Digital ID (Transitional and Consequential Provisions) Rules 2024

1.1 Name

These rules are the Digital ID (Transitional and Consequential Provisions) Rules 2024.

1.2 Commencement

These rules commence at the same time as the Digital ID (Transitional and Consequential Provisions) Act 2024 commences.

1.3 Authority

These rules are made under item 10 of Schedule 1 to the Digital ID (Transitional and Consequential Provisions) Act 2024.

Note 1: Item 10 of Schedule 1 to the Act (the Schedule) relevantly provides that:

(a) the Minister may make rules prescribing matters required or permitted by the Schedule to be prescribed by the rules, or necessary or convenient to be prescribed for carrying out or giving effect to the Schedule;
(b) without limiting the rule-making power mentioned in paragraph (a), the rules may prescribe matters of a transitional nature (including prescribing any saving or application provisions) relating to the enactment of the Schedule or the Digital ID Act;
(c) rules made for the purposes of item 10 of the Schedule before the end of 12 months after commencement may provide that the Act or the Digital ID Act have effect with any modifications prescribed by the rules; and
(d) subject to the limitations in subitem 10(4) of the Schedule, the Act does not limit the rules that may be made.

Note 2: Subitem 10(4) of the Schedule provides that, to avoid doubt, the rules may not do the following:

(a) create an offence or civil penalty;
(b) provide powers of arrest or detention, or entry, search or seizure;
(c) impose a tax;
(d) set an amount to be appropriated from the Consolidated Revenue Fund under an appropriation in the Act;
(e) directly amend the text of the Act or the Digital ID Act.

1.4 Definitions

Note 1: A number of expressions used in these rules are defined in the Act, including the following:

commencement;
driver’s licence;
medicare card;
myGov;
passport.

Note 2: A number of expressions used in these rules are defined in the Digital ID Act, including the following:

accredited entity;
attribute;
digital ID;
participating relying party;
personal information.

Note 3: A number of expressions used in these rules are defined in the Accreditation Rules, including the following:

biometric binding;
identity proofing;
IP level;
reporting period;
special attribute.

(1) Expressions defined in the Digital ID Act and the Accreditation Rules have the same meaning in these rules. (2) In these rules:

Act means the Digital ID (Transitional and Consequential Provisions) Act 2024.

Accreditation Data Standards means the Digital ID (Accreditation) Data Standards 2024.

Accreditation Rules means the Digital ID (Accreditation) Rules 2024.

AGDIS Data Standards means the Digital ID (AGDIS) Data Standards 2024.

AL2 means the authentication level specified as AL2 in rule 3.1 of the Accreditation Data Standards.

Designated Identity Exchange Provider means Services Australia in its capacity as an accredited identity exchange provider while participating in the Australian Government Digital ID System.

Digital ID Act means the Digital ID Act 2024.

myGov linkID means a special attribute that links a person with a service available through myGov that the person seeks to access.

one-off digital ID: see rule 5.3 of the Accreditation Rules.

1.5 Schedules

Each instrument that is specified in a Schedule to this instrument is amended or repealed as set out in the applicable items in the Schedule concerned, and any other item in a Schedule to this instrument has effect according to its terms.

Chapter 2—Transitional and application rules

Chapter 1—Preliminary

1.1 Name

These rules are the Digital ID (Transitional and Consequential Provisions) Rules 2024.

1.2 Commencement

These rules commence at the same time as the Digital ID (Transitional and Consequential Provisions) Act 2024 commences.

1.3 Authority

These rules are made under item 10 of Schedule 1 to the Digital ID (Transitional and Consequential Provisions) Act 2024.

Note 1: Item 10 of Schedule 1 to the Act (the Schedule) relevantly provides that:

(a) the Minister may make rules prescribing matters required or permitted by the Schedule to be prescribed by the rules, or necessary or convenient to be prescribed for carrying out or giving effect to the Schedule;
(b) without limiting the rule-making power mentioned in paragraph (a), the rules may prescribe matters of a transitional nature (including prescribing any saving or application provisions) relating to the enactment of the Schedule or the Digital ID Act;
(c) rules made for the purposes of item 10 of the Schedule before the end of 12 months after commencement may provide that the Act or the Digital ID Act have effect with any modifications prescribed by the rules; and
(d) subject to the limitations in subitem 10(4) of the Schedule, the Act does not limit the rules that may be made.

Note 2: Subitem 10(4) of the Schedule provides that, to avoid doubt, the rules may not do the following:

(a) create an offence or civil penalty;
(b) provide powers of arrest or detention, or entry, search or seizure;
(c) impose a tax;
(d) set an amount to be appropriated from the Consolidated Revenue Fund under an appropriation in the Act;
(e) directly amend the text of the Act or the Digital ID Act.

1.4 Definitions

Note 1: A number of expressions used in these rules are defined in the Act, including the following:

commencement;
driver’s licence;
medicare card;
myGov;
passport.

Note 2: A number of expressions used in these rules are defined in the Digital ID Act, including the following:

accredited entity;
attribute;
digital ID;
participating relying party;
personal information.

Note 3: A number of expressions used in these rules are defined in the Accreditation Rules, including the following:

biometric binding;
identity proofing;
IP level;
reporting period;
special attribute.

(1) Expressions defined in the Digital ID Act and the Accreditation Rules have the same meaning in these rules. (2) In these rules:

Act means the Digital ID (Transitional and Consequential Provisions) Act 2024.

Accreditation Data Standards means the Digital ID (Accreditation) Data Standards 2024.

Accreditation Rules means the Digital ID (Accreditation) Rules 2024.

AGDIS Data Standards means the Digital ID (AGDIS) Data Standards 2024.

AL2 means the authentication level specified as AL2 in rule 3.1 of the Accreditation Data Standards.

Designated Identity Exchange Provider means Services Australia in its capacity as an accredited identity exchange provider while participating in the Australian Government Digital ID System.

Digital ID Act means the Digital ID Act 2024.

myGov linkID means a special attribute that links a person with a service available through myGov that the person seeks to access.

one-off digital ID: see rule 5.3 of the Accreditation Rules.

1.5 Schedules

Each instrument that is specified in a Schedule to this instrument is amended or repealed as set out in the applicable items in the Schedule concerned, and any other item in a Schedule to this instrument has effect according to its terms.

Chapter 2—Transitional and application rules

Part 1—Accreditation

2.1 Entities taken to be accredited immediately after commencement

For the purposes of item 4 of the table in item 2 of Schedule 1 to the Act, the Digital ID Regulator is taken, immediately after commencement, to: (a) have decided for the purposes of subsection 15(2) of the Digital ID Act to accredit an entity specified in column 1 of an item in Table 1 of Schedule 1 as the kind of accredited entity specified in column 2 of the item; and (b) have imposed the conditions, if any, specified in column 3 of the item on the entity’s accreditation for the purposes of paragraph 17(2)(a) of the Digital ID Act.

Part 2—Approval to participate in the Australian Government Digital ID System

2.2 Accredited entities taken to be approved to participate in the Australian Government Digital ID System immediately after commencement

For the purposes of item 4 of the table in subitem 4(1) of Schedule 1 to the Act, the Digital ID Regulator is taken, immediately after commencement, to: (a) have approved an entity specified in column 1 of an item in the following table to participate in the Australian Government Digital ID System for the purposes of section 62 of the Digital ID Act as the kind of accredited entity specified in column 2 of the item; and (b) have imposed the conditions specified in column 3 of the item on the entity’s approval for the purposes of paragraph 64(2)(a) of the Digital ID Act.

