an accredited attribute service provider;

an accredited identity exchange provider;

an accredited identity service provider;

an entity that provides, or proposes to provide, a service of a kind prescribed by the Accreditation Rules.

a body corporate incorporated by or under a law of the Commonwealth or a State or Territory;

(b) a registered foreign company within the meaning of the Corporations Act 2001;

(c) a Commonwealth entity, or a Commonwealth company, within the meaning of the Public Governance, Performance and Accountability Act 2013;

(d) a person or body that is an agency within the meaning of the Freedom of Information Act 1982;

(e) a body specified, or the person holding an office specified, in Freedom of Information Act 1982;Part I of Schedule 2 to the

a department or authority of a State;

a department or authority of a Territory.

to accredit the entity; or

to refuse to accredit the entity.

as an accredited attribute service provider unless the entity provides, or will provide, some or all of the services described in the definition of attribute service provider; or

as an accredited identity exchange provider unless the entity provides, or will provide, some or all of the services described in the definition of identity exchange provider; or

as an accredited identity service provider unless the entity provides, or will provide, some or all of the services described in the definition of identity service provider; or

if Accreditation Rules made for the purposes of paragraph 14(1)(d) prescribe services—as an entity that provides services of the kind prescribed unless the entity provides, or will provide, some or all of the services of that kind.

a direction under subsection 27(1) (about security) directing the Digital ID Regulator to refuse to accredit the entity is in force; or

the Digital ID Regulator is not satisfied that the entity is able to comply with this Act; or

Accreditation Rules made for the purposes of section 28 require specified criteria to be met and the entity does not meet the criteria; or

Accreditation Rules made for the purposes of section 28 require the Digital ID Regulator to be satisfied of specified matters and the Digital ID Regulator is not satisfied of those matters.

must have regard to the matters (if any) prescribed by the Accreditation Rules; and

may have regard to the following:

whether the entity is a fit and proper person;

any other matters the Digital ID Regulator considers relevant.

give written notice of a decision to accredit, or to refuse to accredit, the entity; and

if the decision is to refuse to accredit the entity—give reasons for the decision to the entity.

the kind or kinds of accredited entity that the entity is accredited as;

the day the accreditation comes into force;

any conditions imposed on the entity’s accreditation under subsection 17(2).

the conditions set out in subsection 17(1);

the conditions (if any) imposed by the Digital ID Regulator under subsection 17(2), including as varied under subsection 20(1);

the conditions (if any) determined by the Accreditation Rules under subsection 17(5).

may impose conditions on the accreditation of an entity, either at the time of accreditation or at a later time, if the Digital ID Regulator considers that doing so is appropriate in the circumstances; and

must impose conditions on the accreditation of an entity, either at the time of accreditation or at a later time, if directed to do so under subsection 27(1).

any limitations, exclusions or restrictions in relation to the accredited services of the entity;

the circumstances or manner in which the accredited services of the entity must be provided;

the kinds of restricted attributes of individuals (if any) that the entity is authorised to collect or disclose and the circumstances in which such attributes may be collected or disclosed;

the kinds of restricted attributes of individuals (if any) that the entity must not collect;

the kinds of biometric information (if any) of an individual the entity is authorised to collect, use or disclose and the circumstances in which such information may be collected, used or disclosed;

the entity’s information technology systems through which the entity’s accredited services are provided, including restrictions on changes to such systems;

actions that the entity must take before the entity’s accreditation is suspended or revoked.

Conditions imposed by the Accreditation Rules

whether the entity has provided sufficient justification for the need to collect or disclose the restricted attribute;

whether the entity has demonstrated that a similar outcome cannot be achieved without collecting or disclosing the restricted attribute;

if the collection or disclosure of the restricted attribute is regulated by other legislative or regulatory requirements—whether the entity would be able to comply with those requirements if the condition were imposed;

the potential harm that could result if restricted attributes of that kind were disclosed to an entity that was not authorised to collect them;

community expectations as to whether restricted attributes of that kind should be handled more securely than other kinds of attributes;

any of the following information provided by the entity seeking authorisation to collect or disclose the restricted attribute:

the entity’s risk assessment plan as it relates to the restricted attribute;

the entity’s privacy impact assessment as it relates to the restricted attribute;

the effectiveness of the entity’s protective security (including security governance, information security, personnel security and physical security), privacy arrangements and fraud control arrangements;

if the entity is not a participating relying party—the arrangements in place between the entity and relying parties for the protection of the restricted attribute from further disclosure;

any other matter the Digital ID Regulator considers relevant.

Requirement to give statement of reasons if authorisation given

collect or disclose restricted attributes of individuals; or

collect, use or disclose biometric information of individuals.

the potential harm that could result if the information were disclosed to an entity;

community expectations about the collection, use or disclosure of the information;

if the collection or disclosure of the restricted attribute is regulated by other legislative or regulatory requirements—whether the entities would be able to comply with those requirements if the rules were made;

any privacy impact assessment that has been conducted in relation to the proposal to make the rules;

any other matter the Minister considers relevant.

at any time, on the Digital ID Regulator’s own initiative; or

on application by the entity under section 21;

if the Digital ID Regulator considers it is appropriate to do so.

impose a condition under paragraph 17(2)(a) on an entity’s accreditation after the entity has been accredited; or

vary or revoke a condition under subsection 20(1);

unless the Digital ID Regulator has given the entity a written notice in accordance with subsection (2) of this section.

state the proposed condition, variation or revocation; and

request the entity to give the Digital ID Regulator, within the period specified in the notice, a written statement relating to the proposed condition, variation or revocation.

impose a condition under paragraph 17(2)(a) on an entity’s accreditation; or

vary or revoke a condition under subsection 20(1) on an entity’s accreditation.

state the condition or the variation, or state that the condition is revoked; and

state the day on which the condition, variation or revocation takes effect.

the Digital ID Regulator reasonably believes that the accredited entity has contravened or is contravening this Act; or

the Digital ID Regulator reasonably believes that there has been a cyber security incident involving the entity; or

the Digital ID Regulator reasonably believes that a cyber security incident involving the entity is imminent; or

(d) if the entity is a body corporate—the entity becomes a Chapter 5 body corporate (within the meaning of the Corporations Act 2001); or

the Digital ID Regulator is satisfied that it is not appropriate for the entity to be an accredited entity; or

circumstances specified in the Accreditation Rules apply in relation to the entity.

state the grounds on which the Digital ID Regulator proposes to suspend the entity’s accreditation; and

invite the entity to give the Digital ID Regulator, within 28 days after the day the notice is given, a written statement showing cause why the Digital ID Regulator should not suspend the accreditation.

