On 30 November 2023, the Digital ID Bill 2023 (Cth) and the Digital ID (Transitional and Consequential Provisions) Bill 2023 (Digital ID Bills) were introduced in the Australian Senate. Digital IDs are designed to provide individuals with a convenient way to verify their identity when completing certain online transactions and dealing with government and certain businesses. This acts as an alternative to repeatedly providing details or copies of personal and sensitive identification documents with third parties that may be vulnerable to cyber-attacks.
What are the stated objectives of the Digital ID Bill?
While the Australian Government has an existing digital identification system, the Australian Digital ID System (which has been the subject of significant criticism due to its lack of user friendliness and poor information architecture), the Digital ID Bills are designed to:
- “legislate and strengthen a voluntary Accreditation Scheme for digital ID service providers that wish to demonstrate compliance with best practice privacy, security, proofing and authentication standards;
- legislate and enable expansion of the Australian Government Digital ID System (AGDIS) for use by the Commonwealth, State and Territory governments and eventually private sector organisations;
- embed strong privacy and consumer safeguards, in addition to the Privacy Act 1988 (Cth) to ensure users are protected; and
- strengthen governance arrangements for the Accreditation Scheme and the AGDIS, including by establishing the Australian Competition and Consumer Commission (ACCC) as the Digital ID Regulator, and expanding the role of the Information Commissioner to regulate privacy protections for digital IDs. Both these regulators will have a broad range of powers under the Bill, including to issue civil penalties.”[1]
Ultimately, the Digital ID Bills purported aim is to assist online transactions with government and businesses by providing individuals with secure, voluntary and convenient ways to verify their identity.
What is a Digital ID service provider?
As stated in the Explanatory Memorandum, once the Bill is enacted, accreditation will be available for three (3) kinds of digital ID services:
- attribute service provider;
- identity exchange provider; and
- identity service provider.
These services are found in the federated digital ID system, which involves an identity exchange that facilitates data flows between service providers and the organisations that use their services, which are referred to as “relying parties”.
Relevant definitions contained in clause 9 of the Digital ID Bill
- Accredited Service means “the services provided, or proposed to be provided, by the entity in the entity’s capacity as a particular kind of accredited entity”.[2]
- Digital ID means “a distinct electronic representation of the individual that enables the individual to be sufficiently distinguished when interacting online with services”.[3]
- Digital ID System means “a federation of entities that facilitates or manages the verification of an individual’s identity and/or, after verifying the identity, the authentication of that digital ID or information about the individual”.[4]
- Digital ID Regulator means “the Australian Competition and Consumer Commission”.[5]
- Participate means “an entity participates in the Australian Government Digital ID System at a particular time if, at that time: the entity holds an approval under section 62 to participate in the system and either the entity is directly connected to an accredited entity that is participating in the Australian Government Digital ID System or the entity is an accredited entity that is directly connected to a participating relying party”.[6]
- Personal Information means “information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information or opinion is true or not and includes an attribute of an individual”.[7]
- Relying Party means “an entity that relies, or seeks to rely, on an attribute of an individual that is provided by an accredited entity to provide a service to the individual or enable the individual to access a service”.[8]
What are the expected benefits of the legislation?
It has been stated by the Australian Digital ID System that the accreditation scheme and the AGDIS is predicted to be significantly beneficial to consumers, businesses, the government, and broader economy.
- For consumers, the introduction of this legislation will ensure that Digital ID providers will be governed by legislation to ensure the privacy and security of Australian users information.
- For businesses, the introduction of this legislation will result in a simpler way for customers to verify their identity when transacting. In addition, businesses will have access to a market of accredited Digital ID providers that will ease the minds of customers.
- For the government, the introduction of this legislation will streamline processes across agencies and improve security. This will ultimately make it easier for individuals to access government services and decrease the risk of identity fraud.
How will Digital ID service providers be regulated?