<table cellspacing="0" cellpadding="0" style="width:100%; border-collapse:collapse"><thead><tr><td colspan="4" style="width:415.65pt; border-top:1.5pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="TableHeading"><span>Accredited entities taken to be approved to participate in the Australian Government Digital ID System</span></p></td></tr><tr><td style="width:32.2pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="TableHeading"><span>Item</span></p></td><td style="width:90.95pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="TableHeading"><span>Column 1</span></p><p class="TableHeading"><span>Entity</span></p></td><td style="width:91.55pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="TableHeading"><span>Column 2</span></p><p class="Tabletext"><span style="font-weight:bold">Kind of accredited entity</span></p></td><td style="width:168.55pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="TableHeading"><span>Column 3</span></p><p class="TableHeading"><span>Conditions</span></p></td></tr></thead><tbody><tr><td style="width:32.2pt; border-top:1.5pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>1</span></p></td><td style="width:90.95pt; border-top:1.5pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>Services Australia</span></p></td><td style="width:91.55pt; border-top:1.5pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>Accredited attribute service provider</span></p></td><td style="width:168.55pt; border-top:1.5pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tablea"><span>The entity must:</span></p><p class="Tabletext" style="margin-left:18.85pt; text-indent:-18.85pt"><span>(a)</span><span style="width:7.75pt; text-indent:0pt; display:inline-block"> </span><span>provide its accredited services to issue and manage the myGov linkID attribute; and</span></p><p class="Tabletext" style="margin-left:18.85pt; text-indent:-18.85pt"><span>(b)</span><span style="width:7.19pt; text-indent:0pt; display:inline-block"> </span><span>directly connect to the Designated Identity Exchange Provider.</span></p></td></tr><tr><td style="width:32.2pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext" style="page-break-inside:avoid; page-break-after:avoid"><span>2</span></p></td><td style="width:90.95pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext" style="page-break-inside:avoid; page-break-after:avoid"><span>Services Australia</span></p></td><td style="width:91.55pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext" style="page-break-inside:avoid; page-break-after:avoid"><span>Accredited identity exchange provider</span></p></td><td style="width:168.55pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext" style="page-break-inside:avoid; page-break-after:avoid"><span>The entity must undertake all of the following if, during a reporting period for the entity, the entity has informed a participating relying party, in accordance with section</span><span> </span><span>2.2.1 of Schedule</span><span> </span><span>1 to the AGDIS Data Standards, which accredited identity service provider an individual used to authenticate (</span><span style="font-weight:bold; font-style:italic">the disclosure</span><span>):</span></p><p class="Tablea"><span>(a)</span><span style="width:3.1pt; text-indent:0pt; display:inline-block"> </span><span>arrange, in respect of that reporting period, an independent audit of the entity’s compliance with:</span></p><p class="Tablei"><span>(i)</span><span style="width:4.76pt; text-indent:0pt; display:inline-block"> </span><span>section</span><span> </span><span>2.2.1.4 and the data representation in Table</span><span> </span><span>30 of Schedule</span><span> </span><span>3 to the AGDIS Data Standards in relation to the disclosure; and</span></p><p class="Tablei"><span>(ii)</span><span style="width:1.98pt; text-indent:0pt; display:inline-block"> </span><span>any requirements in the federation protocol used by the participating relying party in relation to the disclosure;</span></p><p class="Tablea"><span>(b)</span><span style="width:2.54pt; text-indent:0pt; display:inline-block"> </span><span>provide the auditor’s findings in relation to that reporting period to the Digital ID Regulator before the end of the next reporting period; and</span></p><p class="Tablea"><span>(c)</span><span style="width:3.1pt; text-indent:0pt; display:inline-block"> </span><span>publish the auditor’s findings in relation to that reporting period on the entity’s website.</span></p></td></tr></tbody></table>

2.3 Relying parties taken to be approved to participate in the Australian Government Digital ID System immediately after commencement

For the purposes of item 10 of the table in subitem 4(2) of Schedule 1 to the Act, the Digital ID Regulator is taken, immediately after commencement, to: (a) have approved an entity specified in column 1 of an item in Table 2 of Schedule 1 to participate in the Australian Government Digital ID System for the purposes of section 62 of the Digital ID Act as a participating relying party; and (b) have imposed the conditions specified in column 2 of the item on the entity’s approval for the purposes of paragraph 64(2)(a) of the Digital ID Act.

2.4 Relying parties taken to be approved to participate in the Australian Government Digital ID System on a specified date after commencement

(1) Subitem 4(2) of Schedule 1 to the Act has effect in relation to an entity mentioned in subrule (2) with the modifications prescribed in that subrule. (2) For the purposes of item 10 of the table in subitem 4(2) of Schedule 1 to the Act, the Digital ID Regulator is taken, on the specified date, to: (a) have approved an entity specified in column 1 of an item in Table 3 of Schedule 1 to participate in the Australian Government Digital ID System for the purposes of section 62 of the Digital ID Act as a participating relying party; and (b) have imposed the conditions specified in column 2 of the item on the entity’s approval for the purposes of paragraph 64(2)(a) of the Digital ID Act. (3) Item 5 of Schedule 1 to the Act has effect in relation to an entity mentioned in subrule (2) with the modifications prescribed in subrules (4) to (11). (4) Item 5 of Schedule 1 to the Act applies in relation to an entity that holds an approval to participate in the Australian Government Digital ID System because of the operation of subitem 4(2) of Schedule 1 to the Act as modified by this rule. (5) For the purposes of paragraph 62(5)(a) of the Digital ID Act: (a) the Digital ID Regulator is taken to have given written notice of the decision to approve the entity to participate in the Australian Government Digital ID System; and (b) the notice referred to in paragraph (a) is taken to have complied with subsection 62(6) of the Digital ID Act. (6) For the purposes of paragraph 62(6)(a) of the Digital ID Act, the Digital ID Regulator is taken to have notified the entity that the day the entity’s approval to participate in the Australian Government Digital ID System comes into force is the specified date. (7) For the purposes of paragraph 62(6)(c) of the Digital ID Act, the Digital ID Regulator is taken to have notified the entity of the conditions set out in column 2 of the item in Table 3 of Schedule 1 that relates to the entity. (8) For the purposes of paragraph 62(6)(d) of the Digital ID Act, the Digital ID Regulator is taken to have notified the entity that the day on which the entity must begin to participate in the Australian Government Digital ID System is the specified date. (9) For the purposes of paragraph 64(1)(c) of the Digital ID Act, the entity is taken to have begun participating in the Australian Government Digital ID System on the specified date. (10) A decision taken to have been made because of the operation of paragraph 4(2)(b) of Schedule 1 to the Act as modified by this rule is not a reviewable decision for the purposes of the Digital ID Act. (11) In this rule:

specified date, in relation to an entity mentioned in subrule (2), means the date specified in column 3 of the item in Table 3 in Schedule 1 that relates to the entity.

Part 3—Transitional liability arrangements

2.5 Application of statutory contract provisions in the Digital ID Act

(1) Division 2 of Part 3 of Chapter 4 of the Digital ID Act does not apply until the earlier of the following: (a) 2 years after commencement; and (b) the first date on which rules made under subsection 85(5) of the Digital ID Act commence. (2) For the avoidance of doubt, this rule does not limit or modify the power of the Minister to make rules in accordance with subsection 85(5) or section 87 of the Digital ID Act.

Part 4—Other modifications to the Act

2.6 References to myGovID in the Act

References to ‘myGovID’ in the Act are taken to be references to ‘myID’.

Part 5—Other modifications to the Digital ID Act

2.7 Conditions on accreditation relating to restricted attributes of individuals

Subsections 18(2) and (3) of the Digital ID Act (about conditions relating to restricted attributes of individuals) do not apply in relation to: (a) the conditions taken to be imposed under paragraph (h) of column 3 of item 2 of the table in item 2 of Schedule 1 to the Act; and (b) the conditions taken to be imposed under paragraph (c) of column 3 of item 3 of Table 1 in Schedule 1.

2.1 Entities taken to be accredited immediately after commencement

For the purposes of item 4 of the table in item 2 of Schedule 1 to the Act, the Digital ID Regulator is taken, immediately after commencement, to: (a) have decided for the purposes of subsection 15(2) of the Digital ID Act to accredit an entity specified in column 1 of an item in Table 1 of Schedule 1 as the kind of accredited entity specified in column 2 of the item; and (b) have imposed the conditions, if any, specified in column 3 of the item on the entity’s accreditation for the purposes of paragraph 17(2)(a) of the Digital ID Act.

Chapter 1—Preliminary

1.1 Name

These rules are the Digital ID (Transitional and Consequential Provisions) Rules 2024.

1.2 Commencement

These rules commence at the same time as the Digital ID (Transitional and Consequential Provisions) Act 2024 commences.

1.3 Authority

These rules are made under item 10 of Schedule 1 to the Digital ID (Transitional and Consequential Provisions) Act 2024.

Note 1: Item 10 of Schedule 1 to the Act (the Schedule) relevantly provides that:

(a) the Minister may make rules prescribing matters required or permitted by the Schedule to be prescribed by the rules, or necessary or convenient to be prescribed for carrying out or giving effect to the Schedule;
(b) without limiting the rule-making power mentioned in paragraph (a), the rules may prescribe matters of a transitional nature (including prescribing any saving or application provisions) relating to the enactment of the Schedule or the Digital ID Act;
(c) rules made for the purposes of item 10 of the Schedule before the end of 12 months after commencement may provide that the Act or the Digital ID Act have effect with any modifications prescribed by the rules; and
(d) subject to the limitations in subitem 10(4) of the Schedule, the Act does not limit the rules that may be made.

Note 2: Subitem 10(4) of the Schedule provides that, to avoid doubt, the rules may not do the following:

(a) create an offence or civil penalty;
(b) provide powers of arrest or detention, or entry, search or seizure;
(c) impose a tax;
(d) set an amount to be appropriated from the Consolidated Revenue Fund under an appropriation in the Act;
(e) directly amend the text of the Act or the Digital ID Act.

1.4 Definitions

Note 1: A number of expressions used in these rules are defined in the Act, including the following:

commencement;
driver’s licence;
medicare card;
myGov;
passport.

Note 2: A number of expressions used in these rules are defined in the Digital ID Act, including the following:

accredited entity;
attribute;
digital ID;
participating relying party;
personal information.

Note 3: A number of expressions used in these rules are defined in the Accreditation Rules, including the following:

biometric binding;
identity proofing;
IP level;
reporting period;
special attribute.

(1) Expressions defined in the Digital ID Act and the Accreditation Rules have the same meaning in these rules. (2) In these rules:

Act means the Digital ID (Transitional and Consequential Provisions) Act 2024.

Accreditation Data Standards means the Digital ID (Accreditation) Data Standards 2024.

Accreditation Rules means the Digital ID (Accreditation) Rules 2024.

AGDIS Data Standards means the Digital ID (AGDIS) Data Standards 2024.

AL2 means the authentication level specified as AL2 in rule 3.1 of the Accreditation Data Standards.

