Commonwealth Coat of Arms of Australia

Digital ID (Transitional and Consequential Provisions) Act 2024

No. 26, 2024

An Act to deal with consequential and transitional matters arising from the enactment of the Digital ID Act 2024, and for related purposes

[Assented to 30 May 2024]

The Parliament of Australia enacts:

1 Short title

This Act is the Digital ID (Transitional and Consequential Provisions) Act 2024.

2 Commencement

(1) Each provision of this Act specified in column 1 of the table commences, or is taken to have commenced, in accordance with column 2 of the table. Any other statement in column 2 has effect according to its terms.

Commencement information
Column 1	Column 2	Column 3
Provisions	Commencement	Date/Details
1. The whole of this Act	At the same time as the Digital ID Act 2024 commences. However, the provisions do not commence at all if that Act does not commence.	30 November 2024

Note: This table relates only to the provisions of this Act as originally enacted. It will not be amended to deal with any later amendments of this Act.

(2) Any information in column 3 of the table is not part of this Act. Information may be inserted in this column, or information in it may be edited, in any published version of this Act.

3 Schedules

Legislation that is specified in a Schedule to this Act is amended or repealed as set out in the applicable items in the Schedule concerned, and any other item in a Schedule to this Act has effect according to its terms.

Schedule 1—Transitional and application provisions

Part 1—Introduction

1 Definitions

(1) In this Schedule:

Authentication Level 2 service has the meaning given by the Accreditation Rules.

biometric binding has the meaning given by the Accreditation Rules.

business authorisation, in relation to an attribute of an individual, means an authorisation for the individual to act on behalf of an entity that is registered in the Australian Business Register (within the meaning of the A New Tax System (Australian Business Number) Act 1999.

change of name certificate means a certificate issued by or on behalf of a State or Territory indicating that an individual has changed the individual’s name.

citizenship certificate means a notice given under section 37 of the Australian Citizenship Act 2007 stating that a person is an Australian citizen at a particular time.

commencement means the commencement of this Schedule.

driver’s licence means a driver’s licence (however described) issued by or on behalf of a State or Territory.

entry permit has the same meaning as in the Migration Act 1958 as in force immediately before 1 September 1994.

ImmiCard means a document issued to an individual, as a person who is not an Australian citizen, by the Department administered by the Minister administering the Migration Act 1958 to assist the individual to prove the individual’s identity.

IP1 means the identity proofing level of that name as set out in the Accreditation Rules.

IP2 means the identity proofing level of that name as set out in the Accreditation Rules.

IP3 means the identity proofing level of that name as set out in the Accreditation Rules.

marriage certificate means a certificate of marriage issued by or on behalf of an authority of a State or Territory whose function it is to register marriages.

medicare card has the same meaning as in Part VII of the National Health Act 1953.

medicare number has the same meaning as in Part VII of the National Health Act 1953.

myGov means the online portal of that name used to access government services.

passport means an Australian travel document (within the meaning of the Australian Passports Act 2005).

source biometric matching has the meaning given by the Accreditation Rules.

transitional rules means rules made under item 10.

visa has the same meaning as in the Migration Act 1958.

(2) Expressions used in this Schedule that are defined for the purposes of the Digital ID Act 2024 have the same meaning as in that Act.

Part 2—Accreditation

2 Entities taken to be accredited

The Digital ID Regulator is taken, immediately after commencement, to:

(a) have decided for the purposes of subsection 15(2) of the Digital ID Act 2024 to accredit an entity specified in column 1 of an item of the following table as the kind of accredited entity specified in column 2 of the item; and

(b) have imposed the conditions, if any, specified in column 3 of the item on the entity’s accreditation for the purposes of subsection 17(2) of the Digital ID Act 2024.

