78Reportable incidents

78 Reportable incidents

(1) The Digital ID Rules may prescribe arrangements relating to the notification and management of incidents (reportable incidents) that have occurred, or are reasonably suspected of having occurred, in relation to the Australian Government Digital ID System.

Note: The Accreditation Rules may also provide for such arrangements in relation to incidents that occur outside the Australian Government Digital ID System (see subparagraph 28(2)(a)(iv)).

(2) Without limiting subsection (1), the Digital ID Rules may make provision in relation to the following matters: (a) the entities that are covered by the arrangements; (b) the kinds of incidents that must be notified; (c) the information that must be included in notification about reportable incidents; (d) the manner in which and period within which reportable incidents must be notified to the Digital ID Regulator or the System Administrator; (e) action that must be taken in relation to reportable incidents; (f) how the Digital ID Regulator or System Administrator deals with reportable incidents, including action that may be taken by the Digital ID Regulator or System Administrator in dealing with a reportable incident such as: (i) requiring an entity to do something; or (ii) authorising the provision of information relating to reportable incidents by the Digital ID Regulator or System Administrator to the Minister, the Information Commissioner, accredited entities, participating relying parties or other specified bodies; (g) authorising the collection of information relating to reportable incidents by the Minister, the Information Commissioner, accredited entities, participating relying parties or other specified bodies. (3) Without limiting paragraph (2)(b), the Digital ID Rules may specify the following kinds of incidents: (a) digital ID fraud incidents; (b) cyber security incidents; (c) changes in control (within the meaning of section 910B of the Corporations Act 2001) of entities covered by the arrangements; (d) if an accredited entity engages contractors to provide an accredited service, or part of an accredited service, of the entity—changes in relation to such contractors. (4) An entity is liable to a civil penalty if: (a) the entity is subject to a requirement under the Digital ID Rules made for the purposes of subsection (1); and (b) the entity fails to comply with the requirement.

Civil penalty: 1,500 penalty units.