relation to the provision or non-provision of an accredited service.
The provision defines a recurring trace for the action or proceeding.
The provision defines a duty for the first entity.
84(1A) Accredited entities participating in the Australian Government
Must provide accredited service in good faith and compliance with the Act.
Must provide service in good faith and compliance.
84(1B) Accredited entities participating in the Australian Government
Non-compliance with service levels is not the ground or cause for an action.
If non-compliance is not the ground or cause for an action, then it is not a breach.
The non-compliance is not a breach of the service level obligation.
The non-compliance overlaps with the action.
84(2) Accredited entities participating in the Australian Government
Entity bears evidential burden in relation to action or proceeding.
85 Statutory contract between entities participating in the
85(1) Statutory contract between entities participating in the
Accredited entities must provide services and comply with intellectual property rights.
Mandatory obligation on accredited entities.
Entities participating in the Australian Government Digital ID System are part of a class.
85(2) Statutory contract between entities participating in the
85(3) Statutory contract between entities participating in the
Application to the Federal Circuit and Family Court of Australia (Division 2) may be made if an accredited entity breaches the contract.
May make application to Federal Circuit and Family Court of Australia (Division 2)
(3) If an accredited entity breaches the contract, an application to the Federal Circuit and Family Court of Australia (Division 2) may be
Must make application to Federal Circuit and Family Court of Australia (Division 2)
During breach of contract, application to Federal Circuit and Family Court of Australia (Division 2) may be made
86 Participating entities to maintain insurance as directed by the
86(1) Participating entities to maintain insurance as directed by the
Directs accredited entities to maintain insurance against liabilities arising from section 85 obligations.
86(2) Participating entities to maintain insurance as directed by the
Condition imposed on entity's approval to participate in Australian Government Digital ID System
Entity's approval to participate in Australian Government Digital ID System
Condition imposed on participation approval
Digital ID Regulator gives direction to entity under subsection (1)
Entity's approval to participate in Australian Government Digital ID System is subject to condition
Participation approval implies compliance with insurance requirement
Entity under subsection (1) has approved participation in Australian Government Digital ID System
Entity must maintain insurance as directed by the Digital ID Regulator
Digital ID Regulator's direction influences entity's behavior
Entity must comply with insurance requirement
Participation approval requires compliance with insurance requirement
86(3) Participating entities to maintain insurance as directed by the
87 Dispute resolution procedures
Entities must comply with dispute resolution procedures before applying for an order.
Entities must comply with dispute resolution procedures.
88 Redress framework
88(1) Redress framework
Digital ID Rules must provide a redress framework within 12 months.
Obligation to provide a redress framework
88(2) Redress framework
procedures for dealing with incidents, requirements relating to notifying individuals affected by incidents
88(3) Redress framework
Entities must provide information about support services to the Digital ID Regulator.
89 Simplified outline of this Chapter
The Digital ID Regulator has certain functions, including to promote compliance with this Act.
The Digital ID Regulator has certain functions.
90 Digital ID Regulator
Establishes the Digital ID Regulator as the Australian Competition and Consumer Commission.
91 Functions of the Digital ID Regulator
92 Powers of the Digital ID Regulator
Power to perform functions under this Act
Ability to do things necessary or convenient
93 Simplified outline of this Chapter
The Minister may give general directions to the System Administrator.
94 System Administrator
The Chief Executive Centrelink is the System Administrator.
The Chief Executive Centrelink is assigned the role of System Administrator.
95 Functions of the System Administrator
96 Powers of the System Administrator
Power to perform necessary or convenient actions for system administration functions.
System Administrator has the power to perform necessary or convenient actions.
97 Directions to the System Administrator
97(1) Directions to the System Administrator
The Minister may give written directions to the System Administrator.
97(2) Directions to the System Administrator
A direction under subsection (1) must be of a general nature only.
(2) A direction under subsection (1) must be of a general nature only.
97(3) Directions to the System Administrator
System Administrator must comply with direction under subsection (1).
97(4) Directions to the System Administrator
A direction under subsection (1) is not a legislative instrument.
98 Simplified outline of this Chapter
Must consult Minister and invite public comments before making, amending or revoking Digital ID Data Standards.
Must consult Minister and invite public comments.
99 Digital ID Data Standards
99(1) Digital ID Data Standards
May make standards about technical integration requirements, design features, and accreditation standards.
99(2) Digital ID Data Standards
Digital ID Data Standards may provide differently for different kinds of entities, things or circumstances.
99(3) Digital ID Data Standards
Digital ID Data Standards must be consistent with Accreditation Rules to the extent possible.
Digital ID Data Standards must be consistent with Accreditation Rules.
(3) Digital ID Data Standards that are inconsistent with the Accreditation Rules have no effect to the extent of the inconsistency.
