4Simplified outline of this Act

4 Simplified outline of this Act

This Act establishes an accreditation scheme for entities providing digital ID services. The Digital ID Regulator (which is the Australian Competition and Consumer Commission) may, on application, accredit certain kinds of entities as accredited attribute service providers, accredited identity exchange providers, accredited identity service providers or entities that provide, or propose to provide, services of a kind prescribed by the Accreditation Rules.

When providing accredited services, accredited entities must comply with certain privacy safeguards. These safeguards are in addition to, and build on, the safeguards contained in the Privacy Act 1988. An accredited entity may be liable to a civil penalty if certain privacy safeguards are breached.

The Digital ID Regulator oversees and maintains the Australian Government Digital ID System. Certain kinds of accredited entities can apply to the Digital ID Regulator to participate in the system. Certain kinds of relying parties can also apply for approval to participate in the system. If a relying party holds an approval, it is known as a participating relying party.

There is a System Administrator whose functions include providing assistance to entities participating in the Australian Government Digital ID System and managing the availability of the Australian Government Digital ID System.

The Digital ID Standards Chair may make Digital ID Data Standards about various matters, including technical integration requirements for entities to participate in the Australian Government Digital ID System and, if required to do so by the Accreditation Rules or the Digital ID Rules, technical, data or design standards relating to accreditation.

The Digital ID Rules may set out marks, symbols, logos or designs (called digital ID trustmarks) that may or must be used by accredited entities and participating relying parties.

The Digital ID Regulator must establish and maintain the Digital ID Accredited Entities Register and the AGDIS Register.

The Digital ID Regulator and the Information Commissioner may take enforcement action against accredited entities and other entities. The Digital ID Regulator can give directions regarding accreditation and participation in the Australian Government Digital ID System or require entities to undergo compliance assessments or produce information or documents. The System Administrator can also give directions to entities regarding participation in the Australian Government Digital ID System and require entities to produce information or documents.

Accredited entities that hold or held an approval to participate in the Australian Government Digital ID System have certain record‑keeping responsibilities and are required to destroy or de‑identify certain information in the possession or control of the entity.