Entities taken to be accredited as accredited entities
Item	Column 1 Entity	Column 2 Accreditation	Column 3 Conditions
1	Commissioner of Taxation	Accredited attribute service provider	The entity’s accredited services must be provided only for business authorisations for the purpose of the Commonwealth Government service known as Relationship Authorisation Manager
2	Commissioner of Taxation	Accredited identity service provider	All of the following: (a) the entity’s accredited services must be provided only for the purpose of the Commonwealth Government service known as myGovID; (b) the entity is authorised to collect, use and disclose biometric information for the purposes of verifying the identity of an individual using facial images; (c) the entity must provide only IP1, IP2 and IP3 services; (d) digital IDs generated by the service must be re‑usable; (e) the entity is authorised to provide only an Authentication Level 2 service using multi‑factor cryptographic software; (f) the entity must provide biometric binding only online and only by using source biometric matching; (g) the service must be provided through a mobile application; (h) the entity is authorised to disclose the following kinds of restricted attributes of individuals to the entity referred to in column 1 of item 8 of the table in subitem 4(2): (i) Australian passport numbers and expiry dates; (ii) medicare numbers and medicare card expiry dates; (iii) Australian citizenship certificate numbers, acquisition dates and countries of birth; (iv) visa or entry permit numbers and countries of issue; (v) driver’s licence numbers, States and Territories of issue, dates of issue and expiry dates; (vi) ImmiCard numbers; (vii) marriage certificate document numbers and certificate printed dates, registration dates and States and Territories of registration; (viii) change of name certificate numbers and certificate printed dates, registration numbers, registration dates and States and Territories of registration; including, in respect of each document referred to in subparagraphs (i) to (viii), a document of that kind issued in the individual’s current name or former name
3	Services Australia	Accredited identity exchange provider
4	An entity prescribed by the transitional rules made for the purposes of this item	An accredited entity of a kind prescribed by the transitional rules made for the purposes of this item	Conditions prescribed by the transitional rules made for the purposes of this item

3 Application of accreditation provisions in Digital ID Act 2024 for entities taken to be accredited

(1) This item applies in relation to an entity that is an accredited entity because of the operation of item 2.

(2) For the purposes of paragraph 15(6)(a) of the Digital ID Act 2024, the Digital ID Regulator is taken to have given written notice of the decision to accredit the entity.

(3) The notice referred to in subitem (2) is taken to have complied with subsection 15(7) of the Digital ID Act 2024.

(4) For the purposes of paragraph 15(7)(a) of the Digital ID Act 2024, the Digital ID Regulator is taken to have notified the entity that the entity is the kind of accredited entity specified in column 2 of the item of the table in item 2 that relates to the entity.

(5) For the purposes of paragraph 15(7)(b) of the Digital ID Act 2024, the Digital ID Regulator is taken to have notified the entity that the day on which the entity’s accreditation comes into force is the day this Schedule commences.

(6) For the purposes of paragraph 15(7)(c) of the Digital ID Act 2024, the Digital ID Regulator is taken to have notified the entity of the conditions set out in column 3 of the item of the table in item 2 that relate to the entity.

(7) A decision taken to have been made because of the operation of paragraph 2(b) is not a reviewable decision for the purposes of the Digital ID Act 2024.

Part 3—Approval to participate in the Australian Government Digital ID System

4 Certain entities are taken to be approved to participate in the Australian Government Digital ID System

Accredited entities

(1) The Digital ID Regulator is taken, immediately after commencement, to:

(a) have approved an entity specified in column 1 of an item of the following table to participate in the Australian Government Digital ID System for the purposes of section 62 of the Digital ID Act 2024 as the kind of accredited entity specified in column 2 of the item; and

(b) have imposed the conditions specified in column 3 of the item on the entity’s approval for the purposes of subsection 64(2) of the Digital ID Act 2024.

Accredited entities taken to be approved to participate in the Australian Government Digital ID System
Item	Column 1 Entity	Column 2 Kind of entity	Column 3 Conditions
1	Commissioner of Taxation	Accredited attribute service provider	The entity must: (a) provide its accredited services for the purpose of the Commonwealth Government service known as Relationship Authorisation Manager (b) directly connect to the entity referred to in column 1 of item 3
2	Commissioner of Taxation	Accredited identity service provider	The entity must: (a) provide its accredited services only for the purpose of the Commonwealth Government service known as myGovID; and (b) directly connect to the entity referred to in column 1 of item 3
3	Services Australia	Accredited identity exchange provider	The entity must directly connect to the entity referred to in column 1 of item 2
4	An entity prescribed by the transitional rules made for the purposes of this item	An accredited entity of a kind prescribed by the transitional rules made for the purposes of this item	Conditions prescribed by the transitional rules made for the purposes of this item

Participating relying parties

(2) The Digital ID Regulator is taken, immediately after commencement, to:

(b) have imposed the conditions specified in column 2 of the item on the entity’s approval for the purposes of subsection 64(2) of the Digital ID Act 2024.