Digital ID Data Standards are taken to be consistent with the Accreditation Rules to the extent that Digital ID Data Standards are capable of operating concurrently with the Accreditation Rules.
Digital ID Data Standards can operate concurrently with Accreditation Rules.
(3) Digital ID Data Standards that are inconsistent with the Accreditation Rules have no effect to the extent of the inconsistency, but Digital ID Data Standards are taken to be consistent with the Accreditation Rules to the extent that Digital ID Data Standards are capable of operating concurrently with the Accreditation Rules.
99(4) Digital ID Data Standards
Digital ID Data Standards are legislative instruments.
Section 42 (disallowance) does not apply to Digital ID Data Standards.
100 Requirement to consult before making
Consultation requirement before making, amending or revoking Digital ID Data Standards
101 Digital ID Data Standards Chair
Establishment of Digital ID Data Standards Chair
102 Functions of the Digital ID Data Standards Chair
Functions of the Digital ID Data Standards Chair
to make Digital ID Data Standards; and to review those standards regularly;
such other functions as are conferred on the Chair by this Act;
103 Powers of the Digital ID Data Standards Chair
Establishment of committees, advisory panels and consultative groups.
104 Directions to the Digital ID Data Standards Chair
104(1) Directions to the Digital ID Data Standards Chair
The Minister may give written directions to the Digital ID Data Standards Chair.
104(2) Directions to the Digital ID Data Standards Chair
105 Appointment
105(1) Appointment
The Minister must appoint the Digital ID Data Standards Chair.
105(2) Appointment
106 Term of appointment
Term of appointment must not exceed 3 years.
107 Acting appointments
The Minister may appoint a person to act as Digital ID Data Standards Chair.
108 Application of the finance law etc.
108(1) Application of the finance law etc.
The Digital ID Data Standards Chair is an official of the Department.
108(2) Application of the finance law etc.
Must include information about performance and exercise of Digital ID Data Standards Chair's functions in annual report.
108(3) Application of the finance law etc.
Exempts Digital ID Data Standards Chair from certain provisions when the Minister is also the chair.
Exempts Digital ID Data Standards Chair from certain provisions.
Relates to the subclass of Digital ID Act 2024.
109 Remuneration
109(1) Remuneration
Chair must be paid remuneration determined by Remuneration Tribunal or prescribed legislative instrument
109(2) Remuneration
Chair must be paid allowances prescribed by legislative instrument
Chair has an obligation to be paid allowances
109(3) Remuneration
Minister may prescribe remuneration and allowances
109(4) Remuneration
Exemption from subsections (1) and (2) for the Digital ID Data Standards Chair while in office.
109(5) Remuneration
Prohibits application of subsections 7(9) and (13) to the office of the Digital ID Data Standards Chair.
109(6) Remuneration
Remuneration subject to the Remuneration Tribunal Act 1973
110 Leave of absence
Recreation leave entitlements determined by the Remuneration Tribunal
111 Outside work
No paid work outside office without Minister's approval
112 Resignation of appointment
112(1) Resignation of appointment
112(2) Resignation of appointment
Resignation takes effect on specified day
113 Termination of appointment
113(1) Termination of appointment
Minister may terminate appointment of Digital ID Data Standards Chair
113(2) Termination of appointment
Termination of appointment under certain conditions
Digital ID Data Standards Chair must not be terminated under these conditions
114 Other terms and conditions
114(1) Other terms and conditions
Terms and conditions for the Digital ID Data Standards Chair's office
114(2) Other terms and conditions
The Digital ID Data Standards Chair is the Minister.
115 Arrangements relating to staff
115(1) Arrangements relating to staff
Temporal relation between staff arrangement and Chair's functions
(1) The staff assisting the Digital ID Data Standards Chair are to be:
115(2) Arrangements relating to staff
Staff are subject to the directions of the Chair.
116 Simplified outline of this Chapter
Using digital ID trustmark without authorization is prohibited.
Entity uses digital ID trustmark without authorization.
Temporal relation between entity's actions and penalties
Entity is liable to civil penalty if the entity uses digital ID trustmark without authorization.
Penalty applies when entity uses unauthorized trustmark.
Implication of failure to comply with requirements
Entity fails to display digital ID trustmark in circumstances specified in the Digital ID Rules.
Propagation of penalties through entity's actions
117 Digital ID trustmarks
117(1) Digital ID trustmarks
Specify one or more digital ID trustmarks that may or must be used by accredited entities.
117(2) Digital ID trustmarks
118 Authorised use of digital ID trustmarks etc.
118(1) Authorised use of digital ID trustmarks etc.
Entity must comply with conditions for using digital ID trustmark.
118(2) Authorised use of digital ID trustmarks etc.