Designated Identity Exchange Provider means Services Australia in its capacity as an accredited identity exchange provider while participating in the Australian Government Digital ID System.

Digital ID Act means the Digital ID Act 2024.

myGov linkID means a special attribute that links a person with a service available through myGov that the person seeks to access.

one-off digital ID: see rule 5.3 of the Accreditation Rules.

1.5 Schedules

Each instrument that is specified in a Schedule to this instrument is amended or repealed as set out in the applicable items in the Schedule concerned, and any other item in a Schedule to this instrument has effect according to its terms.

Chapter 2—Transitional and application rules

Part 1—Accreditation

2.1 Entities taken to be accredited immediately after commencement

For the purposes of item 4 of the table in item 2 of Schedule 1 to the Act, the Digital ID Regulator is taken, immediately after commencement, to: (a) have decided for the purposes of subsection 15(2) of the Digital ID Act to accredit an entity specified in column 1 of an item in Table 1 of Schedule 1 as the kind of accredited entity specified in column 2 of the item; and (b) have imposed the conditions, if any, specified in column 3 of the item on the entity’s accreditation for the purposes of paragraph 17(2)(a) of the Digital ID Act.

Part 2—Approval to participate in the Australian Government Digital ID System

2.2 Accredited entities taken to be approved to participate in the Australian Government Digital ID System immediately after commencement

For the purposes of item 4 of the table in subitem 4(1) of Schedule 1 to the Act, the Digital ID Regulator is taken, immediately after commencement, to: (a) have approved an entity specified in column 1 of an item in the following table to participate in the Australian Government Digital ID System for the purposes of section 62 of the Digital ID Act as the kind of accredited entity specified in column 2 of the item; and (b) have imposed the conditions specified in column 3 of the item on the entity’s approval for the purposes of paragraph 64(2)(a) of the Digital ID Act.

<table cellspacing="0" cellpadding="0" style="width:100%; border-collapse:collapse"><thead><tr><td colspan="4" style="width:415.65pt; border-top:1.5pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="TableHeading"><span>Accredited entities taken to be approved to participate in the Australian Government Digital ID System</span></p></td></tr><tr><td style="width:32.2pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="TableHeading"><span>Item</span></p></td><td style="width:90.95pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="TableHeading"><span>Column 1</span></p><p class="TableHeading"><span>Entity</span></p></td><td style="width:91.55pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="TableHeading"><span>Column 2</span></p><p class="Tabletext"><span style="font-weight:bold">Kind of accredited entity</span></p></td><td style="width:168.55pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="TableHeading"><span>Column 3</span></p><p class="TableHeading"><span>Conditions</span></p></td></tr></thead><tbody><tr><td style="width:32.2pt; border-top:1.5pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>1</span></p></td><td style="width:90.95pt; border-top:1.5pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>Services Australia</span></p></td><td style="width:91.55pt; border-top:1.5pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>Accredited attribute service provider</span></p></td><td style="width:168.55pt; border-top:1.5pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tablea"><span>The entity must:</span></p><p class="Tabletext" style="margin-left:18.85pt; text-indent:-18.85pt"><span>(a)</span><span style="width:7.75pt; text-indent:0pt; display:inline-block"> </span><span>provide its accredited services to issue and manage the myGov linkID attribute; and</span></p><p class="Tabletext" style="margin-left:18.85pt; text-indent:-18.85pt"><span>(b)</span><span style="width:7.19pt; text-indent:0pt; display:inline-block"> </span><span>directly connect to the Designated Identity Exchange Provider.</span></p></td></tr><tr><td style="width:32.2pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext" style="page-break-inside:avoid; page-break-after:avoid"><span>2</span></p></td><td style="width:90.95pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext" style="page-break-inside:avoid; page-break-after:avoid"><span>Services Australia</span></p></td><td style="width:91.55pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext" style="page-break-inside:avoid; page-break-after:avoid"><span>Accredited identity exchange provider</span></p></td><td style="width:168.55pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext" style="page-break-inside:avoid; page-break-after:avoid"><span>The entity must undertake all of the following if, during a reporting period for the entity, the entity has informed a participating relying party, in accordance with section</span><span> </span><span>2.2.1 of Schedule</span><span> </span><span>1 to the AGDIS Data Standards, which accredited identity service provider an individual used to authenticate (</span><span style="font-weight:bold; font-style:italic">the disclosure</span><span>):</span></p><p class="Tablea"><span>(a)</span><span style="width:3.1pt; text-indent:0pt; display:inline-block"> </span><span>arrange, in respect of that reporting period, an independent audit of the entity’s compliance with:</span></p><p class="Tablei"><span>(i)</span><span style="width:4.76pt; text-indent:0pt; display:inline-block"> </span><span>section</span><span> </span><span>2.2.1.4 and the data representation in Table</span><span> </span><span>30 of Schedule</span><span> </span><span>3 to the AGDIS Data Standards in relation to the disclosure; and</span></p><p class="Tablei"><span>(ii)</span><span style="width:1.98pt; text-indent:0pt; display:inline-block"> </span><span>any requirements in the federation protocol used by the participating relying party in relation to the disclosure;</span></p><p class="Tablea"><span>(b)</span><span style="width:2.54pt; text-indent:0pt; display:inline-block"> </span><span>provide the auditor’s findings in relation to that reporting period to the Digital ID Regulator before the end of the next reporting period; and</span></p><p class="Tablea"><span>(c)</span><span style="width:3.1pt; text-indent:0pt; display:inline-block"> </span><span>publish the auditor’s findings in relation to that reporting period on the entity’s website.</span></p></td></tr></tbody></table>

2.3 Relying parties taken to be approved to participate in the Australian Government Digital ID System immediately after commencement

For the purposes of item 10 of the table in subitem 4(2) of Schedule 1 to the Act, the Digital ID Regulator is taken, immediately after commencement, to: (a) have approved an entity specified in column 1 of an item in Table 2 of Schedule 1 to participate in the Australian Government Digital ID System for the purposes of section 62 of the Digital ID Act as a participating relying party; and (b) have imposed the conditions specified in column 2 of the item on the entity’s approval for the purposes of paragraph 64(2)(a) of the Digital ID Act.

2.4 Relying parties taken to be approved to participate in the Australian Government Digital ID System on a specified date after commencement

(1) Subitem 4(2) of Schedule 1 to the Act has effect in relation to an entity mentioned in subrule (2) with the modifications prescribed in that subrule. (2) For the purposes of item 10 of the table in subitem 4(2) of Schedule 1 to the Act, the Digital ID Regulator is taken, on the specified date, to: (a) have approved an entity specified in column 1 of an item in Table 3 of Schedule 1 to participate in the Australian Government Digital ID System for the purposes of section 62 of the Digital ID Act as a participating relying party; and (b) have imposed the conditions specified in column 2 of the item on the entity’s approval for the purposes of paragraph 64(2)(a) of the Digital ID Act. (3) Item 5 of Schedule 1 to the Act has effect in relation to an entity mentioned in subrule (2) with the modifications prescribed in subrules (4) to (11). (4) Item 5 of Schedule 1 to the Act applies in relation to an entity that holds an approval to participate in the Australian Government Digital ID System because of the operation of subitem 4(2) of Schedule 1 to the Act as modified by this rule. (5) For the purposes of paragraph 62(5)(a) of the Digital ID Act: (a) the Digital ID Regulator is taken to have given written notice of the decision to approve the entity to participate in the Australian Government Digital ID System; and (b) the notice referred to in paragraph (a) is taken to have complied with subsection 62(6) of the Digital ID Act. (6) For the purposes of paragraph 62(6)(a) of the Digital ID Act, the Digital ID Regulator is taken to have notified the entity that the day the entity’s approval to participate in the Australian Government Digital ID System comes into force is the specified date. (7) For the purposes of paragraph 62(6)(c) of the Digital ID Act, the Digital ID Regulator is taken to have notified the entity of the conditions set out in column 2 of the item in Table 3 of Schedule 1 that relates to the entity. (8) For the purposes of paragraph 62(6)(d) of the Digital ID Act, the Digital ID Regulator is taken to have notified the entity that the day on which the entity must begin to participate in the Australian Government Digital ID System is the specified date. (9) For the purposes of paragraph 64(1)(c) of the Digital ID Act, the entity is taken to have begun participating in the Australian Government Digital ID System on the specified date. (10) A decision taken to have been made because of the operation of paragraph 4(2)(b) of Schedule 1 to the Act as modified by this rule is not a reviewable decision for the purposes of the Digital ID Act. (11) In this rule:

specified date, in relation to an entity mentioned in subrule (2), means the date specified in column 3 of the item in Table 3 in Schedule 1 that relates to the entity.

Part 3—Transitional liability arrangements

2.5 Application of statutory contract provisions in the Digital ID Act

(1) Division 2 of Part 3 of Chapter 4 of the Digital ID Act does not apply until the earlier of the following: (a) 2 years after commencement; and (b) the first date on which rules made under subsection 85(5) of the Digital ID Act commence. (2) For the avoidance of doubt, this rule does not limit or modify the power of the Minister to make rules in accordance with subsection 85(5) or section 87 of the Digital ID Act.

Part 4—Other modifications to the Act

2.6 References to myGovID in the Act

References to ‘myGovID’ in the Act are taken to be references to ‘myID’.

