Digital ID

A digital ID is an electronic representation of an individual that enables them to be sufficiently identified when interacting with online services.

The Digital ID Act 2024 (Digital ID Act) and the Digital ID (Transitional and Consequential Provisions) Act 2024 enables the Commonwealth to partner with states, territories and the private sector to create a better Digital ID experience for all Australians.

The legislation provides strong privacy safeguards when creating and using Digital IDs from accredited providers. The safeguards build upon the protections in the Privacy Act 1988 (Cth) with penalties for accredited providers if they fail to protect the privacy and security of consumers.

For more information, see the Australian Government's official Digital ID system website.

The OAIC is the privacy regulator of Digital ID and is responsible for ensuring individuals’ privacy is protected.

The OAIC’s role includes:

• providing oversight of the additional privacy safeguards (that apply to all accredited providers in their provision of accredited services), including complaint-handling, investigations and taking enforcement action
• performing Notifiable Data Breach scheme functions in relation to the Digital ID system
• undertaking assessments of Digital ID system compliance by accredited providers.

The privacy obligations in the Digital ID legislation operate in addition to the general obligations under either the Privacy Act or relevant State or Territory privacy legislation.

The OAIC has prepared privacy guidance to assist accredited providers to understand and comply with their privacy obligations when providing accredited services.

For the OAIC’s guidance for accredited Digital ID providers and relying parties please visit privacy materials for accredited entities | Digital ID System.

The OAIC handles individual complaints related to the privacy aspects of Digital ID. Privacy issues an individual may complain about include:

• Collection of certain attributes (like race, ethnic origin, or religious beliefs)
• Sharing of personal information to verify identity without express consent of the individual
• Sharing of restricted personal information (such as health information) without express consent
• Disclosure of Digital ID unique identifiers
• Collection and/or retention of biometric information, beyond specified exceptions
• Discrimination based on biometric information
• Use of your Digital ID data for data profiling and/or marketing activities
• Unlawful disclosure of personal information to law enforcement
• Retention of restricted personal information after a verification session, beyond specified limits

To learn more about what you can complain about to the OAIC, please visit What you can complain about.

To understand more about privacy complaints related to the Digital ID system or to lodge a complaint, please visit Privacy complaints.

The Australian Competition & Consumer Commission (ACCC) is the Digital ID regulator.

The ACCC is responsible for:

• accrediting entities providing digital ID services
• approving entities to participate in the Australian Government Digital ID System (AGDIS)
• undertaking compliance monitoring and enforcement activities for non-privacy aspects of the Digital ID system

For further information, see the ACCC’s Digital ID website.

The Chief Executive Centrelink (CEC) is the System Administrator for the AGDIS as established by the Digital ID Act whose functions include, but are not limited to:

• providing assistance to entities participating in the AGDIS
• managing the availability of the AGDIS and digital ID fraud/cyber incidents
• identifying and managing operational risks

For further information, see the System Administrator resources | Digital ID System.