Prohibition on using digital ID trustmark without authorization
Entity must not use digital ID trustmark
(2) An entity must not use a digital ID trustmark if the entity is not authorized under subsection (1)
118(3) Authorised use of digital ID trustmarks etc.
Do not use a digital ID trustmark so closely resembling an accredited entity or participating relying party.
Entity must not use a digital ID trustmark...
119 Displaying digital ID trustmark
Failure to display digital ID trustmark in specified circumstances
Prohibits failure to display digital ID trustmark
Entity is required to display digital ID trustmark
120 Digital ID Accredited Entities Register
120(1) Digital ID Accredited Entities Register
Establish and maintain a register of accredited entities.
120(2) Digital ID Accredited Entities Register
Must contain specific details for each accredited entity
120(3) Digital ID Accredited Entities Register
The Digital ID Accredited Entities Register may contain additional information.
120(4) Digital ID Accredited Entities Register
Entity removal from register after revocation and non-reaccreditation
Prohibition of entity's continued presence in register
(4) If an entity’s accreditation is revoked...
...the Digital ID Regulator must remove the entity from the Digital ID Accredited Entities Register.
Time interval for non-reaccreditation period
120(5) Digital ID Accredited Entities Register
Provision for correction of information in Digital ID Accredited Entities Register and other related matters.
120(6) Digital ID Accredited Entities Register
Publicly available Digital ID Accredited Entities Register
120(7) Digital ID Accredited Entities Register
The Digital ID Accredited Entities Register is not a legislative instrument.
121 AGDIS Register
121(1) AGDIS Register
Establish and maintain an AGDIS Register of approved entities.
Obligation to establish and maintain a register.
121(2) AGDIS Register
AGDIS Register must contain specific details for each entity.
The AGDIS Register must contain the specified details.
122 Simplified outline of this Chapter
Enforcement action and directions for accredited entities
123 Civil penalty provisions
123(1) Civil penalty provisions
Civil penalty provisions are enforceable under Part 4 of the Regulatory Powers Act.
Prohibits civil penalty provisions from not being enforced under Part 4 of the Regulatory Powers Act.
123(2) Civil penalty provisions
Authorise Digital ID Regulator and certain staff to make civil penalty applications.
123(3) Civil penalty provisions
List of relevant courts for civil penalty provisions
124 Infringement notices
124(1) Infringement notices
Each civil penalty provision is subject to an infringement notice.
124(2) Infringement notices
Infringement officers designated in the Regulatory Powers Act.
124(3) Infringement notices
Identifies chief executives for specific provisions.
Information Commissioner or Digital ID Regulator
125 Enforceable undertakings
125(1) Enforceable undertakings
Enforces civil penalty provisions under Part 6 of the Regulatory Powers Act.
Creates an obligation to enforce civil penalty provisions.
125(2) Enforceable undertakings
Authorises Information Commissioner and Digital ID Regulator as authorised persons for civil penalty provisions.
Information Commissioner and Digital ID Regulator are authorised persons.
125(3) Enforceable undertakings
List of courts that are relevant for enforcing publishing undertakings.
125(4) Enforceable undertakings
The Information Commissioner may publish an undertaking accepted by the Information Commissioner.
The Information Commissioner accepts an undertaking.
126 Injunctions
126(1) Injunctions
Each civil penalty provision of this Act is enforceable under Part 7 of the Regulatory Powers Act.
(1) Each civil penalty provision of this Act is enforceable under Part 7 of the Regulatory Powers Act.
This Act's civil penalty provisions are enforceable under Part 7 of the Regulatory Powers Act.
Part 7 of the Regulatory Powers Act creates a framework for using injunctions to enforce provisions.
This part creates a framework for using injunctions to enforce provisions.
This Act's civil penalty provisions are subject to enforcement under Part 7.
This Act's civil penalty provisions are subject to enforcement by the Regulatory Powers Act.
126(2) Injunctions
126(3) Injunctions
List of courts relevant for provisions in subsection (1)
127 Digital ID Regulator’s power to give directions to entities in
127(1) Digital ID Regulator’s power to give directions to entities in
The Digital ID Regulator may give an entity a direction to do or not do something.
The Digital ID Regulator may give an entity a direction.
127(2) Digital ID Regulator’s power to give directions to entities in
Entities must provide information and connect to the Australian Government Digital ID System by a specified date.
Prohibits entities from not providing information and connecting to the Australian Government Digital ID System.
128 Digital ID Regulator’s power to give directions to protect the
128(1) Digital ID Regulator’s power to give directions to protect the
The Digital ID Regulator may give a direction to protect the integrity or performance of the Australian Government Digital ID System.
128(2) Digital ID Regulator’s power to give directions to protect the
Digital ID Regulator may give directions to conduct specific assessments or take specified actions.