Part 5—Other modifications to the Digital ID Act

2.7 Conditions on accreditation relating to restricted attributes of individuals

Subsections 18(2) and (3) of the Digital ID Act (about conditions relating to restricted attributes of individuals) do not apply in relation to: (a) the conditions taken to be imposed under paragraph (h) of column 3 of item 2 of the table in item 2 of Schedule 1 to the Act; and (b) the conditions taken to be imposed under paragraph (c) of column 3 of item 3 of Table 1 in Schedule 1.

2.2 Accredited entities taken to be approved to participate in the Australian Government Digital ID System immediately after commencement

For the purposes of item 4 of the table in subitem 4(1) of Schedule 1 to the Act, the Digital ID Regulator is taken, immediately after commencement, to: (a) have approved an entity specified in column 1 of an item in the following table to participate in the Australian Government Digital ID System for the purposes of section 62 of the Digital ID Act as the kind of accredited entity specified in column 2 of the item; and (b) have imposed the conditions specified in column 3 of the item on the entity’s approval for the purposes of paragraph 64(2)(a) of the Digital ID Act.

<table cellspacing="0" cellpadding="0" style="width:100%; border-collapse:collapse"><thead><tr><td colspan="4" style="width:415.65pt; border-top:1.5pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="TableHeading"><span>Accredited entities taken to be approved to participate in the Australian Government Digital ID System</span></p></td></tr><tr><td style="width:32.2pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="TableHeading"><span>Item</span></p></td><td style="width:90.95pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="TableHeading"><span>Column 1</span></p><p class="TableHeading"><span>Entity</span></p></td><td style="width:91.55pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="TableHeading"><span>Column 2</span></p><p class="Tabletext"><span style="font-weight:bold">Kind of accredited entity</span></p></td><td style="width:168.55pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="TableHeading"><span>Column 3</span></p><p class="TableHeading"><span>Conditions</span></p></td></tr></thead><tbody><tr><td style="width:32.2pt; border-top:1.5pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>1</span></p></td><td style="width:90.95pt; border-top:1.5pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>Services Australia</span></p></td><td style="width:91.55pt; border-top:1.5pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>Accredited attribute service provider</span></p></td><td style="width:168.55pt; border-top:1.5pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tablea"><span>The entity must:</span></p><p class="Tabletext" style="margin-left:18.85pt; text-indent:-18.85pt"><span>(a)</span><span style="width:7.75pt; text-indent:0pt; display:inline-block"> </span><span>provide its accredited services to issue and manage the myGov linkID attribute; and</span></p><p class="Tabletext" style="margin-left:18.85pt; text-indent:-18.85pt"><span>(b)</span><span style="width:7.19pt; text-indent:0pt; display:inline-block"> </span><span>directly connect to the Designated Identity Exchange Provider.</span></p></td></tr><tr><td style="width:32.2pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext" style="page-break-inside:avoid; page-break-after:avoid"><span>2</span></p></td><td style="width:90.95pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext" style="page-break-inside:avoid; page-break-after:avoid"><span>Services Australia</span></p></td><td style="width:91.55pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext" style="page-break-inside:avoid; page-break-after:avoid"><span>Accredited identity exchange provider</span></p></td><td style="width:168.55pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext" style="page-break-inside:avoid; page-break-after:avoid"><span>The entity must undertake all of the following if, during a reporting period for the entity, the entity has informed a participating relying party, in accordance with section</span><span> </span><span>2.2.1 of Schedule</span><span> </span><span>1 to the AGDIS Data Standards, which accredited identity service provider an individual used to authenticate (</span><span style="font-weight:bold; font-style:italic">the disclosure</span><span>):</span></p><p class="Tablea"><span>(a)</span><span style="width:3.1pt; text-indent:0pt; display:inline-block"> </span><span>arrange, in respect of that reporting period, an independent audit of the entity’s compliance with:</span></p><p class="Tablei"><span>(i)</span><span style="width:4.76pt; text-indent:0pt; display:inline-block"> </span><span>section</span><span> </span><span>2.2.1.4 and the data representation in Table</span><span> </span><span>30 of Schedule</span><span> </span><span>3 to the AGDIS Data Standards in relation to the disclosure; and</span></p><p class="Tablei"><span>(ii)</span><span style="width:1.98pt; text-indent:0pt; display:inline-block"> </span><span>any requirements in the federation protocol used by the participating relying party in relation to the disclosure;</span></p><p class="Tablea"><span>(b)</span><span style="width:2.54pt; text-indent:0pt; display:inline-block"> </span><span>provide the auditor’s findings in relation to that reporting period to the Digital ID Regulator before the end of the next reporting period; and</span></p><p class="Tablea"><span>(c)</span><span style="width:3.1pt; text-indent:0pt; display:inline-block"> </span><span>publish the auditor’s findings in relation to that reporting period on the entity’s website.</span></p></td></tr></tbody></table>

2.3 Relying parties taken to be approved to participate in the Australian Government Digital ID System immediately after commencement

For the purposes of item 10 of the table in subitem 4(2) of Schedule 1 to the Act, the Digital ID Regulator is taken, immediately after commencement, to: (a) have approved an entity specified in column 1 of an item in Table 2 of Schedule 1 to participate in the Australian Government Digital ID System for the purposes of section 62 of the Digital ID Act as a participating relying party; and (b) have imposed the conditions specified in column 2 of the item on the entity’s approval for the purposes of paragraph 64(2)(a) of the Digital ID Act.

2.4 Relying parties taken to be approved to participate in the Australian Government Digital ID System on a specified date after commencement

(1) Subitem 4(2) of Schedule 1 to the Act has effect in relation to an entity mentioned in subrule (2) with the modifications prescribed in that subrule. (2) For the purposes of item 10 of the table in subitem 4(2) of Schedule 1 to the Act, the Digital ID Regulator is taken, on the specified date, to: (a) have approved an entity specified in column 1 of an item in Table 3 of Schedule 1 to participate in the Australian Government Digital ID System for the purposes of section 62 of the Digital ID Act as a participating relying party; and (b) have imposed the conditions specified in column 2 of the item on the entity’s approval for the purposes of paragraph 64(2)(a) of the Digital ID Act. (3) Item 5 of Schedule 1 to the Act has effect in relation to an entity mentioned in subrule (2) with the modifications prescribed in subrules (4) to (11). (4) Item 5 of Schedule 1 to the Act applies in relation to an entity that holds an approval to participate in the Australian Government Digital ID System because of the operation of subitem 4(2) of Schedule 1 to the Act as modified by this rule. (5) For the purposes of paragraph 62(5)(a) of the Digital ID Act: (a) the Digital ID Regulator is taken to have given written notice of the decision to approve the entity to participate in the Australian Government Digital ID System; and (b) the notice referred to in paragraph (a) is taken to have complied with subsection 62(6) of the Digital ID Act. (6) For the purposes of paragraph 62(6)(a) of the Digital ID Act, the Digital ID Regulator is taken to have notified the entity that the day the entity’s approval to participate in the Australian Government Digital ID System comes into force is the specified date. (7) For the purposes of paragraph 62(6)(c) of the Digital ID Act, the Digital ID Regulator is taken to have notified the entity of the conditions set out in column 2 of the item in Table 3 of Schedule 1 that relates to the entity. (8) For the purposes of paragraph 62(6)(d) of the Digital ID Act, the Digital ID Regulator is taken to have notified the entity that the day on which the entity must begin to participate in the Australian Government Digital ID System is the specified date. (9) For the purposes of paragraph 64(1)(c) of the Digital ID Act, the entity is taken to have begun participating in the Australian Government Digital ID System on the specified date. (10) A decision taken to have been made because of the operation of paragraph 4(2)(b) of Schedule 1 to the Act as modified by this rule is not a reviewable decision for the purposes of the Digital ID Act. (11) In this rule:

specified date, in relation to an entity mentioned in subrule (2), means the date specified in column 3 of the item in Table 3 in Schedule 1 that relates to the entity.

Chapter 1—Preliminary

1.1 Name

These rules are the Digital ID (Transitional and Consequential Provisions) Rules 2024.

1.2 Commencement

These rules commence at the same time as the Digital ID (Transitional and Consequential Provisions) Act 2024 commences.

1.3 Authority

These rules are made under item 10 of Schedule 1 to the Digital ID (Transitional and Consequential Provisions) Act 2024.

Note 1: Item 10 of Schedule 1 to the Act (the Schedule) relevantly provides that:

(a) the Minister may make rules prescribing matters required or permitted by the Schedule to be prescribed by the rules, or necessary or convenient to be prescribed for carrying out or giving effect to the Schedule;
(b) without limiting the rule-making power mentioned in paragraph (a), the rules may prescribe matters of a transitional nature (including prescribing any saving or application provisions) relating to the enactment of the Schedule or the Digital ID Act;
(c) rules made for the purposes of item 10 of the Schedule before the end of 12 months after commencement may provide that the Act or the Digital ID Act have effect with any modifications prescribed by the rules; and
(d) subject to the limitations in subitem 10(4) of the Schedule, the Act does not limit the rules that may be made.