According to the Australian Digital ID System, the ACCC will be appointed as the initial regulator of the Digital ID and will be responsible for:
- “accrediting Digital ID services against the Digital ID Bill and Accreditation Rules;
- approving which services can participate in the AGDIS; and
- using its investigative and compliance powers in the legislation to ensure Digital ID providers and services comply with the legislation to keep people’s information safe.”
Privacy-related aspects of the Digital ID accreditation scheme will be regulated by the Information Commissioner to ensure the protection of individuals choosing to use an accredited Digital ID provider.
Links and further references
Legislation
Explanatory Memorandum to the Digital ID Bill 2023 (Cth)
Australian Government – Digital ID Act 2024
Further information about digital ID confirmation
If your business needs advice on implementing digital ID confirmation, contact us for a confidential and obligation-free discussion:
Malcolm Burrows B.Bus.,MBA.,LL.B.,LL.M.,MQLS.
Legal Practice Director
T: +61 7 3221 0013 (preferred)
M: +61 419 726 535
E: mburrows@dundaslawyers.com.au
Disclaimer
This article contains general commentary only. You should not rely on the commentary as legal advice. Specific legal advice should be obtained to ascertain how the law applies to your particular circumstances.
[1] Explanatory Memorandum, Digital ID Bill 2023 (Cth).
[2] Digital ID Bill 2023 (Cth) s 9.
[3] Digital ID Bill 2023 (Cth) s 9.
[4] Digital ID Bill 2023 (Cth) s 9.
[5] Digital ID Bill 2023 (Cth) s 90.
[6] Digital ID Bill 2023 (Cth) s 9.
[7] Digital ID Bill 2023 (Cth) s 9.
[8] Digital ID Bill 2023 (Cth) s 9.
Related insights about digital ID confirmation
-
A bet or a game? The Lottoland decision
The Supreme Court of New South Wales has ruled in favour of Lottoland Australia Pty Ltd, affirming that its disputed products fall under the exception of an Excluded Wagering Service as defined by the Interactive Gambling Act 2001 (Cth), clarifying the distinction between ‘bets’ and ‘games’.
-
Abhorrent violent content prohibited
Organizations hosting abhorrent violent material, such as terrorism, murder, torture, rape and kidnapping, now face hefty fines under the Criminal Code Amendment Act 2019 (Cth), up to 50,000 penalty units or 10% of annual turnover.
-
Domain name disputes – the case of eazyjet.com
Learn more about domain name disputes and the evidence required to establish confusion, rights, and bad faith. Internet Corporation for Assigned Names and Numbers (ICANN) and World Intellectual Property Organization (WIPO) provide legal elements and remedies, and the implications of failing to respond to a complaint.
-
EU General Data Protection Regulations (GDPR) – How to comply
The General Data Protection Regulation (GDPR) applies to Australian entities processing personal data of European Union (EU) citizens/residents. It outlines principles, notification obligations, penalties for non-compliance, and requirements for cross-border data transfers.
-
Legal challenges arising from data loss
Organisations must protect confidential data from external and internal threats. Learn steps to secure data, potential data breach implications, and how a data breach notification bill may require affected entities to notify consumers.
-
Data Breach Bill 2016 – key data security considerations
The Privacy Amendment (Notifiable Data Breaches) Bill 2016 has been passed, making notification of data breaches mandatory from 23 February 2018. Find out how this could affect you and what measures you can take to protect your data.
-
Legal risks in the in-app purchase model
Software developers and publishers are offering users the chance to make In-App Purchases within their software, but there are legal risks involved. Learn how to protect yourself and your business by understanding the requirements of distribution platforms and Australian consumer law.
-
Letting go of employees threatening to go to the media
When employees leak confidential information or threaten to go to the media, employers can face serious consequences. Find out what the Fair Work Commission says about this issue and what options employers have to protect themselves.
-
What exactly is an advertising sign-off?
Injunctions are Court orders that can restrain almost any conduct. Prohibitory, Mandatory, and Ex Parte injunctions can be sought if serious question to be tried, urgency, damages would not suffice, and the balance of convenience favours the applicant.