128(3) Digital ID Regulator’s power to give directions to protect the
Assessment must comply with Accreditation Rules requirements.
128(4) Digital ID Regulator’s power to give directions to protect the
Direction must be in writing and specify reason.
128(5) Digital ID Regulator’s power to give directions to protect the
Comply with direction given under subsection (1)
128(6) Digital ID Regulator’s power to give directions to protect the
129 Remedial directions to accredited entities etc.
129(1) Remedial directions to accredited entities etc.
Accredited entities must comply with the Act if believed to have contravened a provision.
129(2) Remedial directions to accredited entities etc.
Entity must take specified action to prevent future contravention of the provision.
Entity has an obligation to take specified action.
129(3) Remedial directions to accredited entities etc.
129(4) Remedial directions to accredited entities etc.
Must comply with direction given under subsection (2)
130 System Administrator’s power to give directions to protect the
130(1) System Administrator’s power to give directions to protect the
System Administrator has power to give directions to protect the Australian Government Digital ID System.
System Administrator has power to give directions.
Directions are given during system integrity or performance protection.
130(2) System Administrator’s power to give directions to protect the
System Administrator's power to give directions
130(3) System Administrator’s power to give directions to protect the
130(4) System Administrator’s power to give directions to protect the
System Administrator must give written directions with specified reason.
130(5) System Administrator’s power to give directions to protect the
Must comply with direction given by System Administrator.
130(6) System Administrator’s power to give directions to protect the
131 Compliance assessments
131(1) Compliance assessments
The Digital ID Regulator may require an entity to undergo a compliance assessment.
131(2) Compliance assessments
Entity must undertake compliance assessment within specified period.
Notice specifying period and method of assessment
Entity must undertake compliance assessment
131(3) Compliance assessments
Comply with notice within specified period.
131(4) Compliance assessments
Digital ID Rules may make provision for compliance assessments.
131(5) Compliance assessments
Entities must follow specific processes and provide information during compliance assessments.
Entities must follow specific processes and provide information.
131(6) Compliance assessments
132 Entities must provide assistance to persons undertaking
Entities must provide assistance to persons undertaking compliance assessments.
Entity has a duty to provide assistance.
133 Digital ID Regulator’s power to require information or
133(1) Digital ID Regulator’s power to require information or
The Digital ID Regulator may require information or documents from an entity.
The Digital ID Regulator may require information or documents.
133(2) Digital ID Regulator’s power to require information or
Entity must provide information or documents to Digital ID Regulator upon request.
Entity must provide information or documents.
133(3) Digital ID Regulator’s power to require information or
133(4) Digital ID Regulator’s power to require information or
Entity may be liable to civil penalty for non-compliance with notice.
133(5) Digital ID Regulator’s power to require information or
Comply with requirement within specified period and manner.
Information or documents as required by the notice.
133(6) Digital ID Regulator’s power to require information or
Entity must provide a reasonable excuse if required information is not provided.
Entity has an obligation to provide information.
134 System Administrator’s power to require information or
134(1) System Administrator’s power to require information or
Entity must provide information or documents relevant to the operation of the Australian Government Digital ID System.
134(2) System Administrator’s power to require information or
System Administrator may require entity to provide information or documents.
134(3) System Administrator’s power to require information or
A period specified in a notice must not be less than 28 days.
(3) A period specified in a notice under subsection (2)
must not be less than 28 days after the notice is given.
134(4) System Administrator’s power to require information or
Entity must comply with notice or face civil penalty
134(5) System Administrator’s power to require information or
134(6) System Administrator’s power to require information or
Entity must provide information with a reasonable excuse.
135 Record keeping by participating entities and former
135(1) Record keeping by participating entities and former
135(2) Record keeping by participating entities and former
Exemption from record keeping for relying parties
135(3) Record keeping by participating entities and former
Entity must keep records in a specified manner.
Records of the kind, for the period and in the manner prescribed by the Digital ID Rules.
135(4) Record keeping by participating entities and former
Records of a kind not related to information obtained through the Australian Government Digital ID System are prohibited.
Prohibition of records not related to the Australian Government Digital ID System
...of more than 7 years if specified circumstances apply.
Overlap of record retention periods with legal proceedings
(4) may only prescribe a period of retention...
...if specified circumstances apply in relation to the record.
Recurring trace of record retention periods with legal proceedings
Diffusion of record retention periods with legal proceedings
Inference of record retention periods with legal proceedings
136 Destruction or de-identification of certain information
Destruction or de-identification of certain information is required for accredited entities.
Duty to destroy or de-identify information
Temporal interval for destruction or de-identification
137 Reviewable decisions
A decision by the Digital ID Regulator is a reviewable decision.