Relying parties taken to be approved to participate in the Australian Government Digital ID System
Item	Column 1 Entity	Column 2 Conditions
1	Australian Communications and Media Authority	The entity: (a) is approved to provide, or provide access to, the service known as ACMA Assist within the Australian Government Digital ID System; and (b) must directly connect to the entity referred to in column 1 of item 3 of the table in subitem (1)
2	Australian Financial Security Authority	The entity: (a) is approved to provide, or provide access to, the service known as the Personal Debt Portal within the Australian Government Digital ID System; and (b) must directly connect to the entity referred to in column 1 of item 3 of the table in subitem (1)
3	Australian Sports Commission	The entity: (a) is approved to provide, or provide access to, the service known as SportAUS Connect within the Australian Government Digital ID System; and (b) must directly connect to the entity referred to in column 1 of item 3 of the table in subitem (1)
4	Commissioner of Taxation	The entity: (a) is approved to provide, or provide access to, the services known as the online Tax File Number service and ATO Online Services for Individuals within the Australian Government Digital ID System; and (b) must directly connect to the entity referred to in column 1 of item 3 of the table in subitem (1)
5	Civil Aviation Safety Authority	The entity: (a) is approved to provide, or provide access to, the service known as myCASA within the Australian Government Digital ID System; and (b) must directly connect to the entity referred to in column 1 of item 3 of the table in subitem (1)
6	Commonwealth Department of Defence	The entity: (a) is approved to provide, or provide access to, the services known as myClearance and ServiceConnect within the Australian Government Digital ID System; and (b) must directly connect to the entity referred to in column 1 of item 3 of the table in subitem (1)
7	IP Australia	The entity: (a) is approved to provide, or provide access to, the service known as the Online Service Portal within the Australian Government Digital ID System; and (b) must directly connect to the entity referred to in column 1 of item 3 of the table in subitem (1)
8	Services Australia	The entity: (a) is approved to provide, or provide access to, the services listed in subitem (3) within the Australian Government Digital ID System; and (b) must directly connect to the entity referred to in column 1 of item 3 of the table in subitem (1); and (c) in providing, or providing access to, the service known as Centrelink, it is authorised to collect the following kinds of attributes of individuals: (i) family names, given names, middle names and dates of birth stated on Australian passports; (ii) family names and given names stated on medicare cards; (iii) family names, given names and dates of birth stated on Australian citizenship certificates; (iv) family names, given names and dates of birth stated on visas or entry permits; (v) family names, given names, middle names and dates of birth stated on Australian driver’s licences; (vi) family names, given names and dates of birth stated on ImmiCards; (vii) family names, given names, middle names, secondary family names, secondary given names and secondary middle names stated on marriage certificates; (viii) the new family names, new given names, new middle names, previous family names, previous given names, previous middle names and dates of birth stated on change of name certificates; including, in respect of each document referred to in subparagraphs (i) to (viii), a document of that kind issued in the individual’s current name or former name; and (d) is authorised, subject to paragraph (e), to collect the following kinds of restricted attributes of individuals: (i) Australian passport numbers and expiry dates; (ii) medicare numbers and medicare card expiry dates; (iii) Australian citizenship certificate numbers, acquisition dates and countries of birth; (iv) visa or entry permit numbers and countries of issue; (v) Australian driver’s licence numbers, States and Territories of issue, dates of issue and expiry dates; (vi) ImmiCard numbers; (vii) marriage certificate document numbers and certificate printed dates, registration dates and States and Territories of registration; (viii) change of name certificate numbers and certificate printed dates, registration numbers, registration dates and States and Territories of registration; including, in respect of each document referred to in subparagraphs (i) to (viii), a document of that kind issued in the individual’s current name or former name; and (e) must only collect the restricted attributes of individuals specified in paragraph (d) for the following purposes: (i) to verify an individual’s identity to the extent necessary to perform the service delivery functions set out in section 8A of the Human Services (Centrelink) Act 1997; (ii) to comply with paragraphs 10(e) and (f) of the Public Governance, Performance and Accountability Rule 2014
9	Student Identifiers Registrar (within the meaning of the Student Identifiers Act 2014)	The entity: (a) is approved to provide, or provide access to, the service known as the USI Student Portal within the Australian Government Digital ID System; and (b) must directly connect to the entity referred to in column 1 of item 3 of the table in subitem (1)
10	An entity prescribed by the transitional rules made for the purposes of this item	Conditions prescribed by the transitional rules made for the purposes of this item