Note 2: Subitem 10(4) of the Schedule provides that, to avoid doubt, the rules may not do the following:

(a) create an offence or civil penalty;
(b) provide powers of arrest or detention, or entry, search or seizure;
(c) impose a tax;
(d) set an amount to be appropriated from the Consolidated Revenue Fund under an appropriation in the Act;
(e) directly amend the text of the Act or the Digital ID Act.

1.4 Definitions

Note 1: A number of expressions used in these rules are defined in the Act, including the following:

commencement;
driver’s licence;
medicare card;
myGov;
passport.

Note 2: A number of expressions used in these rules are defined in the Digital ID Act, including the following:

accredited entity;
attribute;
digital ID;
participating relying party;
personal information.

Note 3: A number of expressions used in these rules are defined in the Accreditation Rules, including the following:

biometric binding;
identity proofing;
IP level;
reporting period;
special attribute.

(1) Expressions defined in the Digital ID Act and the Accreditation Rules have the same meaning in these rules. (2) In these rules:

Act means the Digital ID (Transitional and Consequential Provisions) Act 2024.

Accreditation Data Standards means the Digital ID (Accreditation) Data Standards 2024.

Accreditation Rules means the Digital ID (Accreditation) Rules 2024.

AGDIS Data Standards means the Digital ID (AGDIS) Data Standards 2024.

AL2 means the authentication level specified as AL2 in rule 3.1 of the Accreditation Data Standards.

Designated Identity Exchange Provider means Services Australia in its capacity as an accredited identity exchange provider while participating in the Australian Government Digital ID System.

Digital ID Act means the Digital ID Act 2024.

myGov linkID means a special attribute that links a person with a service available through myGov that the person seeks to access.

one-off digital ID: see rule 5.3 of the Accreditation Rules.

1.5 Schedules

Each instrument that is specified in a Schedule to this instrument is amended or repealed as set out in the applicable items in the Schedule concerned, and any other item in a Schedule to this instrument has effect according to its terms.

Chapter 2—Transitional and application rules

Part 1—Accreditation

2.1 Entities taken to be accredited immediately after commencement

For the purposes of item 4 of the table in item 2 of Schedule 1 to the Act, the Digital ID Regulator is taken, immediately after commencement, to: (a) have decided for the purposes of subsection 15(2) of the Digital ID Act to accredit an entity specified in column 1 of an item in Table 1 of Schedule 1 as the kind of accredited entity specified in column 2 of the item; and (b) have imposed the conditions, if any, specified in column 3 of the item on the entity’s accreditation for the purposes of paragraph 17(2)(a) of the Digital ID Act.

Part 2—Approval to participate in the Australian Government Digital ID System

2.2 Accredited entities taken to be approved to participate in the Australian Government Digital ID System immediately after commencement

For the purposes of item 4 of the table in subitem 4(1) of Schedule 1 to the Act, the Digital ID Regulator is taken, immediately after commencement, to: (a) have approved an entity specified in column 1 of an item in the following table to participate in the Australian Government Digital ID System for the purposes of section 62 of the Digital ID Act as the kind of accredited entity specified in column 2 of the item; and (b) have imposed the conditions specified in column 3 of the item on the entity’s approval for the purposes of paragraph 64(2)(a) of the Digital ID Act.

<table cellspacing="0" cellpadding="0" style="width:100%; border-collapse:collapse"><thead><tr><td colspan="4" style="width:415.65pt; border-top:1.5pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="TableHeading"><span>Accredited entities taken to be approved to participate in the Australian Government Digital ID System</span></p></td></tr><tr><td style="width:32.2pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="TableHeading"><span>Item</span></p></td><td style="width:90.95pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="TableHeading"><span>Column 1</span></p><p class="TableHeading"><span>Entity</span></p></td><td style="width:91.55pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="TableHeading"><span>Column 2</span></p><p class="Tabletext"><span style="font-weight:bold">Kind of accredited entity</span></p></td><td style="width:168.55pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="TableHeading"><span>Column 3</span></p><p class="TableHeading"><span>Conditions</span></p></td></tr></thead><tbody><tr><td style="width:32.2pt; border-top:1.5pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>1</span></p></td><td style="width:90.95pt; border-top:1.5pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>Services Australia</span></p></td><td style="width:91.55pt; border-top:1.5pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>Accredited attribute service provider</span></p></td><td style="width:168.55pt; border-top:1.5pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tablea"><span>The entity must:</span></p><p class="Tabletext" style="margin-left:18.85pt; text-indent:-18.85pt"><span>(a)</span><span style="width:7.75pt; text-indent:0pt; display:inline-block"> </span><span>provide its accredited services to issue and manage the myGov linkID attribute; and</span></p><p class="Tabletext" style="margin-left:18.85pt; text-indent:-18.85pt"><span>(b)</span><span style="width:7.19pt; text-indent:0pt; display:inline-block"> </span><span>directly connect to the Designated Identity Exchange Provider.</span></p></td></tr><tr><td style="width:32.2pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext" style="page-break-inside:avoid; page-break-after:avoid"><span>2</span></p></td><td style="width:90.95pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext" style="page-break-inside:avoid; page-break-after:avoid"><span>Services Australia</span></p></td><td style="width:91.55pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext" style="page-break-inside:avoid; page-break-after:avoid"><span>Accredited identity exchange provider</span></p></td><td style="width:168.55pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext" style="page-break-inside:avoid; page-break-after:avoid"><span>The entity must undertake all of the following if, during a reporting period for the entity, the entity has informed a participating relying party, in accordance with section</span><span> </span><span>2.2.1 of Schedule</span><span> </span><span>1 to the AGDIS Data Standards, which accredited identity service provider an individual used to authenticate (</span><span style="font-weight:bold; font-style:italic">the disclosure</span><span>):</span></p><p class="Tablea"><span>(a)</span><span style="width:3.1pt; text-indent:0pt; display:inline-block"> </span><span>arrange, in respect of that reporting period, an independent audit of the entity’s compliance with:</span></p><p class="Tablei"><span>(i)</span><span style="width:4.76pt; text-indent:0pt; display:inline-block"> </span><span>section</span><span> </span><span>2.2.1.4 and the data representation in Table</span><span> </span><span>30 of Schedule</span><span> </span><span>3 to the AGDIS Data Standards in relation to the disclosure; and</span></p><p class="Tablei"><span>(ii)</span><span style="width:1.98pt; text-indent:0pt; display:inline-block"> </span><span>any requirements in the federation protocol used by the participating relying party in relation to the disclosure;</span></p><p class="Tablea"><span>(b)</span><span style="width:2.54pt; text-indent:0pt; display:inline-block"> </span><span>provide the auditor’s findings in relation to that reporting period to the Digital ID Regulator before the end of the next reporting period; and</span></p><p class="Tablea"><span>(c)</span><span style="width:3.1pt; text-indent:0pt; display:inline-block"> </span><span>publish the auditor’s findings in relation to that reporting period on the entity’s website.</span></p></td></tr></tbody></table>

2.3 Relying parties taken to be approved to participate in the Australian Government Digital ID System immediately after commencement

For the purposes of item 10 of the table in subitem 4(2) of Schedule 1 to the Act, the Digital ID Regulator is taken, immediately after commencement, to: (a) have approved an entity specified in column 1 of an item in Table 2 of Schedule 1 to participate in the Australian Government Digital ID System for the purposes of section 62 of the Digital ID Act as a participating relying party; and (b) have imposed the conditions specified in column 2 of the item on the entity’s approval for the purposes of paragraph 64(2)(a) of the Digital ID Act.

2.4 Relying parties taken to be approved to participate in the Australian Government Digital ID System on a specified date after commencement

(1) Subitem 4(2) of Schedule 1 to the Act has effect in relation to an entity mentioned in subrule (2) with the modifications prescribed in that subrule. (2) For the purposes of item 10 of the table in subitem 4(2) of Schedule 1 to the Act, the Digital ID Regulator is taken, on the specified date, to: (a) have approved an entity specified in column 1 of an item in Table 3 of Schedule 1 to participate in the Australian Government Digital ID System for the purposes of section 62 of the Digital ID Act as a participating relying party; and (b) have imposed the conditions specified in column 2 of the item on the entity’s approval for the purposes of paragraph 64(2)(a) of the Digital ID Act. (3) Item 5 of Schedule 1 to the Act has effect in relation to an entity mentioned in subrule (2) with the modifications prescribed in subrules (4) to (11). (4) Item 5 of Schedule 1 to the Act applies in relation to an entity that holds an approval to participate in the Australian Government Digital ID System because of the operation of subitem 4(2) of Schedule 1 to the Act as modified by this rule. (5) For the purposes of paragraph 62(5)(a) of the Digital ID Act: (a) the Digital ID Regulator is taken to have given written notice of the decision to approve the entity to participate in the Australian Government Digital ID System; and (b) the notice referred to in paragraph (a) is taken to have complied with subsection 62(6) of the Digital ID Act. (6) For the purposes of paragraph 62(6)(a) of the Digital ID Act, the Digital ID Regulator is taken to have notified the entity that the day the entity’s approval to participate in the Australian Government Digital ID System comes into force is the specified date. (7) For the purposes of paragraph 62(6)(c) of the Digital ID Act, the Digital ID Regulator is taken to have notified the entity of the conditions set out in column 2 of the item in Table 3 of Schedule 1 that relates to the entity. (8) For the purposes of paragraph 62(6)(d) of the Digital ID Act, the Digital ID Regulator is taken to have notified the entity that the day on which the entity must begin to participate in the Australian Government Digital ID System is the specified date. (9) For the purposes of paragraph 64(1)(c) of the Digital ID Act, the entity is taken to have begun participating in the Australian Government Digital ID System on the specified date. (10) A decision taken to have been made because of the operation of paragraph 4(2)(b) of Schedule 1 to the Act as modified by this rule is not a reviewable decision for the purposes of the Digital ID Act. (11) In this rule:

specified date, in relation to an entity mentioned in subrule (2), means the date specified in column 3 of the item in Table 3 in Schedule 1 that relates to the entity.