The Digital ID Regulator has the power to make decisions.
The decision must occur during the accreditation process.
The accreditation process begins when an entity applies for accreditation.
If the Digital ID Regulator refuses to accredit an entity, then the entity is not accredited.
The Digital ID Regulator has the power to refuse accreditation.
The decision can only be made if the entity has applied for accreditation.
The entity must apply for accreditation before the Digital ID Regulator can make a decision.
The decision is a type of artificial intelligence decision.
The Digital ID Regulator uses artificial intelligence to make decisions.
138 Internal review of decisions
138(1) Internal review of decisions
Entity can apply for internal review of a decision made by a delegate.
Entity has the right to apply for internal review.
138(2) Internal review of decisions
Application for internal review must be made within 28 days after the decision first came to notice.
Application must be made within 28 days.
Obligation to apply for internal review within 28 days.
139 Reconsideration by decision-maker
139(1) Reconsideration by decision-maker
Decision-maker must review and decide on an application for internal review within 90 days.
139(2) Reconsideration by decision-maker
Decision-maker must provide written statement of reasons for decision.
139(3) Reconsideration by decision-maker
Delegate must not have been involved in making the original reviewable decision and hold a position or perform duties of a higher level than the delegate who made the original reviewable decision.
Delegate must not have been involved in making the original reviewable decision.
Delegate must hold a position or perform duties of a higher level than the delegate who made the original reviewable decision.
140 Review by the Administrative Review Tribunal
140(1) Review by the Administrative Review Tribunal
Applications for review of certain decisions can be made to the Administrative Review Tribunal.
140(2) Review by the Administrative Review Tribunal
Application must be made by or on behalf of an affected entity.
140(3) Review by the Administrative Review Tribunal
Review by the Administrative Review Tribunal
Despite section 17 of the Administrative Review Tribunal Act 2024.
Section 17 of the Administrative Review Tribunal Act 2024.
141 Requirements for applications
141(1) Requirements for applications
Digital ID Rules, Accreditation Rules, and fee (if applicable)
141(2) Requirements for applications
Acceptance of previously provided information as satisfying a requirement.
Classifies the provision as a permissive rule.
141(3) Requirements for applications
Approval may be given for different forms or a single form for multiple applications.
Different forms for different kinds of applications
A single form for more than one kind of application
142 Powers in relation to applications
142(1) Powers in relation to applications
Require applicant to provide further information or documents
142(2) Powers in relation to applications
Notice period for information or documents must be at least 14 days.
Information or documents within the specified period
Must provide information or documents within a specified period
143 Decisions not required to be made in certain circumstances
143(1) Decisions not required to be made in certain circumstances
No decision required if application is not in approved form.
143(2) Decisions not required to be made in certain circumstances
No decision is required until information or documents are provided.
143(3) Decisions not required to be made in certain circumstances
Decision on application delayed until information is provided.
Information or documents requested by the person requiring them.
143(4) Decisions not required to be made in certain circumstances
Digital ID Regulator not required to make decision until assessment is conducted.
143(5) Decisions not required to be made in certain circumstances
Pay fee before making a decision on an application.
144 Charging of fees by Digital ID Regulator etc.
144(1) Charging of fees by Digital ID Regulator etc.
Provision for charging fees by the Digital ID Regulator and others
144(2) Charging of fees by Digital ID Regulator etc.
144(3) Charging of fees by Digital ID Regulator etc.
No fee can be charged for creating or using a digital ID.
144(4) Charging of fees by Digital ID Regulator etc.
Fee prescribed by Digital ID Rules is payable to Commonwealth
Imposes a duty on Digital ID Regulator etc.
144(5) Charging of fees by Digital ID Regulator etc.
144(6) Charging of fees by Digital ID Regulator etc.
(6) A fee prescribed by the Digital ID Rules must not be such as to amount to taxation.
Fee will not amount to taxation eventually
144(7) Charging of fees by Digital ID Regulator etc.
Service need not be provided while fee remains unpaid
145 Review of fees
145(1) Review of fees
Minister must undertake periodic reviews of rules made for the purposes of subsection 144(1).
Obligation to undertake periodic reviews.
145(2) Review of fees
The first review of fees must start within 2 years and be completed within 12 months.
145(3) Review of fees
Subsequent reviews must be completed within 12 months.
(3) Subsequent reviews must start no later than every 2 years after the completion of the previous review; and be completed within 12 months.
Temporal interval for subsequent reviews
Subsequent reviews contain a temporal interval starting no later than every 2 years after the completion of the previous review
Subsequent reviews contain a temporal trace starting no later than every 2 years after the completion of the previous review
Subsequent reviews contain a diffusion starting no later than every 2 years after the completion of the previous review
Subsequent reviews contain a CogAI analysis starting no later than every 2 years after the completion of the previous review
145(4) Review of fees
Minister must provide written report on review of fees within 15 sitting days.