(3) For the purpose of item 8 of the table in subitem (2), the services are as follows:

(a) the service known as Apprenticeships Data Management System for Individuals;

(b) the service known as ATO Online Services for Individuals;

(d) the service known as Child Support;

(e) the service known as the Department of Health Applications Portal;

(f) the service known as the Digital Identity Dashboard;

(g) the service known as the Individual Healthcare Identifiers Service;

(h) the service known as Medicare Online;

(i) the service known as My Aged Care Online Account;

(j) the service known as myGov;

(k) the service known as My Health Record;

(l) the service known as MyService;

(m) the service known as the National Cancer Screening Register Participant Portal;

(n) the service known as the National Disability Insurance Scheme myplace Participant Portal;

(o) the service known as the National Redress Scheme;

(p) the service known as Workforce Australia for Individuals.

(4) Subsections 65(2) and (3) of the Digital ID Act 2024 (about conditions relating to restricted attributes of individuals) do not apply in relation to:

(a) the conditions taken to be imposed under paragraph (d) of column 2 of item 8 of the table in subitem (2); or

(b) conditions prescribed by the transitional rules made for the purposes of item 4 of the table in subitem (1) or item 10 of the table in subitem (2) that authorise an entity to collect and disclose restricted attributes.

5 Application of certain provisions in Digital ID Act 2024 for entities taken to be approved to participate

(1) This item applies in relation to an entity that holds an approval to participate in the Australian Government Digital ID System because of the operation of subitem 4(1) or (2).

(2) For the purposes of paragraph 62(5)(a) of the Digital ID Act 2024, the Digital ID Regulator is taken to have given written notice of the decision to approve the entity to participate in the Australian Government Digital ID System.

(3) The notice referred to in subitem (2) is taken to have complied with subsection 62(6) of the Digital ID Act 2024.

(4) For the purposes of paragraph 62(6)(a) of the Digital ID Act 2024, the Digital ID Regulator is taken to have notified the entity that the day the entity’s approval to participate in the Australian Government Digital ID System comes into force is the day this Schedule commences.

(5) For the purposes of paragraph 62(6)(c) of the Digital ID Act 2024, the Digital ID Regulator is taken to have notified the entity of the conditions set out in column 3 of the item of the table in subitem 4(1) or (2) that relate to the entity.

(6) For the purposes of paragraph 62(6)(d) of the Digital ID Act 2024, the Digital ID Regulator is taken to have notified the entity that the day on which the entity must begin to participate in the Australian Government Digital ID System is the day this Schedule commences.

(7) For the purposes of paragraph 64(1)(c) of the Digital ID Act 2024, the entity is taken to have begun participating in the Australian Government Digital ID System on the day this Schedule commences.

(8) A decision taken to have been made because of the operation of paragraph 4(1)(b) or (2)(b) is not a reviewable decision for the purposes of the Digital ID Act 2024.

Part 4—Other matters

6 Application of the Digital ID Act 2024—information or documents

Section 133 of the Digital ID Act 2024 applies to notices given after commencement, regardless of whether the information or documents came into existence before or after that commencement.

7 Digital ID Regulator—first annual report

(1) This section applies if the Digital ID Act 2024 commences less than 6 months before the end of a financial year (the first year).

(2) Section 154 of the Digital ID Act 2024 does not apply in relation to the first year.

(3) Instead, that section applies in relation to the next financial year as if the next financial year also included the period:

(a) starting at commencement; and

(b) ending at the end of the first year.

8 Information Commissioner—first annual report

(1) This section applies if the Digital ID Act 2024 commences less than 6 months before the end of a reporting period (the first reporting period) for the Information Commissioner.

(2) Section 155 of the Digital ID Act 2024 does not apply in relation to the first reporting period.

(3) Instead, that section applies in relation to the next reporting period as if the next reporting period also included the period:

(a) starting at commencement; and

(b) ending at the end of the first reporting period.