Exception—cyber security incident

that the entity’s accreditation is suspended;

if the entity is accredited as more than one kind of accredited entity—the accreditation that is suspended;

the reasons for the suspension;

the day the suspension is to start;

if the accreditation is suspended for a period—the period of the suspension;

if the accreditation is suspended until a specified event occurs or action is taken—the event or action.

Effect of suspension

the entity is taken not to be accredited while the suspension is in force; and

if the entity holds an approval to participate in the Australian Government Digital ID System as an accredited entity—the entity is taken not to hold that approval while the entity’s accreditation is suspended.

Revocation of suspension

the Digital ID Regulator reasonably believes that the accredited entity has contravened or is contravening this Act; or

the Digital ID Regulator reasonably believes that:

there has been a cyber security incident involving the entity; and

the cyber security incident is serious; or

(c) if the entity is a body corporate—the entity becomes a Chapter 5 body corporate (within the meaning of the Corporations Act 2001); or

the Digital ID Regulator is satisfied that it is not appropriate for the entity to be an accredited entity; or

circumstances specified in the Accreditation Rules apply in relation to the entity.

an entity’s accreditation is revoked under subsection (1), (2) or (5); and

the entity holds an approval to participate in the Australian Government Digital ID System;

the Digital ID Regulator must at the same time revoke the entity’s approval to participate as an accredited entity.

Show cause notice must generally be given before decision to revoke

state the grounds on which the Digital ID Regulator proposes to revoke the entity’s accreditation; and

invite the entity to give the Digital ID Regulator, within 28 days after the day the notice is given, a written statement showing cause why the Digital ID Regulator should not revoke the accreditation.

Exception—cyber security incident

that the entity’s accreditation is to be revoked;

if the entity is accredited as more than one kind of accredited entity—the accreditation that is to be revoked;

the reasons for the revocation;

the day the revocation is to take effect.

Accreditation can be revoked even while suspended

refuse to accredit an entity;

impose conditions on the accreditation of an entity;

suspend the accreditation of an accredited entity;

revoke the accreditation of an accredited entity.

requirements that entities must meet in order to become and remain an accredited entity, including requirements relating to the following:

privacy;

security;

fraud control;

incident management and reporting;

disaster recovery;

user experience and inclusion;

without limiting paragraph (a), requirements relating to the conduct of, and reporting on, privacy impact assessments, fraud assessments and security assessments;

technical, data or design standards relating to the provision of accredited services of accredited entities;

without limiting paragraph (c), standards relating to the testing of the information technology systems of entities;

the conduct of periodic reviews of an entity’s compliance with specified requirements of the Accreditation Rules, including the timing of such reviews, who is to conduct such reviews and the provision of reports about such reviews to the Digital ID Regulator;

the obligations of accredited entities in relation to monitoring their compliance with this Act;

requirements relating to the collection, holding, use and disclosure of personal information of individuals;

matters relating to representatives or nominees of individuals in relation to the creation, maintenance or deactivation of digital IDs of individuals;

requirements or restrictions relating to the generation of digital IDs for children.

must not be used by the accredited identity service provider for verifying the identity of the individual or authenticating a digital ID of the individual; and

if it can be reactivated, must not be reactivated by the accredited identity service provider without the express consent of the individual.

require accredited entities, or specified kinds of accredited entities, to comply with specified accessibility standards; and

require accredited entities, or specified kinds of accredited entities, to have regard to specified accessibility guidelines; and

require accredited entities, or specified kinds of accredited entities, to conduct useability testing with a diverse range of individuals, covering diversity in disability, age, gender and ethnicity; and

specify requirements relating to device or browser access; and

specify requirements relating to the provision of support or assistance for individuals who may experience barriers when creating or using a digital ID.

(a) the Privacy Act 1988 applies in relation to the act or practice as if the entity were an organisation within the meaning of that Act; or

a law of a State or Territory that provides for all of the following applies in relation to the act or practice:

protection of personal information comparable to that provided by the Australian Privacy Principles;

monitoring of compliance with the law;

a means for an individual to seek recourse if the individual’s personal information is dealt with in a way contrary to the law; or

all of the following apply:

neither paragraph (a) nor (b) apply to the acts or practices of the entity;

the entity has an APP-equivalent agreement with the Commonwealth;

(iii) the agreement includes a term that prohibits the entity from collecting, holding, using or disclosing personal information in any way that would, if the entity were an organisation within the meaning of the Privacy Act 1988, breach an Australian Privacy Principle.

37  Contraventions of privacy obligations in APP-equivalent agreements

(a) an interference with the privacy of the individual for the purposes of the Privacy Act 1988; and

covered by sections 13, 13G and 13H of that Act.

an act or practice of the entity has contravened, or may have contravened, the term of the agreement in relation to an individual; and

(b) the act or practice is the subject of a complaint to, or an investigation by, the Information Commissioner under Part V of the Privacy Act 1988.

(a) an interference with the privacy of the individual for the purposes of the Privacy Act 1988; and

covered by sections 13, 13G and 13H of that Act.