146 Recovery of fees charged by the Digital ID Regulator
Recovery of fees charged by the Digital ID Regulator
147 Commonwealth not liable to pay fees charged by entities that
147(1) Commonwealth not liable to pay fees charged by entities that
Commonwealth not liable to pay fees charged by entities that are part of the Commonwealth.
If a fee is payable under this Act, then the Commonwealth is liable to pay it.
(1) The Commonwealth is not liable to pay a fee that is payable under this Act to a part of the Commonwealth that is not a separate legal entity.
However, it is the Parliament’s intention that the Commonwealth should be notionally liable to pay such a fee.
The Commonwealth's liability for fees overlaps with its intention to be notionally liable.
The Commonwealth's liability for fees repeats with its intention to be notionally liable.
147(2) Commonwealth not liable to pay fees charged by entities that
The Finance Minister may give written directions for carrying out subsection (1)
147(3) Commonwealth not liable to pay fees charged by entities that
Commonwealth must comply with directions despite other laws.
147(4) Commonwealth not liable to pay fees charged by entities that
Directions under subsection (2) are not legislative instruments.
147(5) Commonwealth not liable to pay fees charged by entities that
Commonwealth not liable to pay fees charged by entities that
Include Commonwealth entities in definition of Commonwealth
Public Governance, Performance and Accountability Act 2013
Commonwealth entity within the meaning of the Act
Fees charged by entities during a specific period
Division 2, Fees charged by accredited entities
148 Charging of fees by accredited entities in relation to the
148(1) Charging of fees by accredited entities in relation to the
Accredited entities must charge fees in accordance with Digital ID Rules.
148(2) Charging of fees by accredited entities in relation to the
Accredited entities must charge fees for services related to the Australian Government Digital ID System.
148(3) Charging of fees by accredited entities in relation to the
Accredited entities may charge fees in relation to the Digital ID Rules.
148(4) Charging of fees by accredited entities in relation to the
148(5) Charging of fees by accredited entities in relation to the
Accredited entities can charge fees for their services.
149 Simplified outline of this Chapter
Minister may establish advisory committees.
Establishing advisory committees is an obligation.
150 Advisory committees
150(1) Advisory committees
Establish advisory committees as deemed necessary by the Minister.
Create an obligation to establish advisory committees.
150(2) Advisory committees
Minister determines composition of advisory committee.
Determining condition for advisory committee composition.
150(3) Advisory committees
Determine committee's terms of reference and appointment conditions.
Minister must determine committee's terms of reference and appointment conditions.
150(4) Advisory committees
An instrument made under subsection (1) or (3) is not a legislative instrument.
(4) An instrument made under subsection (1) or (3)
151 Prohibition on entrusted persons using or disclosing certain
151(1) Prohibition on entrusted persons using or disclosing certain
Prohibition on entrusted persons using or disclosing certain information.
Prohibits the use or disclosure of protected information.
...the person uses or discloses the information;
Defines a temporal interval for the offence.
...the information is personal information about an individual; or there is a risk that the use or disclosure might substantially prejudice the commercial interests of another person.
Requires a recurring trace for the offence.
(c) the person uses or discloses the information;
...the use or disclosure might substantially prejudice the commercial interests of another person.
Diffuses the prohibition to entrusted persons.
(a) the person is or has been an entrusted person;
...the person obtains protected information in the course of, or for the purposes of, performing functions or exercising powers under this Act;
Represents the knowledge that entrusted persons should not use or disclose certain information.
(b) the person obtains protected information in the course of, or for the purposes of, performing functions or exercising powers under this Act;
151(2) Prohibition on entrusted persons using or disclosing certain
...or (f) the System Administrator; or ...
...(e) a person engaged under section 27A of the Competition and Consumer Act 2010;
151(3) Prohibition on entrusted persons using or disclosing certain
Prohibition on entrusted persons using or disclosing certain information without authorization.
Prohibits the use or disclosure of certain information.
(3) Subsection (1) does not apply if the use or disclosure is authorised by section 152.
151(4) Prohibition on entrusted persons using or disclosing certain
Prohibition on using or disclosing protected information.
...using or disclosing certain information.
Classifies protected information as sensitive data.
...information that was disclosed or obtained under or for the purposes of this Act.
Restricts access to protected information during its disclosure.
Limits the spread of protected information.
Identifies sensitive data in protected information.
Defines constraints on protected information disclosure.
152 Authorised uses and disclosures of protected information by
Authorised uses and disclosures of protected information by entrusted persons.