(4) In this item, reporting period has the same meaning as in the meaning of the Public Governance, Performance and Accountability Act 2013.

9 Rules—requirement to consult

Section 169 of the Digital ID Act 2024 does not apply in relation to rules made under section 168 of that Act between the period:

(a) starting on the day this Act receives the Royal Assent; and

(b) ending 6 months after commencement.

10 Transitional rules

(1) The Minister may, by legislative instrument, make rules prescribing matters:

(a) required or permitted by this Schedule to be prescribed by the rules; or

(b) necessary or convenient to be prescribed for carrying out or giving effect to this Schedule.

(2) Without limiting subitem (1), the rules may prescribe matters of a transitional nature (including prescribing any saving or application provisions) relating to the enactment of this Schedule or the Digital ID Act 2024.

(3) Rules made for the purposes of this item before the end of 12 months after commencement may provide that this Act or the Digital ID Act 2024 have effect with any modifications prescribed by the rules.

(4) To avoid doubt, the rules may not do the following:

(a) create an offence or civil penalty;

(b) provide powers of:

(i) arrest or detention; or

(ii) entry, search or seizure;

(d) set an amount to be appropriated from the Consolidated Revenue Fund under an appropriation in this Act;

(e) directly amend the text of this Act or the Digital ID Act 2024.

(5) This Act (other than subitem (4)) does not limit the rules that may be made.

Schedule 2—Consequential amendments

Administrative Decisions (Judicial Review) Act 1977

1 At the end of Schedule 1

Add:

; (zj) decisions under the Digital ID Act 2024, in relation to an entity (within the meaning of that Act) that is not an Australian entity (within the meaning of that Act), for reasons of security (within the meaning of the Australian Security Intelligence Organisation Act 1979).

Age Discrimination Act 2004

2 Schedule 2 (at the end of the table)

Add:

Accreditation Rules made under the Digital ID Act 2024

rules made for the purposes of paragraph 28(2)(i) of the Digital ID Act 2024

Australian Security Intelligence Organisation Act 1979

3 Subsection 35(1) (after paragraph (c) of the definition of prescribed administrative action)

Insert:

(ca) the exercise of a power under Chapter 2 or 4 of the Digital ID Act 2024; or

4 After paragraph 36(1)(ba)

Insert:

(bb) a security assessment in relation to an exercise of a power under Chapter 2 or 4 of the Digital ID Act 2024 in respect of an entity (within the meaning of that Act) that is not an Australian entity (within the meaning of that Act); or

Competition and Consumer Act 2010

5 Subsections 19(1) and (7)

After “this Act,”, insert “the Digital ID Act 2024,”.

Privacy Act 1988

6 At the end of subsection 33C(1)

Add:

; (g) whether personal information (within the meaning of the Digital ID Act 2024) is being maintained and handled in accordance with the following:

(i) Division 2 of Part 2 of Chapter 3 of that Act, including rules made for the purposes of that Division;

(ii) the term in APP‑equivalent agreements (within the meaning of that Act) prohibiting collecting, holding, using or disclosing personal information (within the meaning of that Act) in any way that would breach an Australian Privacy Principle.

Taxation Administration Act 1953

7 At the end of Part IA

Add:

3J Functions relating to digital ID systems

(1) The Commissioner’s functions include providing services, or access to services, within digital ID systems.

(2) Without limiting subsection (1), the Commissioner may participate within the Australian Government Digital ID System as one or more kinds of accredited entities.

(3) The Commissioner has power to do all things that are necessary or convenient to be done for or in connection with the performance of the Commissioner’s functions under this section.

(4) This section does not limit any functions or powers the Commissioner has apart from this section.

(5) To avoid doubt:

(a) the Digital ID Act 2024 is not a taxation law; and

(b) the functions referred to in subsection (1) are not performed under, or for the purposes of, a taxation law.

(6) In this section:

accredited entity has the same meaning as in the Digital ID Act 2024.

Australian Government Digital ID System has the same meaning as in the Digital ID Act 2024.

digital ID system has the same meaning as in the Digital ID Act 2024.

[Minister’s second reading speech made in—

Senate on 30 November 2023

House of Representatives on 15 May 2024]

(159/23)