(a) the act or practice of the entity that contravenes a provision of Privacy Act 1988; andDivision 2 of this Part or section 136 is the subject of a complaint to, or an investigation by, the Information Commissioner under Part V of the

the entity is not an agency or organisation.

is an APP entity; and

(b) is aware that there are reasonable grounds to believe that there has been an eligible data breach (within the meaning of the Privacy Act 1988) of the entity relating to the entity’s accredited services; and

(c) is required under Privacy Act 1988 to give the Information Commissioner a statement that complies with subsection 26WK(3) of that Act.section 26WK of the

the entity is a department or authority of a State or Territory; and

a law of the State or Territory provides for a scheme for the notification of data breaches that:

covers the entity; and

(ii) is comparable to the scheme provided for in Privacy Act 1988.Part IIIC of the

(a) the accredited entity is aware that there are reasonable grounds to believe that there has been an eligible data breach (within the meaning of the Privacy Act 1988) of the entity relating to the entity’s accredited services; and

because of the operation of subsection (3) of this section, the entity is required under the Information Commissioner a statement that complies with subsection 26WK(3) of that Act;section 26WK of that Act to give

the entity must also give a copy of the statement to the Digital ID Regulator at the same time as the statement is given to the Information Commissioner.

the entity is not an APP entity; and

the entity is a department or authority of a State or Territory; and

(c) the entity is required under a law of the State or Territory to give a statement (however described) that corresponds to Privacy Act 1988 to another entity (the notified entity); andsection 26WK of the

the statement relates to the accredited services of the entity.

information or an opinion about an individual’s racial or ethnic origin;

information or an opinion about an individual’s political opinions;

information or an opinion about an individual’s membership of a political association;

information or an opinion about an individual’s religious beliefs or affiliations;

information or an opinion about an individual’s philosophical beliefs;

information or an opinion about an individual’s sexual orientation or practices.

did not solicit the attribute of the individual; and

destroys the attribute, as soon as practicable, after becoming aware the accredited entity has collected the attribute.

(a) an accredited entity (the assigning entity) assigns a unique identifier to an individual within a digital ID system; and

the assigning entity discloses the unique identifier to another accredited entity or to a relying party.

if the unique identifier was disclosed to another accredited entity—the other accredited entity; or

if the unique identifier was disclosed to a relying party—the relying party.

detecting, reporting or investigating a contravention, or an alleged contravention, of a provision of this Act;

conducting proceedings in relation to a contravention, or an alleged contravention, of a civil penalty provision of this Act;

detecting, reporting or investigating either of the following within a digital ID system:

a digital ID fraud incident;

a cyber security incident:

(d) conducting an assessment of the matter referred to in paragraph 33C(1)(g) of the Privacy Act 1988 (about assessments by the Information Commissioner in relation to the handling and maintenance of personal information in accordance with certain aspects of this Act);

detecting, reporting, investigating or prosecuting an offence against a law of the Commonwealth, a State or a Territory.

to a contractor engaged by the accredited entity; and

for the purposes of the contractor providing an accredited service, or part of an accredited service, of the accredited entity.

the collection, use or disclosure is authorised under section 49 or 50; and

unless the collection, use or disclosure is authorised under paragraph 49(3)(a) or subsection 49(5), (6) or (8)—the individual to whom the information relates has expressly consented to the collection, use or disclosure of the biometric information.

collect, use or disclose biometric information of an individual for the purpose of one-to-many matching of the individual; or

collect, use or disclose biometric information of an individual to determine whether the individual has multiple digital IDs.

the accredited entity’s conditions on accreditation authorise the collection, use, or disclosure of the biometric information; and

the biometric information of the individual is collected, used or disclosed for the purposes of the accredited entity doing either or both of the following:

verifying the identity of the individual;

authenticating the individual to their digital ID.

the biometric information is contained in a verifiable credential that is in the individual’s control; and

the Accreditation Rules prescribe requirements relating to the collection, use or disclosure of the biometric information; and

the collection, use or disclosure complies with those requirements.

the disclosure of the information is required or authorised by or under a warrant issued under a law of the Commonwealth, a State or a Territory; or

the information is disclosed with the express consent of the individual to whom the biometric information relates, or purports to relate, and the disclosure is for the purpose of:

verifying the identity of the individual; or

investigating or prosecuting an offence against a law of the Commonwealth, a State or a Territory.

any law of the Commonwealth, a State or a Territory (whether enacted or made before or after this subsection); or

a warrant (other than a warrant of a kind mentioned in paragraph (3)(a)), authorisation or order issued under such a law.

the accredited entity collected the information in accordance with subsection (1); and

the information is retained, used or disclosed for the purposes of undertaking testing in relation to the information; and

the entity complies with any requirements prescribed by the Accreditation Rules.

the purposes for which testing may be undertaken;

the kinds of testing that may be undertaken using biometric information;

the circumstances in which testing of the biometric information may be undertaken;

the manner in which the biometric information that has been retained for testing must be destroyed;

the preparation, content, approval and implementation of ethics plans relating to the testing of the biometric information;

obtaining express consent of individuals to whom the biometric information relates;

reporting of testing results to the Digital ID Regulator.

the entity collected the information in accordance with subsection (1); and

the information is retained, used or disclosed for the purposes of preventing or investigating a digital ID fraud incident; and

the entity complies with any requirements prescribed by the Accreditation Rules.

the manner in which biometric information that has been retained for preventing or investigating digital ID fraud incidents must be destroyed;

the reporting of fraud prevention or investigation activities to the Digital ID Regulator.

an accredited entity collects biometric information of an individual under subparagraph 49(1)(b)(i) for the purpose of verifying the identity of the individual; and

the accredited entity has verified that the biometric information is legitimate.

contains personal information about the individual; and

the individual has expressly consented to the issue of; and

can be used to assist the individual to prove the individual’s age or identity or a permission or authorisation that the individual holds; and

is issued by or on behalf of the entity.

a body corporate incorporated by or under a law of the Commonwealth or a State or Territory;

(b) a Commonwealth entity, or a Commonwealth company, within the meaning of the Public Governance, Performance and Accountability Act 2013;

(c) a person or body that is an agency within the meaning of the Freedom of Information Act 1982;

(d) a body specified, or the person holding an office specified, in Freedom of Information Act 1982;Part I of Schedule 2 to the

a department or authority of a State;

a department or authority of a Territory.

