Digital ID Act 2024
51Destruction of biometric information of individuals
Start here
Get a plain-English read of 51
Turn the raw legal text into a practical explanation grounded in Digital ID Act 2024.
51 Destruction of biometric information of individuals
(1) Subject to subsections (2), (3), (4) and (5), if an accredited entity collects biometric information of an individual for the purposes of verifying an individual’s identity only, the provider must destroy the information immediately after the verification is complete.
Civil penalty: 1,500 penalty units.
(2) Subject to subsections (3), (4) and (5), if: (a) an accredited entity collects biometric information of an individual; and (b) the information is collected for the purposes of authenticating the individual to their digital ID (regardless of whether that information is also collected for the purposes of verifying the individual’s identity); and (c) the individual has not given express consent for that information to be retained for the purposes of further authenticating of the individual to their digital ID; the provider must destroy the information immediately after the authentication is complete.
Civil penalty: 1,500 penalty units.
(3) Subject to subsections (4) and (5), if: (a) an accredited entity collects biometric information of an individual with the express consent of the individual to whom the information relates; and (b) the information is collected for the purposes of authenticating the individual to their digital ID; and (c) the individual withdraws their consent; the accredited entity must destroy the information immediately after the consent is withdrawn. (4) If an accredited entity retains biometric information of an individual in accordance with subsection 49(6) (about testing), the accredited entity must destroy the information at the earlier of: (a) the completion of testing the information; and (b) 14 days after the entity collects the information.
Civil penalty: 1,500 penalty units.
(5) If an accredited entity retains biometric information of an individual in accordance with subsection 49(8) (about preventing or investigating digital ID fraud incidents), the accredited entity must destroy the information at the earlier of: (a) immediately after the completion of activities relating to the prevention or investigation of the digital ID fraud incident (as the case may be); and (b) 14 days after the entity collects the information.
Civil penalty: 1,500 penalty units.