153 Disclosing personal or commercially sensitive information to
153(1) Disclosing personal or commercially sensitive information to
An entrusted person is not required to produce a document or disclose protected information under certain circumstances.
153(2) Disclosing personal or commercially sensitive information to
Must disclose documents or answer questions to a court, tribunal, authority, or other person with power to require production.
154 Annual report by the Digital ID Regulator
154(1) Annual report by the Digital ID Regulator
Annual report by the Digital ID Regulator
154(2) Annual report by the Digital ID Regulator
154(3) Annual report by the Digital ID Regulator
Annual report must be given to the Minister by a certain date.
155 Annual report by Information Commissioner
Annual report must include performance information
155A Annual reports by law enforcement agencies etc. on disclosure
155A(1) Annual reports by law enforcement agencies etc. on disclosure
Law enforcement agencies and enforcement bodies must request or require accredited entities to disclose biometric information or personal information.
The law enforcement agency or enforcement body must request or require the accredited entity to disclose biometric information or personal information.
The accredited entity MUST provide biometric information or personal information.
The enforcement body must request or require the accredited entity to use or disclose personal information of an individual for enforcement-related activities.
The accredited entity MUST use or disclose personal information of an individual for enforcement-related activities.
Disclosure must occur during a financial year.
The law enforcement agency or enforcement body MUST request or require the accredited entity to disclose biometric information or personal information DURING a financial year.
The disclosure of biometric information or personal information OCCURS BETWEEN the start and end of a financial year.
Disclosure must be recurring for enforcement-related activities.
The enforcement body MUST request or require the accredited entity to use or disclose personal information of an individual FOR ENFORCEMENT-RELATED ACTIVITIES CONDUCTED BY, OR ON BEHALF OF, THE ENFORCEMENT BODY.
The disclosure of personal information of an individual is RECURSIVE for enforcement-related activities.
155A(2) Annual reports by law enforcement agencies etc. on disclosure
Annual report on disclosure of information by law enforcement agencies
Classification of information in the report
(a) the total number of requests or requirements made by the agency or body during the financial year;
155A(3) Annual reports by law enforcement agencies etc. on disclosure
Annual reports must be given to the AFP Minister by a certain date.
155B Annual report by AFP Minister
155B(1) Annual report by AFP Minister
The AFP Minister must prepare an annual report.
155B(2) Annual report by AFP Minister
AFP Minister must include a statement if no section 155A reports were provided.
155B(3) Annual report by AFP Minister
Annual report by AFP Minister must include specific information about law enforcement agencies' requests and compliance.
Classification of information required in the report
(a) the total number of requests or requirements made by the law enforcement agency or enforcement body during the financial year;
(3) If subsection (2) does not apply, the report by the AFP Minister
156 How this Act applies in relation to non-legal persons
156(1) How this Act applies in relation to non-legal persons
Entities must appoint accountable persons to exercise permissions or rights.
Entities must appoint accountable persons.
156(2) How this Act applies in relation to non-legal persons
Imposes obligation on accountable persons for non-legal entities
Imposes obligation on accountable persons
This Act purports to impose an obligation or duty
on each person who is an accountable person for the entity at the time the obligation or duty arises or is in operation
Describes temporal interval of obligation
the obligation or duty arises or is in operation
at the time the obligation or duty arises or is in operation
Describes mechanism of obligation discharge
any person who is an accountable person for the entity at the time the obligation or duty arises or is in operation
or any person who is authorised by a person referred to in subparagraph (i) to discharge the obligation or duty
156(3) How this Act applies in relation to non-legal persons
Accountable persons for non-legal entities are liable for contraventions.
Accountable persons have an obligation to comply.
(3) A provision of this Act (including a civil penalty provision) that is purportedly contravened by an entity that is not a legal person...
...is instead contravened by each accountable person for the entity...
The liability of accountable persons overlaps with that of the entity.
(c) was in any way knowingly concerned in, or party to, the relevant act or omission.
...or (c) was in any way knowingly concerned in, or party to, the relevant act or omission.
The liability of accountable persons repeats with each occurrence.
(3) A provision of this Act (including a civil penalty provision)...
...is instead contravened by each accountable person for the entity who:...
The liability of accountable persons is an obligation.
The liability of accountable persons implies that they have a duty to comply.
156(4) How this Act applies in relation to non-legal persons
Definition of accountable person for an entity
157 Attributing conduct to the Commonwealth, States and
Determine whether Commonwealth, State or Territory has contravened the Act
158 Bodies corporate and due diligence
Due diligence obligation for bodies corporate
Bodies corporate must take reasonable precautions and exercise due diligence
No contravention if due diligence is exercised
159 Protection from civil action
159(1) Protection from civil action
List of entities protected from civil action
Entities listed are protected from civil action
159(2) Protection from civil action
Protection from civil action for acts done in good faith
(2) A person mentioned in subsection (1)
is not liable to an action or other proceeding for damages
Obligation to act with good faith in performance of functions
(a) in the performance, or purported performance, of any functions under this Act
Obligation to act with good faith in exercise of powers
(b) in the exercise, or purported exercise, of any powers under this Act
Temporal overlap between good faith and liability
160 Geographical jurisdiction of civil penalty provisions
Entity must comply with civil penalty provisions within geographical jurisdiction.