(a) the entity (the first entity) is not covered by subsection (3); and

(b) the first entity has a written agreement with another entity (the government entity) that is covered by that subsection; and

the agreement provides for the first entity to disclose the biometric information of the individual to the government entity for the purposes of issuing a document or other credential that:

contains personal information about the individual; and

the individual has expressly consented to the issue of; and

can be used to assist the individual to prove the individual’s age or identity or a permission or authorisation that the individual holds; and

is issued by or on behalf of the entity;

the entity may disclose the biometric information in accordance with the agreement if the disclosure occurs within 14 days after the biometric information is collected.

an accredited entity collects biometric information of an individual; and

the information is collected for the purposes of authenticating the individual to their digital ID (regardless of whether that information is also collected for the purposes of verifying the individual’s identity); and

the individual has not given express consent for that information to be retained for the purposes of further authenticating of the individual to their digital ID;

the provider must destroy the information immediately after the authentication is complete.

an accredited entity collects biometric information of an individual with the express consent of the individual to whom the information relates; and

the information is collected for the purposes of authenticating the individual to their digital ID; and

the individual withdraws their consent;

the accredited entity must destroy the information immediately after the consent is withdrawn.

the completion of testing the information; and

14 days after the entity collects the information.

immediately after the completion of activities relating to the prevention or investigation of the digital ID fraud incident (as the case may be); and

14 days after the entity collects the information.

the information is personal information about an individual that is in the entity’s possession or control; and

the information is any of the following:

information about the services provided by the entity that the individual has accessed, or attempted to access;

information relating to how or when access was obtained or attempted to be obtained by the individual;

information relating to the method of access or attempted access by the individual;

the date and time the individual’s identity was verified.

is for purposes relating to improving the performance or useability of the entity’s information technology system through which the entity’s accredited services are provided and not for broader business purposes; or

is for the purposes of the entity complying with this Act; or

is required or authorised by or under a law of the Commonwealth, a State or a Territory.

the personal information is not biometric information of the individual; and

any of the following apply:

at the time the information is used or disclosed, the accredited entity is satisfied that the enforcement body has started proceedings against a person for an offence against a law of the Commonwealth, a State or a Territory;

at the time the information is used or disclosed, the accredited entity is satisfied that the enforcement body has started proceedings against a person in relation to a breach of a law imposing a penalty or sanction;

the disclosure of the information is required or authorised by or under a warrant issued under a law of the Commonwealth, a State or a Territory;

the information is used or disclosed for the purposes of reporting a suspected or actual digital ID fraud incident or suspected or actual cyber security incident;

the information is used or disclosed by the accredited entity for the purposes of complying with this Act;

the information is disclosed with the express consent of the individual to whom the personal information relates, or purports to relate, and the disclosure is for the purpose of verifying the identity of the individual, or investigating or prosecuting an offence against a law of the Commonwealth, a State or a Territory.

(a) Crimes Act 1914 (about disclosure of personal information to certain entities for integrity purposes); andsection 86E of the

any other law of the Commonwealth, a State or a Territory, whether enacted or made before or after the commencement of this section.

offering to supply goods or services;

advertising or promoting goods or services;

enabling another entity to offer to supply goods or services;

enabling another entity to advertise or promote goods or services;

market research.

the information is disclosed to an individual for the purposes of:

offering to supply the entity’s accredited services; or

advertising or promoting the entity’s accredited services; and

the information is disclosed to the individual with the individual’s express consent.

a restricted attribute of the individual;

the individual’s name;

the individual’s address;

the individual’s date of birth;

the individual’s phone number;

the individual’s email address;

an attribute of a kind prescribed by the Accreditation Rules.

the entity provides or receives services within the Australian Government Digital ID System; and

the entity is not an entity mentioned in column 1 of an item in the table in subsection (1).

the Digital ID Regulator;

the System Administrator.

the entity provides or receives services within the Australian Government Digital ID System; and

the entity is an entity mentioned in column 1 of an item in the table in subsection (1); and

the entity does not satisfy one or more requirements set out in column 2 of that item.

whether the entities are relying parties or accredited entities; or

kinds of relying parties; or

kinds of accredited entities; or

whether the entity belongs to the public or private sector.

must not revoke the determination; and

may vary the determination only to:

specify additional kinds of entities that may apply; or

correct an error, defect or irregularity in the determination.

the entity has made an application under section 61; and

unless the entity is a relying party—the entity is an accredited entity; and

the Digital ID Regulator is satisfied that the entity will comply with the Digital ID Data Standards that apply in relation to the entity and that relate to participation in the Australian Government Digital ID System; and

if the Digital ID Regulator makes a requirement under paragraph 131(1)(a) in relation to the entity—the entity has been assessed as being able to comply with this Act; and

the Digital ID Regulator is satisfied that it is appropriate to approve the entity to participate in the system; and

any other requirements prescribed by the Digital ID Rules are met.

whether the entity is a fit and proper person;

whether the entity has appropriate procedures for dealing with the identities (whether real or not, and whether assumed or not) of shielded persons.

give written notice of a decision to approve, or to refuse to approve, an entity to participate in the Australian Government Digital ID System; and

if the decision is to refuse to approve the entity—give reasons for the decision to the entity.

the day the approval comes into force; and

whether the entity is a participating relying party or an accredited entity and, if the entity is an accredited entity, the kind of accredited entity it is accredited as; and

any conditions imposed on the approval under subsection 64(2); and

the day on which the entity must begin to participate in the Australian Government Digital ID System.

the conditions set out in subsection 64(1);

the conditions (if any) imposed by the Digital ID Regulator under subsection 64(2), including as varied under subsection 66(1);

the conditions (if any) determined by the Digital ID Rules for the purposes of subsection 64(5).

unless the entity is a relying party—the entity must be an accredited entity;

if the entity is an accredited entity:

the entity must participate in the Australian Government Digital ID System only as the kind of accredited entity it is accredited as and approved to participate as; and

the entity must provide only its accredited services in the Australian Government Digital ID System;

the entity must begin to participate in the Australian Government Digital ID System on the entity’s participation start day;

the entity must comply with this Act.

