MOU between the ACCC, OAIC and Chief Executive Centrelink: Digital ID

Part 1: Parties to the MOU

1.1 The parties to this Memorandum of Understanding (MOU) are the Australian Competition and Consumer Commission ( ACCC ), the Office of the Australian Information Commissioner ( OAIC ), and Chief Executive Centrelink, in their capacity as System Administrator ( CEC ) (together the Parties ). In this MOU, the term ‘Party’ will mean either the ACCC, OAIC or CEC, as the context allows.

1.2 The ACCC is an independent Commonwealth statutory authority. The ACCC is the Digital ID Regulator of Australia’s Digital ID System whose functions include, but are not limited to, promoting compliance, administering the accreditation scheme, approving entities to participate in the Australian Government Digital ID System (AGDIS), overseeing and maintaining the AGDIS and consulting with a range of government bodies on matters relating to the Digital ID Act 2024 (Cth) (the Act).

1.3 The OAIC is the independent national regulator for privacy and freedom of information. The OAIC’s functions include investigation and enforcement of privacy breaches, undertaking assessments of the handling and maintenance of personal information in accordance with the Act and performing Notifiable Data Breach scheme functions in relation to Australia’s Digital ID System.

1.4 The CEC is the System Administrator for the AGDIS as established by the Act whose functions include, but are not limited to, providing assistance to entities participating in the AGDIS, managing the availability of the AGDIS and digital ID fraud/cyber incidents and identifying and managing operational risks. Employees of Services Australia may assist the CEC in the performance of their functions or perform these functions as their delegate.

Part 2: Purpose and function of the MOU

2.1 This MOU relates to Digital ID matters only.

2.2 The Parties all have separate, distinct and independent roles in Australia’s Digital ID System and each will act independently in carrying out their role and exercising powers and functions related to Australia’s Digital ID system.

2.3 However, there are areas where the Parties may cooperate and share information to carry out their respective Digital ID functions.

2.4 The Parties recognise that cooperation may contribute significantly to the effective operation of the Digital ID system, and the ability of the Parties to effectively discharge their respective Digital ID functions, including in relation to compliance and enforcement.

2.5 This MOU recognises the need to ensure any information sharing that occurs between the Parties is done lawfully to enable the performance of each Party’s respective regulatory roles for the purposes of the Act and in accordance with the Parties’ respective information sharing provisions.

Part 3: Engagement with Department of Finance and Data Standards Body

3.1 The Parties recognise that while this MOU aims to facilitate their cooperation, the Parties will also engage with the Department of Finance and the Data Standards Body ( DSB ), given their roles in Australia’s Digital ID System.

3.2 The Department of Finance is responsible for whole of government coordination of digital ID policy and supports the Minister for Finance in administering the Act. This includes advising the Minister in relation to rules and other legislative instruments that the Minister is required or permitted to make under the Act. These rules deal with matters that impact the Parties in relation to their regulatory functions concerning Australia’s Digital ID System.

3.3 The DSB sits within the Department of the Treasury and supports the Digital ID Data Standards Chair to undertake their functions to make and review Digital ID data standards, including technical integration requirements for entities to participate in the AGDIS, and to determine service levels that apply to AGDIS participants and relying parties.

3.4 The Parties have independent functions and powers. However, the Parties agree to work effectively with the Department of Finance and DSB to ensure a cooperative approach to the delivery of certain Digital ID functions and objectives, where appropriate. Where the Parties need to make disclosures of information in these circumstances, these will be done in accordance with relevant legal frameworks.

Part 4: Scope of the MOU

4.1 This MOU does not create any enforceable rights or impose any legally binding obligations on any Party.

4.2 The MOU is not intended to be exhaustive in the subject matters within its scope. The Parties may enter into any other arrangements for cooperation and collaboration to the full extent permitted by the law.

4.3 Nothing in this MOU affects the exercise of the legislative function s, powers, duties or obligations of any Party.

Part 5: Commencement, review, and termination

5.1 This Agreement commences upon signing by all Parties and should be reviewed at least every 2 years upon commencement, or as required, including due to changes in regulatory responsibility as a result of machinery of Government or other Government change, by agreement of all Parties.

5.2 Any Party may in writing to the other Parties request a variation of the MOU at any time. A variation is made when agreed in writing by all Parties.

5.3 Any Party may terminate this MOU by giving at least 30 days written notice to the other Parties. The termination will take effect 30 days after the notice is sent, unless otherwise agreed, in writing, between the Parties.

Part 6: Opportunities for cooperation

6.1 The Parties will act independently, and each has independent functions and powers within Australia’s Digital ID system.

6.2 The Parties recognise that there may be occasions where consultation, or where appropriate, cooperation will support the effective or efficient performance of their independent functions. In those situations, the parties may seek to consult and, if appropriate, cooperate with each other.

6.3 The Parties may develop appropriate processes and protocols or frameworks for consultation or cooperation when undertaking their independent Digital ID functions, where appropriate.

6.4 The schedules attached to this MOU may set out protocols or frameworks for some potential areas of consultation and cooperation, namely:

1. how the Parties may lawfully share information with one another to support their independent Digital ID functions; and
2. the operational and technical ways the Parties may interact to support their independent Digital ID functions.

6.5 Once this MOU is executed, any Schedules will be valid. Schedules can be approved or amended by written agreement of the relevant decision maker or delegate within each Party.

Part 7: Confidentiality

7.1 Information sharing undertaken in accordance with this MOU is subject to all applicable confidentiality, secrecy and privacy requirements under the laws applicable to the Parties in their respective jurisdictions.

Part 8: Methods of communication

8.1 The Parties will communicate as the need arises and may agree to establish regular meetings to facilitate cooperation pursuant to this MOU.

8.2 Communication between the Parties may occur through email, in-person or virtual meetings, reports or telephone calls and will be determined by the nature and urgency of the matter.

Part 9: Triage of complaints, enquiries and notifications as appropriate

9.1 There may be instances where the Parties receive complaints, reports, enquiries or notifications that are best dealt with by another Party to the MOU or the agency with administrative responsibility. Where possible and in accordance with legal requirements, relevant Parties will share information and enable the transfer of a matter via the agreed process as identified in the relevant Schedule/s.

Part 10: Dispute resolution

10.1 Where a dispute arises between the Parties regarding this MOU, the Parties will make reasonable attempts to resolve the dispute at the contact officer level, and if necessary, escalate to SES to reach a mutually acceptable outcome.

Part 11: Publication of MOU

11.1 The Parties agree that this MOU, including schedules, may be published as each Party considers appropriate including by placing it on the Party's website.

Signatures and Execution

Michael John Keogh

Acting Chairperson

Australian Competition and Consumer Commission

Date: 6 December 2024

Elizabeth Tydd

Australian Information Commissioner

Office of the Australian Information Commissioner

Date: 6 December 2024

David Hazlehurst

Chief Executive Centrelink (within the meaning of the Human Services (Centrelink) Act 1997)

Date: 6 December 2024