161 Interaction with tax file number offences
Nothing in this Act affects or limits the operation of certain tax file number offences.
162 Review of operation of Act
162(1) Review of operation of Act
Minister must undertake review of Act's operation.
162(2) Review of operation of Act
Review of operation of Act must be undertaken within 2 years after commencement.
Obligation to undertake review within 2 years.
162(3) Review of operation of Act
Must provide written report of review to Minister
162(4) Review of operation of Act
Minister must table report in each House of Parliament within 15 sitting days.
163 Delegation—Minister
163(1) Delegation—Minister
Delegation of Minister's functions or powers
The Minister delegates all or any of their functions or powers
The Minister may delegate to the Digital ID Regulator, Secretary, or SES employee/acting SES employee
The delegation occurs within a specific temporal interval
163(2) Delegation—Minister
Delegate must comply with written directions of the Minister.
164 Delegation—Digital ID Regulator
Delegation of powers or functions under this Act
165 Delegation—System Administrator
Delegation of System Administrator's functions is prohibited.
166 Delegation—Digital ID Data Standards Chair
166(1) Delegation—Digital ID Data Standards Chair
Delegation of functions or powers to a person assisting the Chair
The Chair may delegate functions or powers
The person assisting the Chair has the delegated function or power
166(2) Delegation—Digital ID Data Standards Chair
Exemption from subsection (1) for Digital ID Data Standards function
166(3) Delegation—Digital ID Data Standards Chair
Delegate must comply with directions of the Digital ID Data Standards Chair.
167 Instruments may incorporate etc. material as in force or existing
167(1) Instruments may incorporate etc. material as in force or existing
List of core instruments subject to this section
167(2) Instruments may incorporate etc. material as in force or existing
Incorporation of material from other instruments or writings
167(3) Instruments may incorporate etc. material as in force or existing
Provision for changes to incorporated instruments taking effect for the core instrument
167(4) Instruments may incorporate etc. material as in force or existing
Subsection (2) has effect despite subsection 14(2) of the Legislation Act 2003.
Continues effect despite subsection 14(2)
168 Rules—general matters
168(1) Rules—general matters
Minister may make rules by legislative instrument.
168(2) Rules—general matters
Rules may prescribe different matters for different entities, things or circumstances.
168(3) Rules—general matters
Confer power on Digital ID Regulator, System Administrator or Minister to make an instrument of administrative character.
Granting a power to make an instrument of administrative character.
169 Rules—requirement to consult
169(1) Rules—requirement to consult
Consult persons about draft rules or amendments before making or amending them.
Must consult persons about draft rules or amendments.
The Minister must make or amend rules under section 168.
The Minister MUST cause to be published a notice inviting persons to make submissions.
Consultation period is at least 28 days after notice publication.
The notice must be published within a specified period.
The consultation period IS >= the specified period.
The Minister must consider any submissions received within the specified period.
The Minister MUST consider the submissions.
The Minister must consult the Information Commissioner if the rules deal with matters related to privacy functions.
The Minister MUST consult the Information Commissioner.
169(2) Rules—requirement to consult
Minister must consult Information Commissioner on rules regarding accredited entities and biometric information.
Minister has a duty to consult Information Commissioner.
169(2A) Rules—requirement to consult
Consultation requirement for rule-making under section 168
(2A) Before making or amending any rules under section 168, the Minister must...
(2A) Before making or amending any rules under section 168, the Minister must also: (a) consult such organisations representing individuals who may experience barriers when creating or using a digital ID as the Minister considers appropriate; and (b) by written notice, invite such organisations to make comments to the Minister within the period specified in the written notice.
(2A) Before making or amending any rules under section 168, the Minister must also: (c) consider any comments received within the specified period.
(2A) Before making or amending any rules under section 168, the Minister must also: (b) by written notice, invite such organisations to make comments to the Minister within the period specified in the written notice.
169(3) Rules—requirement to consult
Consider submissions after specified period if appropriate.
169(4) Rules—requirement to consult
Exemptions from subsections (1) and (2A)
169(5) Rules—requirement to consult
30 May
Privacy and Other Legislation Amendment Act 2024
10 Dec
Conditional commencement of Administrative Review Tribunal (Miscellaneous Measures) Act 2025
20 Feb