Conditions imposed by the Digital ID Regulator

may impose conditions on the approval of an entity to participate in the Australian Government Digital ID System, either at the time of approval or at a later time, if the Digital ID Regulator considers that doing so is appropriate in the circumstances; and

must impose conditions on the approval of an entity to participate in the Australian Government Digital ID System, either at the time of approval or at a later time, if directed to do so under subsection 73(1).

the kind of accredited entity or participating relying party that the entity must directly connect to in order to participate in the Australian Government Digital ID System;

the kinds of attributes of individuals that the entity is authorised to collect or disclose and the circumstances in which such attributes may be collected or disclosed;

the kinds of attributes of individuals that the entity must not collect;

for an accredited entity—the circumstances in which the entity may or must not provide its accredited services within the Australian Government Digital ID System;

for an accredited entity—the accredited services of the entity that the entity must provide within the Australian Government Digital ID System;

for a relying party—the services the relying party is approved to provide, or to provide access to, within the Australian Government Digital ID System;

actions that the entity must take before the entity’s approval to participate in the Australian Government Digital ID System is suspended or revoked.

Conditions imposed by the Digital ID Rules

to collect or disclose a restricted attribute of an individual within the Australian Government Digital ID System; or

to disclose a restricted attribute of an individual that is collected by the entity within the Australian Government Digital ID System to an entity outside the system.

whether the entity has provided sufficient justification for the need to collect or disclose the restricted attribute;

whether the entity has demonstrated that a similar outcome cannot be achieved without collecting or disclosing the restricted attribute;

if the collection or disclosure of the restricted attribute is regulated by other legislative or regulatory requirements—whether the entity would be able to comply with those requirements if the condition were imposed;

the potential harm that could result if restricted attributes of that kind were disclosed to an entity that was not authorised to collect them;

community expectations as to whether restricted attributes of that kind should be handled more securely than other kinds of attributes;

any of the following information provided by the entity seeking authorisation to collect or disclose the restricted attribute:

the entity’s risk assessment plan as it relates to the restricted attribute;

the entity’s privacy impact assessment as it relates to the restricted attribute;

the effectiveness of the entity’s protective security (including security governance, information security, personnel security and physical security), privacy arrangements and fraud control arrangements;

any other matter the Digital ID Regulator considers relevant.

Requirement to give statement of reasons if authorisation given

the potential harm that could result if restricted attributes of that kind were disclosed to an entity;

community expectations as to whether restricted attributes of that kind should be handled more securely than other kinds of attributes;

if the collection or disclosure of the restricted attribute is regulated by other legislative or regulatory requirements—whether the entities would be able to comply with those requirements if the rules were made;

any privacy impact assessment that has been conducted in relation to the proposal to make the rules;

any other matter the Minister considers relevant.

at any time, on the Digital ID Regulator’s own initiative; or

on application by the entity under section 67;

if the Digital ID Regulator considers it is appropriate to do so.

impose a condition under paragraph 64(2)(a) on an entity’s approval to participate in the Australian Government Digital ID System after the approval has been given; or

vary or revoke a condition imposed under subsection 66(1);

unless the Digital ID Regulator has given the entity a written notice in accordance with subsection (2) of this section.

state the proposed condition, variation or revocation; and

request the entity to give the Digital ID Regulator, within the period specified in the notice, a written statement relating to the proposed condition, variation or revocation.

impose a condition under paragraph 64(2)(a) on an entity’s approval to participate in the Australian Government Digital ID System; or

vary or revoke a condition under subsection 66(1) on an entity’s approval to participate in the Australian Government Digital ID System.

state the condition or the variation, or state that the condition is revoked; and

state the day on which the condition, variation or revocation takes effect.

the Digital ID Regulator reasonably believes that the entity has contravened or is contravening this Act; or

the Digital ID Regulator reasonably believes that:

there has been a cyber security incident involving the entity; and

the incident involves a risk to the operation of the Australian Government Digital ID System; or

(c) if the entity is a body corporate—the entity is a Chapter 5 body corporate (within the meaning of the Corporations Act 2001); or

if the entity is an individual—the entity is an insolvent under administration; or

the Digital ID Regulator is satisfied that it is not appropriate for the entity to participate in the Australian Government Digital ID System; or

circumstances specified in the Digital ID Rules apply in relation to the entity.

state the grounds on which the Digital ID Regulator proposes to suspend the entity’s approval; and

invite the entity to give the Digital ID Regulator, within 28 days after the day the notice is given, a written statement showing cause why the Digital ID Regulator should not suspend the approval.

Exception—cyber security incident or security

that the entity’s approval to participate in the Australian Government Digital ID System is suspended;

the reasons for the suspension;

the day the suspension is to start;

if the approval is suspended for a period—the period of the suspension;

if the approval is suspended until a specified event occurs or action is taken—the event or action.

