65Conditions relating to restricted attributes of individuals

65 Conditions relating to restricted attributes of individuals

Matters to which the Digital ID Regulator must have regard before authorising disclosure etc. of restricted attributes (1) Subsection (2) applies if the Digital ID Regulator proposes to impose a condition on an entity’s approval to participate in the Australian Government Digital ID System authorising the entity: (a) to collect or disclose a restricted attribute of an individual within the Australian Government Digital ID System; or (b) to disclose a restricted attribute of an individual that is collected by the entity within the Australian Government Digital ID System to an entity outside the system. (2) In deciding whether to impose the condition, the Digital ID Regulator must have regard to the following matters: (a) whether the entity has provided sufficient justification for the need to collect or disclose the restricted attribute; (b) whether the entity has demonstrated that a similar outcome cannot be achieved without collecting or disclosing the restricted attribute; (c) if the collection or disclosure of the restricted attribute is regulated by other legislative or regulatory requirements—whether the entity would be able to comply with those requirements if the condition were imposed; (d) the potential harm that could result if restricted attributes of that kind were disclosed to an entity that was not authorised to collect them; (e) community expectations as to whether restricted attributes of that kind should be handled more securely than other kinds of attributes; (f) any of the following information provided by the entity seeking authorisation to collect or disclose the restricted attribute: (i) the entity’s risk assessment plan as it relates to the restricted attribute; (ii) the entity’s privacy impact assessment as it relates to the restricted attribute; (iii) the effectiveness of the entity’s protective security (including security governance, information security, personnel security and physical security), privacy arrangements and fraud control arrangements; (g) any other matter the Digital ID Regulator considers relevant. Requirement to give statement of reasons if authorisation given (3) If the Digital ID Regulator imposes the condition authorising the entity to collect or disclose a restricted attribute of an individual, the Digital ID Regulator must publish on the Digital ID Regulator’s website a statement of reasons for giving the authorisation. Matters to which the Minister must have regard before authorising disclosure etc. of restricted attributes (4) Subsection (5) applies if the Minister proposes to make Digital ID Rules for the purposes of subsection 64(5) providing that specified kinds of entities are authorised to collect or disclose specified kinds of restricted attributes of individuals, either generally or in specified circumstances. (5) In deciding whether to make the Digital ID Rules, the Minister must have regard to the following matters: (a) the potential harm that could result if restricted attributes of that kind were disclosed to an entity; (b) community expectations as to whether restricted attributes of that kind should be handled more securely than other kinds of attributes; (c) if the collection or disclosure of the restricted attribute is regulated by other legislative or regulatory requirements—whether the entities would be able to comply with those requirements if the rules were made; (d) any privacy impact assessment that has been conducted in relation to the proposal to make the rules; (e) any other matter the Minister considers relevant.