136Destruction or de‑identification of certain information

136 Destruction or de‑identification of certain information

(1) This section applies to: (a) accredited entities that hold an approval to participate in the Australian Government Digital ID System; and (b) accredited entities whose approval to participate in the Australian Government Digital ID System is suspended; and (c) accredited entities whose approval to participate in the Australian Government Digital ID System has been revoked. (2) The accredited entity must destroy or de‑identify information in the possession or control of the entity if: (a) the information is personal information; and (b) the information was obtained by the entity through the Australian Government Digital ID System; and (c) the entity is not required or authorised to retain the information by or under: (i) this Act; or (ii) another law of the Commonwealth (other than a prescribed law); or (iii) a law of a State or Territory; or (iv) a court/tribunal order (within the meaning of the Privacy Act 1988); and (d) the information does not relate to any current or anticipated legal proceedings or dispute resolution proceedings to which the entity is a party.

Note: For the purposes of subparagraph (c)(i), the entity may be required to retain the information for a specified period under Digital ID Rules made for the purposes of section 135.

Civil penalty: 1,000 penalty units.

(3) In this section:

prescribed law means a law of the Commonwealth prescribed by the Digital ID Rules for the purposes of this definition.