Part 3—Transitional liability arrangements

2.5 Application of statutory contract provisions in the Digital ID Act

(1) Division 2 of Part 3 of Chapter 4 of the Digital ID Act does not apply until the earlier of the following: (a) 2 years after commencement; and (b) the first date on which rules made under subsection 85(5) of the Digital ID Act commence. (2) For the avoidance of doubt, this rule does not limit or modify the power of the Minister to make rules in accordance with subsection 85(5) or section 87 of the Digital ID Act.

Part 4—Other modifications to the Act

2.6 References to myGovID in the Act

References to ‘myGovID’ in the Act are taken to be references to ‘myID’.

Part 5—Other modifications to the Digital ID Act

2.7 Conditions on accreditation relating to restricted attributes of individuals

Subsections 18(2) and (3) of the Digital ID Act (about conditions relating to restricted attributes of individuals) do not apply in relation to: (a) the conditions taken to be imposed under paragraph (h) of column 3 of item 2 of the table in item 2 of Schedule 1 to the Act; and (b) the conditions taken to be imposed under paragraph (c) of column 3 of item 3 of Table 1 in Schedule 1.

2.5 Application of statutory contract provisions in the Digital ID Act

(1) Division 2 of Part 3 of Chapter 4 of the Digital ID Act does not apply until the earlier of the following: (a) 2 years after commencement; and (b) the first date on which rules made under subsection 85(5) of the Digital ID Act commence. (2) For the avoidance of doubt, this rule does not limit or modify the power of the Minister to make rules in accordance with subsection 85(5) or section 87 of the Digital ID Act.

Chapter 1—Preliminary

1.1 Name

These rules are the Digital ID (Transitional and Consequential Provisions) Rules 2024.

1.2 Commencement

These rules commence at the same time as the Digital ID (Transitional and Consequential Provisions) Act 2024 commences.

1.3 Authority

These rules are made under item 10 of Schedule 1 to the Digital ID (Transitional and Consequential Provisions) Act 2024.

Note 1: Item 10 of Schedule 1 to the Act (the Schedule) relevantly provides that:

(a) the Minister may make rules prescribing matters required or permitted by the Schedule to be prescribed by the rules, or necessary or convenient to be prescribed for carrying out or giving effect to the Schedule;
(b) without limiting the rule-making power mentioned in paragraph (a), the rules may prescribe matters of a transitional nature (including prescribing any saving or application provisions) relating to the enactment of the Schedule or the Digital ID Act;
(c) rules made for the purposes of item 10 of the Schedule before the end of 12 months after commencement may provide that the Act or the Digital ID Act have effect with any modifications prescribed by the rules; and
(d) subject to the limitations in subitem 10(4) of the Schedule, the Act does not limit the rules that may be made.

Note 2: Subitem 10(4) of the Schedule provides that, to avoid doubt, the rules may not do the following:

(a) create an offence or civil penalty;
(b) provide powers of arrest or detention, or entry, search or seizure;
(c) impose a tax;
(d) set an amount to be appropriated from the Consolidated Revenue Fund under an appropriation in the Act;
(e) directly amend the text of the Act or the Digital ID Act.

1.4 Definitions

Note 1: A number of expressions used in these rules are defined in the Act, including the following:

commencement;
driver’s licence;
medicare card;
myGov;
passport.

Note 2: A number of expressions used in these rules are defined in the Digital ID Act, including the following:

accredited entity;
attribute;
digital ID;
participating relying party;
personal information.

Note 3: A number of expressions used in these rules are defined in the Accreditation Rules, including the following:

biometric binding;
identity proofing;
IP level;
reporting period;
special attribute.

(1) Expressions defined in the Digital ID Act and the Accreditation Rules have the same meaning in these rules. (2) In these rules:

Act means the Digital ID (Transitional and Consequential Provisions) Act 2024.

Accreditation Data Standards means the Digital ID (Accreditation) Data Standards 2024.

Accreditation Rules means the Digital ID (Accreditation) Rules 2024.

AGDIS Data Standards means the Digital ID (AGDIS) Data Standards 2024.

AL2 means the authentication level specified as AL2 in rule 3.1 of the Accreditation Data Standards.

Designated Identity Exchange Provider means Services Australia in its capacity as an accredited identity exchange provider while participating in the Australian Government Digital ID System.

Digital ID Act means the Digital ID Act 2024.

myGov linkID means a special attribute that links a person with a service available through myGov that the person seeks to access.

one-off digital ID: see rule 5.3 of the Accreditation Rules.

1.5 Schedules

Each instrument that is specified in a Schedule to this instrument is amended or repealed as set out in the applicable items in the Schedule concerned, and any other item in a Schedule to this instrument has effect according to its terms.

Chapter 2—Transitional and application rules

Part 1—Accreditation

2.1 Entities taken to be accredited immediately after commencement

For the purposes of item 4 of the table in item 2 of Schedule 1 to the Act, the Digital ID Regulator is taken, immediately after commencement, to: (a) have decided for the purposes of subsection 15(2) of the Digital ID Act to accredit an entity specified in column 1 of an item in Table 1 of Schedule 1 as the kind of accredited entity specified in column 2 of the item; and (b) have imposed the conditions, if any, specified in column 3 of the item on the entity’s accreditation for the purposes of paragraph 17(2)(a) of the Digital ID Act.

Part 2—Approval to participate in the Australian Government Digital ID System

2.2 Accredited entities taken to be approved to participate in the Australian Government Digital ID System immediately after commencement

For the purposes of item 4 of the table in subitem 4(1) of Schedule 1 to the Act, the Digital ID Regulator is taken, immediately after commencement, to: (a) have approved an entity specified in column 1 of an item in the following table to participate in the Australian Government Digital ID System for the purposes of section 62 of the Digital ID Act as the kind of accredited entity specified in column 2 of the item; and (b) have imposed the conditions specified in column 3 of the item on the entity’s approval for the purposes of paragraph 64(2)(a) of the Digital ID Act.

<table cellspacing="0" cellpadding="0" style="width:100%; border-collapse:collapse"><thead><tr><td colspan="4" style="width:415.65pt; border-top:1.5pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="TableHeading"><span>Accredited entities taken to be approved to participate in the Australian Government Digital ID System</span></p></td></tr><tr><td style="width:32.2pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="TableHeading"><span>Item</span></p></td><td style="width:90.95pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="TableHeading"><span>Column 1</span></p><p class="TableHeading"><span>Entity</span></p></td><td style="width:91.55pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="TableHeading"><span>Column 2</span></p><p class="Tabletext"><span style="font-weight:bold">Kind of accredited entity</span></p></td><td style="width:168.55pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="TableHeading"><span>Column 3</span></p><p class="TableHeading"><span>Conditions</span></p></td></tr></thead><tbody><tr><td style="width:32.2pt; border-top:1.5pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>1</span></p></td><td style="width:90.95pt; border-top:1.5pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>Services Australia</span></p></td><td style="width:91.55pt; border-top:1.5pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>Accredited attribute service provider</span></p></td><td style="width:168.55pt; border-top:1.5pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tablea"><span>The entity must:</span></p><p class="Tabletext" style="margin-left:18.85pt; text-indent:-18.85pt"><span>(a)</span><span style="width:7.75pt; text-indent:0pt; display:inline-block"> </span><span>provide its accredited services to issue and manage the myGov linkID attribute; and</span></p><p class="Tabletext" style="margin-left:18.85pt; text-indent:-18.85pt"><span>(b)</span><span style="width:7.19pt; text-indent:0pt; display:inline-block"> </span><span>directly connect to the Designated Identity Exchange Provider.</span></p></td></tr><tr><td style="width:32.2pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext" style="page-break-inside:avoid; page-break-after:avoid"><span>2</span></p></td><td style="width:90.95pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext" style="page-break-inside:avoid; page-break-after:avoid"><span>Services Australia</span></p></td><td style="width:91.55pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext" style="page-break-inside:avoid; page-break-after:avoid"><span>Accredited identity exchange provider</span></p></td><td style="width:168.55pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext" style="page-break-inside:avoid; page-break-after:avoid"><span>The entity must undertake all of the following if, during a reporting period for the entity, the entity has informed a participating relying party, in accordance with section</span><span> </span><span>2.2.1 of Schedule</span><span> </span><span>1 to the AGDIS Data Standards, which accredited identity service provider an individual used to authenticate (</span><span style="font-weight:bold; font-style:italic">the disclosure</span><span>):</span></p><p class="Tablea"><span>(a)</span><span style="width:3.1pt; text-indent:0pt; display:inline-block"> </span><span>arrange, in respect of that reporting period, an independent audit of the entity’s compliance with:</span></p><p class="Tablei"><span>(i)</span><span style="width:4.76pt; text-indent:0pt; display:inline-block"> </span><span>section</span><span> </span><span>2.2.1.4 and the data representation in Table</span><span> </span><span>30 of Schedule</span><span> </span><span>3 to the AGDIS Data Standards in relation to the disclosure; and</span></p><p class="Tablei"><span>(ii)</span><span style="width:1.98pt; text-indent:0pt; display:inline-block"> </span><span>any requirements in the federation protocol used by the participating relying party in relation to the disclosure;</span></p><p class="Tablea"><span>(b)</span><span style="width:2.54pt; text-indent:0pt; display:inline-block"> </span><span>provide the auditor’s findings in relation to that reporting period to the Digital ID Regulator before the end of the next reporting period; and</span></p><p class="Tablea"><span>(c)</span><span style="width:3.1pt; text-indent:0pt; display:inline-block"> </span><span>publish the auditor’s findings in relation to that reporting period on the entity’s website.</span></p></td></tr></tbody></table>

