Key points

The Digital ID Bill 2024 and Digital ID (Transitional and Consequential Provisions) Bill 2024 were passed by the Australian Parliament on 16 May 2024, with the Acts expected to commence by November 2024.

The Accreditation Scheme will be voluntary for digital ID service providers and aims to provide individuals with more convenient and secure ways to verify their identity online. 

It is expected that within two years of the Acts commencing, private sector entities will be able to apply to participate as providers or users of accredited digital ID services, or both. 

What will the Digital ID legislation entail? 

1.Accreditation Scheme for Digital ID Services:

The Digital ID Bill 2024 and Digital ID (Transitional and Consequential Provisions) Bill 2024 (Digital ID legislation) will implement a voluntary accreditation scheme for digital ID services.

While application to the Accreditation Scheme is not compulsory for digital ID service providers, if accredited, entities must then adhere to privacy safeguards additional to those in the Privacy Act 1988 (Cth).

This scheme ensures that accredited service providers meet specific, nationally consistent standards, enhancing the security and reliability of digital identity verification processes.

2. Expanding the Australian Government Digital ID System:

The Digital ID legislation will expand the existing Australian Government Digital ID System (AGDIS) to facilitate shared use of Digital IDs between public and private sector entities.

This expansion aims to facilitate efficient and secure interactions between government agencies and private businesses by streamlining processes such as accessing government services, financial transactions and online registrations. This will enable businesses to verify their customers’ identities more easily and securely.

3. Regulation of Accredited Digital ID Service Providers:

The Digital ID legislation introduces robust privacy safeguards to protect individuals’ personal information, which builds upon the protections in the Privacy Act 1988 (Cth). Penalties will apply for accredited providers which fail to protect privacy and security as required by their accreditation.

The ACCC will initially oversee compliance with the accreditation scheme in its role as the Digital ID Regulator. Additionally, the Information Commissioner will regulate privacy protections specifically related to digital IDs.

Impact of the changes on the private sector

This legislation will allow private sector entities to access accredited digital ID service providers to verify their customers. The Digital ID legislation’s implementation of nationally standardised accreditation criteria means businesses will have more secure and efficient ways to verify their customers’ identities online and to interact with government agencies.

Next Steps

1. Organisations offering digital ID services should prepare to meet the accreditation requirements under the Digital ID legislation ahead of the November 2024 commencement. Accredited entities will have greater opportunity to engage with government agencies and private organisations requiring digital identity services.
2. Businesses already using digital ID services should consider the potential risks involved in continuing to use non-accredited service providers once the Digital ID legislation has commenced and service providers are able to be accredited.