47Restricting disclosure of unique identifiers

47 Restricting disclosure of unique identifiers

(1) This section applies if: (a) an accredited entity (the assigning entity) assigns a unique identifier to an individual within a digital ID system; and (b) the assigning entity discloses the unique identifier to another accredited entity or to a relying party. (2) The assigning entity must not disclose the unique identifier to any other entity other than: (a) if the unique identifier was disclosed to another accredited entity—the other accredited entity; or (b) if the unique identifier was disclosed to a relying party—the relying party.

Civil penalty: 1,500 penalty units.

(3) The accredited entity to whom the unique identifier is disclosed must not disclose the unique identifier to any other entity.

Civil penalty: 1,500 penalty units.

(4) Subsections (2) and (3) do not apply if the disclosure of the unique identifier is for one or more of the following purposes: (a) detecting, reporting or investigating a contravention, or an alleged contravention, of a provision of this Act; (b) conducting proceedings in relation to a contravention, or an alleged contravention, of a civil penalty provision of this Act; (c) detecting, reporting or investigating either of the following within a digital ID system: (i) a digital ID fraud incident; (ii) a cyber security incident: (d) conducting an assessment of the matter referred to in paragraph 33C(1)(g) of the Privacy Act 1988 (about assessments by the Information Commissioner in relation to the handling and maintenance of personal information in accordance with certain aspects of this Act); (e) detecting, reporting, investigating or prosecuting an offence against a law of the Commonwealth, a State or a Territory.

Note: A person who wishes to rely on this subsection bears an evidential burden in relation to the matter mentioned in this subsection (see section 96 of the Regulatory Powers Act).

(5) Subsections (2) and (3) also do not apply if the disclosure of the unique identifier is: (a) to a contractor engaged by the accredited entity; and (b) for the purposes of the contractor providing an accredited service, or part of an accredited service, of the accredited entity.

Note: A person who wishes to rely on this subsection bears an evidential burden in relation to the matter mentioned in this subsection (see section 96 of the Regulatory Powers Act).

(6) Subsections (2) and (3) also do not apply if the unique identifier is disclosed to another entity if the other entity is facilitating access to the entity for whom the unique identifier was created.

Note: A person who wishes to rely on this subsection bears an evidential burden in relation to the matter mentioned in this subsection (see section 96 of the Regulatory Powers Act).