2.3 Relying parties taken to be approved to participate in the Australian Government Digital ID System immediately after commencement

For the purposes of item 10 of the table in subitem 4(2) of Schedule 1 to the Act, the Digital ID Regulator is taken, immediately after commencement, to: (a) have approved an entity specified in column 1 of an item in Table 2 of Schedule 1 to participate in the Australian Government Digital ID System for the purposes of section 62 of the Digital ID Act as a participating relying party; and (b) have imposed the conditions specified in column 2 of the item on the entity’s approval for the purposes of paragraph 64(2)(a) of the Digital ID Act.

2.4 Relying parties taken to be approved to participate in the Australian Government Digital ID System on a specified date after commencement

(1) Subitem 4(2) of Schedule 1 to the Act has effect in relation to an entity mentioned in subrule (2) with the modifications prescribed in that subrule. (2) For the purposes of item 10 of the table in subitem 4(2) of Schedule 1 to the Act, the Digital ID Regulator is taken, on the specified date, to: (a) have approved an entity specified in column 1 of an item in Table 3 of Schedule 1 to participate in the Australian Government Digital ID System for the purposes of section 62 of the Digital ID Act as a participating relying party; and (b) have imposed the conditions specified in column 2 of the item on the entity’s approval for the purposes of paragraph 64(2)(a) of the Digital ID Act. (3) Item 5 of Schedule 1 to the Act has effect in relation to an entity mentioned in subrule (2) with the modifications prescribed in subrules (4) to (11). (4) Item 5 of Schedule 1 to the Act applies in relation to an entity that holds an approval to participate in the Australian Government Digital ID System because of the operation of subitem 4(2) of Schedule 1 to the Act as modified by this rule. (5) For the purposes of paragraph 62(5)(a) of the Digital ID Act: (a) the Digital ID Regulator is taken to have given written notice of the decision to approve the entity to participate in the Australian Government Digital ID System; and (b) the notice referred to in paragraph (a) is taken to have complied with subsection 62(6) of the Digital ID Act. (6) For the purposes of paragraph 62(6)(a) of the Digital ID Act, the Digital ID Regulator is taken to have notified the entity that the day the entity’s approval to participate in the Australian Government Digital ID System comes into force is the specified date. (7) For the purposes of paragraph 62(6)(c) of the Digital ID Act, the Digital ID Regulator is taken to have notified the entity of the conditions set out in column 2 of the item in Table 3 of Schedule 1 that relates to the entity. (8) For the purposes of paragraph 62(6)(d) of the Digital ID Act, the Digital ID Regulator is taken to have notified the entity that the day on which the entity must begin to participate in the Australian Government Digital ID System is the specified date. (9) For the purposes of paragraph 64(1)(c) of the Digital ID Act, the entity is taken to have begun participating in the Australian Government Digital ID System on the specified date. (10) A decision taken to have been made because of the operation of paragraph 4(2)(b) of Schedule 1 to the Act as modified by this rule is not a reviewable decision for the purposes of the Digital ID Act. (11) In this rule:

specified date, in relation to an entity mentioned in subrule (2), means the date specified in column 3 of the item in Table 3 in Schedule 1 that relates to the entity.

Part 3—Transitional liability arrangements

2.5 Application of statutory contract provisions in the Digital ID Act

(1) Division 2 of Part 3 of Chapter 4 of the Digital ID Act does not apply until the earlier of the following: (a) 2 years after commencement; and (b) the first date on which rules made under subsection 85(5) of the Digital ID Act commence. (2) For the avoidance of doubt, this rule does not limit or modify the power of the Minister to make rules in accordance with subsection 85(5) or section 87 of the Digital ID Act.

Part 4—Other modifications to the Act

2.6 References to myGovID in the Act

References to ‘myGovID’ in the Act are taken to be references to ‘myID’.

Part 5—Other modifications to the Digital ID Act

2.7 Conditions on accreditation relating to restricted attributes of individuals

Subsections 18(2) and (3) of the Digital ID Act (about conditions relating to restricted attributes of individuals) do not apply in relation to: (a) the conditions taken to be imposed under paragraph (h) of column 3 of item 2 of the table in item 2 of Schedule 1 to the Act; and (b) the conditions taken to be imposed under paragraph (c) of column 3 of item 3 of Table 1 in Schedule 1.

2.6 References to myGovID in the Act

References to ‘myGovID’ in the Act are taken to be references to ‘myID’.

Chapter 1—Preliminary

1.1 Name

These rules are the Digital ID (Transitional and Consequential Provisions) Rules 2024.

1.2 Commencement

These rules commence at the same time as the Digital ID (Transitional and Consequential Provisions) Act 2024 commences.

1.3 Authority

These rules are made under item 10 of Schedule 1 to the Digital ID (Transitional and Consequential Provisions) Act 2024.

Note 1: Item 10 of Schedule 1 to the Act (the Schedule) relevantly provides that:

(a) the Minister may make rules prescribing matters required or permitted by the Schedule to be prescribed by the rules, or necessary or convenient to be prescribed for carrying out or giving effect to the Schedule;
(b) without limiting the rule-making power mentioned in paragraph (a), the rules may prescribe matters of a transitional nature (including prescribing any saving or application provisions) relating to the enactment of the Schedule or the Digital ID Act;
(c) rules made for the purposes of item 10 of the Schedule before the end of 12 months after commencement may provide that the Act or the Digital ID Act have effect with any modifications prescribed by the rules; and
(d) subject to the limitations in subitem 10(4) of the Schedule, the Act does not limit the rules that may be made.

Note 2: Subitem 10(4) of the Schedule provides that, to avoid doubt, the rules may not do the following:

(a) create an offence or civil penalty;
(b) provide powers of arrest or detention, or entry, search or seizure;
(c) impose a tax;
(d) set an amount to be appropriated from the Consolidated Revenue Fund under an appropriation in the Act;
(e) directly amend the text of the Act or the Digital ID Act.

1.4 Definitions

Note 1: A number of expressions used in these rules are defined in the Act, including the following:

commencement;
driver’s licence;
medicare card;
myGov;
passport.

Note 2: A number of expressions used in these rules are defined in the Digital ID Act, including the following:

accredited entity;
attribute;
digital ID;
participating relying party;
personal information.

Note 3: A number of expressions used in these rules are defined in the Accreditation Rules, including the following:

biometric binding;
identity proofing;
IP level;
reporting period;
special attribute.

(1) Expressions defined in the Digital ID Act and the Accreditation Rules have the same meaning in these rules. (2) In these rules:

Act means the Digital ID (Transitional and Consequential Provisions) Act 2024.

Accreditation Data Standards means the Digital ID (Accreditation) Data Standards 2024.

Accreditation Rules means the Digital ID (Accreditation) Rules 2024.

AGDIS Data Standards means the Digital ID (AGDIS) Data Standards 2024.

AL2 means the authentication level specified as AL2 in rule 3.1 of the Accreditation Data Standards.

Designated Identity Exchange Provider means Services Australia in its capacity as an accredited identity exchange provider while participating in the Australian Government Digital ID System.

Digital ID Act means the Digital ID Act 2024.

myGov linkID means a special attribute that links a person with a service available through myGov that the person seeks to access.

one-off digital ID: see rule 5.3 of the Accreditation Rules.

1.5 Schedules

Each instrument that is specified in a Schedule to this instrument is amended or repealed as set out in the applicable items in the Schedule concerned, and any other item in a Schedule to this instrument has effect according to its terms.

Chapter 2—Transitional and application rules

Part 1—Accreditation

2.1 Entities taken to be accredited immediately after commencement

For the purposes of item 4 of the table in item 2 of Schedule 1 to the Act, the Digital ID Regulator is taken, immediately after commencement, to: (a) have decided for the purposes of subsection 15(2) of the Digital ID Act to accredit an entity specified in column 1 of an item in Table 1 of Schedule 1 as the kind of accredited entity specified in column 2 of the item; and (b) have imposed the conditions, if any, specified in column 3 of the item on the entity’s accreditation for the purposes of paragraph 17(2)(a) of the Digital ID Act.