Revocation of suspension

the Digital ID Regulator reasonably believes that the entity has contravened or is contravening this Act; or

the Digital ID Regulator reasonably believes that:

there has been a cyber security incident involving the entity; and

the cyber security incident is serious; or

(c) if the entity is a body corporate—the entity is a Chapter 5 body corporate (within the meaning of the Corporations Act 2001); or

if the entity is an individual—the entity is an insolvent under administration; or

the Digital ID Regulator is satisfied that it is not appropriate for the entity to participate in the Australian Government Digital ID System; or

circumstances specified in the Digital ID Rules apply in relation to the entity.

state the grounds on which the Digital ID Regulator proposes to revoke the entity’s approval; and

invite the entity to give the Digital ID Regulator, within 28 days after the day the notice is given, a written statement showing cause why the Digital ID Regulator should not revoke the approval.

Notice of revocation

that the entity’s approval to participate in the Australian Government Digital ID System is to be revoked;

the reasons for the revocation;

the day the revocation is to take effect.

Approval can be revoked even while suspended

refuse to approve an entity to participate in the Australian Government Digital ID System;

impose conditions on the approval of an entity to participate in the Australian Government Digital ID System;

suspend the approval of an entity to participate in the Australian Government Digital ID System;

revoke the approval of an entity to participate in the Australian Government Digital ID System.

the participating relying party provides the service, or access to the service, by means other than the creation or use of a digital ID through the Australian Government Digital ID System; and

either of the following apply:

the other means is not reasonably accessible;

using the other means results in the service being provided on substantially less favourable terms.

Exceptions

the service provides access to another service; and

the individual can access the other service by means other than the creation or use of a digital ID through the Australian Government Digital ID System; and

the other means is reasonably accessible; and

using the other means does not result in the other service being provided on substantially less favourable terms.

the participating relying party is providing a service, or access to a service, to an individual who is acting on behalf of another entity in a professional or business capacity; or

the participating relying party holds an exemption under subsection (4).

Exemptions

(a) the participating relying party is a small business (within the meaning of the Privacy Act 1988); or

the participating relying party provides services, or access to services, solely online; or

the participating relying party is providing services, or access to services, in exceptional circumstances.

(a) a Commonwealth entity, or a Commonwealth company, within the meaning of the Public Governance, Performance and Accountability Act 2013; or

(b) a person or body that is an agency within the meaning of the Freedom of Information Act 1982; or

(c) a body specified, or the person holding an office specified, in Freedom of Information Act 1982.Part I of Schedule 2 to the

must be in writing; and

may be revoked by the Digital ID Regulator if the Digital ID Regulator considers it appropriate to do so.

give written notice of a decision to grant, or to refuse to grant, the exemption to the participating relying party; and

if the decision is to refuse to grant the exemption—give reasons for the decision to the participating relying party.

state that the Digital ID Regulator proposes to revoke the exemption; and

give reasons for the proposed revocation; and

request the entity to give the Digital ID Regulator, within the period specified in the notice, a written statement relating to the proposed revocation.

prohibit (either absolutely or unless particular circumstances are met or conditions are complied with) the holding, storing, handling or transferring of such information outside Australia; and

empower the Digital ID Regulator to grant exemptions to entities from any such prohibitions; and

be expressed to apply to all entities or entities of a specified kind.

the entity is subject to a requirement under the Digital ID Rules made for the purposes of subsection (1); and

the entity fails to comply with the requirement.

the entities that are covered by the arrangements;

the kinds of incidents that must be notified;

the information that must be included in notification about reportable incidents;

the manner in which and period within which reportable incidents must be notified to the Digital ID Regulator or the System Administrator;

action that must be taken in relation to reportable incidents;

how the Digital ID Regulator or System Administrator deals with reportable incidents, including action that may be taken by the Digital ID Regulator or System Administrator in dealing with a reportable incident such as:

requiring an entity to do something; or

authorising the provision of information relating to reportable incidents by the Digital ID Regulator or System Administrator to the Minister, the Information Commissioner, accredited entities, participating relying parties or other specified bodies;

authorising the collection of information relating to reportable incidents by the Minister, the Information Commissioner, accredited entities, participating relying parties or other specified bodies.

digital ID fraud incidents;

cyber security incidents;

(c) changes in control (Corporations Act 2001) of entities covered by the arrangements;within the meaning of section 910B of the

if an accredited entity engages contractors to provide an accredited service, or part of an accredited service, of the entity—changes in relation to such contractors.

the entity is subject to a requirement under the Digital ID Rules made for the purposes of subsection (1); and

the entity fails to comply with the requirement.

the obligation on participating relying parties to provide individuals with a choice of accredited identity service providers when the individual seeks to verify their identity or authenticate their digital ID or other information; and

the obligation on accredited entities participating in the Australian Government Digital ID System to provide their accredited services to other entities participating in the system.

specify the circumstances in which the interoperability obligation applies to participating relying parties and accredited entities;

provide for the Minister, on application, to grant exemptions from the interoperability obligation;

specify the grounds on which the Minister may grant exemptions, which may include the following:

that the Minister is satisfied that a service, or access to a service, provided by a participating relying party that is a government entity is of a kind that should use only accredited services of a government entity;

that the participating relying party provides a service, or access to a service, that the Minister is satisfied is of a kind that would promote use of digital IDs if the service, or access to the service, was available through the Australian Government Digital ID System;

that the exemption is of a limited duration to allow for the implementation of required business practices or technological systems, or to facilitate the use of the Australian Government Digital ID System by particular kinds of entities;

that an entity will provide an arrangement to assist individuals who would otherwise be at a disadvantage in accessing the Australian Government Digital ID System;

the exemption is necessary to satisfy the requirements of another legislative provision or scheme;

that the governance arrangements of an accredited entity prohibit or restrict the entity from interacting with a particular kind of service.

service levels relating to the availability and performance of the information technology systems through which accredited entities that hold an approval to participate in the Australian Government Digital ID System will provide their accredited services;

service levels relating to the availability and performance of the services participating relying parties are approved to provide, or provide access to, within the Australian Government Digital ID System.

must be in writing; and

must specify the period for which it is in force, which must not exceed 3 months; and

may be granted unconditionally or subject to conditions.

the accredited entity uses or discloses the information for the purposes of conducting testing in the Australian Government Digital ID System; and

the accredited entity or another entity is authorised under section 81 to conduct the testing using the information; and

the individual to whom the information relates has expressly consented to the use or disclosure of the information for that purpose.

the action or other proceeding is brought by the other entity or the participating relying party; and

subsection (1A) or (1B) applies.

the first entity does not comply with this Act (other than the service levels determined under section 80) in relation to the accredited service; and

the non-compliance is not the ground or cause for the action or other proceeding.

an accredited entity that holds an approval to participate in the Australian Government Digital ID System and each other accredited entity that also holds such an approval; and

an accredited entity and each participating relying party;

under which each accredited entity agrees to:

provide the entity’s accredited services while participating in the Australian Government Digital ID System in compliance with this Act (other than the service levels determined under section 80), to the extent it relates to verifying the identity of an individual or authenticating a digital ID of, or information about, an individual; and

comply with requirements in relation to intellectual property rights that are prescribed by the Digital ID Rules for the purposes of this paragraph.

starting on the day that the participation start day for both entities has arrived or passed; and

ending on the day on which the approval to participate in the Australian Government Digital ID System has been revoked for one or both of the entities.

an order giving directions to the respondent about compliance with, or enforcement of, the contract;

an order directing the respondent to compensate the entity that has suffered loss or damage as a result of the breach;

an order directing the respondent to prevent or reduce loss or damage suffered, or likely to be suffered;

any other order that the Court considers appropriate.

conduct or circumstances that do, or do not, constitute breaches of contract;

provision of this Act that are not covered by the contract;

limits on the kinds of losses or damages for which compensation may be payable;

limits on the amount of compensation that an accredited entity may be liable to pay.

the entities that are covered by the framework;

the kinds of incidents that are covered by the framework, which may include digital ID fraud incidents and cyber security incidents;

procedures for dealing with incidents that are covered by the framework;

requirements relating to notifying individuals affected by incidents covered by the framework;

the provision of information, support and assistance to individuals affected by incidents covered by the framework;

development and publication of policies relating to the identification, management and resolution of incidents covered by the framework;

development and publication of policies relating to complaints by individuals relating to incidents covered by the framework.

timeframes relating to the provision of support services to individuals affected by digital ID fraud incidents or cyber security incidents;

requirements relating to the kinds of information relating to support services that entities covered by the framework must make available, and the manner in which such information must be made available;

information that must be provided by entities covered by the framework to the Digital ID Regulator about the kinds of support services provided to individuals under the framework and the manner and timeframes in which such information must be provided.

the performance of the Digital ID Data Standards Chair’s functions; and

the exercise of the Digital ID Data Standards Chair’s powers;

during the period.

subsections (1) and (2) do not apply during that time; and

(b) the Department’s annual report under Public Governance, Performance and Accountability Act 2013 for the period that includes that time must include information about the performance of the Digital ID Data Standards Chair’s functions, and the exercise of the Digital ID Data Standards Chair’s powers, at that time.section 46 of the

remuneration for the purposes of subsection (1); and

allowances for the purposes of subsection (2).

for misbehaviour; or

if the Digital ID Data Standards Chair is unable to perform the duties of the Digital ID Data Standards Chair’s office because of physical or mental incapacity.

the Digital ID Data Standards Chair:

becomes bankrupt; or

applies to take the benefit of any law for the relief of bankrupt or insolvent debtors; or

compounds with the Digital ID Data Standards Chair’s creditors; or

makes an assignment of the Digital ID Data Standards Chair’s remuneration for the benefit of the Digital ID Data Standards Chair’s creditors; or

if the Digital ID Data Standards Chair is appointed on a full-time basis—the Digital ID Data Standards Chair is absent, except on leave of absence, for 14 consecutive days or for 28 days in any 12-month period; or

(c) the Digital ID Data Standards Chair fails, without reasonable excuse, to comply with Public Governance, Performance and Accountability Act 2013 (which deals with the duty to disclose interests) or rules made for the purposes of that section.section 29 of the

APS employees in the Department whose services are made available to the Chair, by the Secretary, in connection with the performance of any of the Chair’s functions or the exercise of any of the Chair’s powers; or

APS employees in another Department of the Commonwealth whose services are made available to the Chair, by the Secretary of that Department, in connection with the performance of any of the Chair’s functions or the exercise of any of the Chair’s powers.

the Information Commissioner or a member of staff of the Office of the Australian Information Commissioner who is an SES employee or acting SES employee are authorised applicants in relation to the civil penalty provisions in Division 2 of Part 2 of Chapter 3 of this Act (about additional privacy safeguards) and section 136 of this Act (about destruction etc. of certain information); and

the Digital ID Regulator is an authorised applicant in relation to every other civil penalty provision of this Act.

Relevant court

the Federal Court of Australia;

the Federal Circuit and Family Court of Australia (Division 2);

a court of a State or Territory that has jurisdiction in relation to the matter.

the Information Commissioner or a member of staff of the Office of the Australian Information Commissioner who is an SES employee or acting SES employee are infringement officers in relation to the civil penalty provisions in Division 2 of Part 2 of Chapter 3 of this Act (about additional privacy safeguards) and section 136 of this Act (about destruction etc. of certain information); and

the Digital ID Regulator is an infringement officer in relation to every other civil penalty provision of this Act.

Relevant chief executive

in relation to the provisions mentioned in paragraph (2)(a) of this section—the Information Commissioner; and

in relation to the provisions mentioned in paragraph (2)(b) of this section—the Digital ID Regulator.

the Information Commissioner is an authorised person in relation to the civil penalty provisions in Division 2 of Part 2 of Chapter 3 of this Act (about additional privacy safeguards) and section 136 of this Act (about destruction etc. of certain information); and

the Digital ID Regulator is an authorised person in relation to every other civil penalty provision of this Act.

Relevant court

the Federal Court of Australia;

the Federal Circuit and Family Court of Australia (Division 2);

a court of a State or Territory that has jurisdiction in relation to the matter.

Publishing undertakings

the Information Commissioner is an authorised person in relation to the civil penalty provisions in Division 2 of Part 2 of Chapter 3 of this Act (about additional privacy safeguards) and section 136 of this Act (about destruction etc. of certain information); and

the Digital ID Regulator is an authorised person in relation to every other civil penalty provision of this Act.

Relevant court

the Federal Court of Australia;

the Federal Circuit and Family Court of Australia (Division 2);

(c) a court of a State or Territory that has jurisdiction in relation to the matter.

give effect to a decision to accredit an entity as an accredited entity; or

give effect to a decision to suspend or revoke an entity’s accreditation as an accredited entity; or

deal with matters arising as a result of the suspension or revocation of an entity’s accreditation as an accredited entity; or

give effect to a decision to approve an entity to participate in the Australian Government Digital ID System; or

give effect to a decision to suspend or revoke an entity’s approval to participate in the Australian Government Digital ID System; or

deal with matters arising as a result of the suspension or revocation of an entity’s approval to participate in the Australian Government Digital ID System.

require an accredited identity exchange provider to:

provide information to an entity that holds an approval to participate in the Australian Government Digital ID System about the steps required to connect to the system; and

connect the entity to the Australian Government Digital ID System by a specified date; or

require an entity whose accreditation has been suspended or revoked to notify other participants in the digital ID system in which the entity participates of the suspension or revocation and the date on which the suspension or revocation takes effect.

be in writing; and

specify the reason for the direction.

accredited entities;

entities whose accreditation as an accredited entity is suspended.

conduct a privacy impact assessment in relation to a specified matter and provide a copy of the assessment to the Digital ID Regulator;

conduct a fraud assessment in relation to a specified matter and provide a copy of the report to the Digital ID Regulator in relation to the assessment;

conduct a security assessment in relation to a specified matter and provide a copy of the report to the Digital ID Regulator in relation to the assessment;

an act or thing specified by the Digital ID Rules.

be in writing; and

specify the reason for the direction.

be in writing; and

specify the reason for the direction.

entities that hold an approval to participate in the Australian Government Digital ID System;

entities whose approval to participate in the Australian Government Digital ID System is suspended.

take or not take specified action in relation to the performance of the Australian Government Digital ID System;

conduct a fraud assessment in relation to a specified matter and provide a copy of the report to the System Administrator in relation to the assessment;

conduct a security assessment in relation to a specified matter and provide a copy of the report to the System Administrator in relation to the assessment;

an act or thing specified by the Digital ID Rules.

be in writing; and

specify the reason for the direction.

for the purposes of determining whether the entity has complied, is complying or is able to comply with this Act; or

if the Digital ID Regulator is satisfied that any of the following has occurred, or is suspected to have occurred, in relation to an accredited entity:

a cyber security incident;

a digital ID fraud incident;

a serious or repeated breach of the Accreditation Rules;

an incident that is having, or may have, a material impact on the operation of the entity’s information technology systems through which it provides its accredited services;

an incident that is having, or may have, a material impact on the operation of the Australian Government Digital ID System;

a change to the entity’s operating environment that is having, or may have, a material impact on the entity’s risk profile; or

in circumstances specified in the Digital ID Rules.

the period within which the compliance assessment is to be undertaken; and

whether the compliance assessment must be undertaken:

by or on behalf of the Digital ID Regulator; or

by an independent assessor arranged by the entity.

processes to be followed during a compliance assessment or after a compliance assessment has been conducted;

information that must be provided to or by an entity during a compliance assessment or after a compliance assessment has been conducted;

requirements in relation to reports to be provided in relation to a compliance assessment;

actions the Digital ID Regulator may require the entity subject to a compliance assessment to take during the compliance assessment or after the assessment has been conducted.

whether an entity is complying, or has complied, with the entity’s obligations under this Act; or

the performance of the Digital ID Regulator’s functions, or the exercise of any of the Digital ID Regulator’s powers, under this Act.

to give to the Digital ID Regulator, within the period and in the manner and form specified in the notice, any such information; or

to produce to the Digital ID Regulator, within the period and in the manner specified in the notice, any such documents.

to give to the System Administrator, within the period and in the manner and form specified in the notice, any such information; or

to produce to the System Administrator, within the period and in the manner specified in the notice, any such documents.

the Digital ID Regulator for activities carried out by or on behalf of the Digital ID Regulator in performing functions or exercising powers under this Act; or

other persons to whom application may be made under this Act.

prescribe a fee by specifying the amount of the fee or a method of working out the fee;

specify that the amount of a fee is the cost incurred by the Digital ID Regulator in arranging and paying for another person to carry out a relevant activity;

make provision for when and how fees are to be paid;

make provision in relation to penalties for late payment of specified fees;

make provision in relation to the refund, remission or waiver of specified fees or penalties for late payment of specified fees.

start no later than 2 years after rules made for the purposes of subsection 144(1) commence; and

be completed within 12 months.

start no later than every 2 years after the completion of the previous review; and

be completed within 12 months.

to be prepared; and

to be tabled in each House of the Parliament within 15 sitting days of that House after the Minister receives the report.

prescribe a fee by specifying the amount of the fee or a method of working out the fee;

make provision for when and how fees may be charged;

make provision in relation to the conduct of periodic reviews of fees;

make provision for any other matters in relation to the charging of fees, including in relation to exemptions, refunds, remissions or waivers.