Part 2—Approval to participate in the Australian Government Digital ID System

2.2 Accredited entities taken to be approved to participate in the Australian Government Digital ID System immediately after commencement

For the purposes of item 4 of the table in subitem 4(1) of Schedule 1 to the Act, the Digital ID Regulator is taken, immediately after commencement, to: (a) have approved an entity specified in column 1 of an item in the following table to participate in the Australian Government Digital ID System for the purposes of section 62 of the Digital ID Act as the kind of accredited entity specified in column 2 of the item; and (b) have imposed the conditions specified in column 3 of the item on the entity’s approval for the purposes of paragraph 64(2)(a) of the Digital ID Act.

<table cellspacing="0" cellpadding="0" style="width:100%; border-collapse:collapse"><thead><tr><td colspan="4" style="width:415.65pt; border-top:1.5pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="TableHeading"><span>Accredited entities taken to be approved to participate in the Australian Government Digital ID System</span></p></td></tr><tr><td style="width:32.2pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="TableHeading"><span>Item</span></p></td><td style="width:90.95pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="TableHeading"><span>Column 1</span></p><p class="TableHeading"><span>Entity</span></p></td><td style="width:91.55pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="TableHeading"><span>Column 2</span></p><p class="Tabletext"><span style="font-weight:bold">Kind of accredited entity</span></p></td><td style="width:168.55pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="TableHeading"><span>Column 3</span></p><p class="TableHeading"><span>Conditions</span></p></td></tr></thead><tbody><tr><td style="width:32.2pt; border-top:1.5pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>1</span></p></td><td style="width:90.95pt; border-top:1.5pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>Services Australia</span></p></td><td style="width:91.55pt; border-top:1.5pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>Accredited attribute service provider</span></p></td><td style="width:168.55pt; border-top:1.5pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tablea"><span>The entity must:</span></p><p class="Tabletext" style="margin-left:18.85pt; text-indent:-18.85pt"><span>(a)</span><span style="width:7.75pt; text-indent:0pt; display:inline-block"> </span><span>provide its accredited services to issue and manage the myGov linkID attribute; and</span></p><p class="Tabletext" style="margin-left:18.85pt; text-indent:-18.85pt"><span>(b)</span><span style="width:7.19pt; text-indent:0pt; display:inline-block"> </span><span>directly connect to the Designated Identity Exchange Provider.</span></p></td></tr><tr><td style="width:32.2pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext" style="page-break-inside:avoid; page-break-after:avoid"><span>2</span></p></td><td style="width:90.95pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext" style="page-break-inside:avoid; page-break-after:avoid"><span>Services Australia</span></p></td><td style="width:91.55pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext" style="page-break-inside:avoid; page-break-after:avoid"><span>Accredited identity exchange provider</span></p></td><td style="width:168.55pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext" style="page-break-inside:avoid; page-break-after:avoid"><span>The entity must undertake all of the following if, during a reporting period for the entity, the entity has informed a participating relying party, in accordance with section</span><span> </span><span>2.2.1 of Schedule</span><span> </span><span>1 to the AGDIS Data Standards, which accredited identity service provider an individual used to authenticate (</span><span style="font-weight:bold; font-style:italic">the disclosure</span><span>):</span></p><p class="Tablea"><span>(a)</span><span style="width:3.1pt; text-indent:0pt; display:inline-block"> </span><span>arrange, in respect of that reporting period, an independent audit of the entity’s compliance with:</span></p><p class="Tablei"><span>(i)</span><span style="width:4.76pt; text-indent:0pt; display:inline-block"> </span><span>section</span><span> </span><span>2.2.1.4 and the data representation in Table</span><span> </span><span>30 of Schedule</span><span> </span><span>3 to the AGDIS Data Standards in relation to the disclosure; and</span></p><p class="Tablei"><span>(ii)</span><span style="width:1.98pt; text-indent:0pt; display:inline-block"> </span><span>any requirements in the federation protocol used by the participating relying party in relation to the disclosure;</span></p><p class="Tablea"><span>(b)</span><span style="width:2.54pt; text-indent:0pt; display:inline-block"> </span><span>provide the auditor’s findings in relation to that reporting period to the Digital ID Regulator before the end of the next reporting period; and</span></p><p class="Tablea"><span>(c)</span><span style="width:3.1pt; text-indent:0pt; display:inline-block"> </span><span>publish the auditor’s findings in relation to that reporting period on the entity’s website.</span></p></td></tr></tbody></table>

2.3 Relying parties taken to be approved to participate in the Australian Government Digital ID System immediately after commencement

For the purposes of item 10 of the table in subitem 4(2) of Schedule 1 to the Act, the Digital ID Regulator is taken, immediately after commencement, to: (a) have approved an entity specified in column 1 of an item in Table 2 of Schedule 1 to participate in the Australian Government Digital ID System for the purposes of section 62 of the Digital ID Act as a participating relying party; and (b) have imposed the conditions specified in column 2 of the item on the entity’s approval for the purposes of paragraph 64(2)(a) of the Digital ID Act.

2.4 Relying parties taken to be approved to participate in the Australian Government Digital ID System on a specified date after commencement

(1) Subitem 4(2) of Schedule 1 to the Act has effect in relation to an entity mentioned in subrule (2) with the modifications prescribed in that subrule. (2) For the purposes of item 10 of the table in subitem 4(2) of Schedule 1 to the Act, the Digital ID Regulator is taken, on the specified date, to: (a) have approved an entity specified in column 1 of an item in Table 3 of Schedule 1 to participate in the Australian Government Digital ID System for the purposes of section 62 of the Digital ID Act as a participating relying party; and (b) have imposed the conditions specified in column 2 of the item on the entity’s approval for the purposes of paragraph 64(2)(a) of the Digital ID Act. (3) Item 5 of Schedule 1 to the Act has effect in relation to an entity mentioned in subrule (2) with the modifications prescribed in subrules (4) to (11). (4) Item 5 of Schedule 1 to the Act applies in relation to an entity that holds an approval to participate in the Australian Government Digital ID System because of the operation of subitem 4(2) of Schedule 1 to the Act as modified by this rule. (5) For the purposes of paragraph 62(5)(a) of the Digital ID Act: (a) the Digital ID Regulator is taken to have given written notice of the decision to approve the entity to participate in the Australian Government Digital ID System; and (b) the notice referred to in paragraph (a) is taken to have complied with subsection 62(6) of the Digital ID Act. (6) For the purposes of paragraph 62(6)(a) of the Digital ID Act, the Digital ID Regulator is taken to have notified the entity that the day the entity’s approval to participate in the Australian Government Digital ID System comes into force is the specified date. (7) For the purposes of paragraph 62(6)(c) of the Digital ID Act, the Digital ID Regulator is taken to have notified the entity of the conditions set out in column 2 of the item in Table 3 of Schedule 1 that relates to the entity. (8) For the purposes of paragraph 62(6)(d) of the Digital ID Act, the Digital ID Regulator is taken to have notified the entity that the day on which the entity must begin to participate in the Australian Government Digital ID System is the specified date. (9) For the purposes of paragraph 64(1)(c) of the Digital ID Act, the entity is taken to have begun participating in the Australian Government Digital ID System on the specified date. (10) A decision taken to have been made because of the operation of paragraph 4(2)(b) of Schedule 1 to the Act as modified by this rule is not a reviewable decision for the purposes of the Digital ID Act. (11) In this rule:

specified date, in relation to an entity mentioned in subrule (2), means the date specified in column 3 of the item in Table 3 in Schedule 1 that relates to the entity.

Part 3—Transitional liability arrangements

2.5 Application of statutory contract provisions in the Digital ID Act

(1) Division 2 of Part 3 of Chapter 4 of the Digital ID Act does not apply until the earlier of the following: (a) 2 years after commencement; and (b) the first date on which rules made under subsection 85(5) of the Digital ID Act commence. (2) For the avoidance of doubt, this rule does not limit or modify the power of the Minister to make rules in accordance with subsection 85(5) or section 87 of the Digital ID Act.

Part 4—Other modifications to the Act

2.6 References to myGovID in the Act

References to ‘myGovID’ in the Act are taken to be references to ‘myID’.

Part 5—Other modifications to the Digital ID Act

2.7 Conditions on accreditation relating to restricted attributes of individuals

Subsections 18(2) and (3) of the Digital ID Act (about conditions relating to restricted attributes of individuals) do not apply in relation to: (a) the conditions taken to be imposed under paragraph (h) of column 3 of item 2 of the table in item 2 of Schedule 1 to the Act; and (b) the conditions taken to be imposed under paragraph (c) of column 3 of item 3 of Table 1 in Schedule 1.

2.7 Conditions on accreditation relating to restricted attributes of individuals

Subsections 18(2) and (3) of the Digital ID Act (about conditions relating to restricted attributes of individuals) do not apply in relation to: (a) the conditions taken to be imposed under paragraph (h) of column 3 of item 2 of the table in item 2 of Schedule 1 to the Act; and (b) the conditions taken to be imposed under paragraph (c) of column 3 of item 3 of Table 1 in Schedule 1.

Table 1 – Entities taken to be approved as accredited entities immediately after commencement

Note: See rule 2.1 (Entities taken to be accredited immediately after commencement).

<table cellspacing="0" cellpadding="0" style="width:100%; border-collapse:collapse"><thead><tr><td colspan="4" style="width:415.65pt; border-top:1.5pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="TableHeading"><span>Entities taken to be approved as accredited entities immediately after commencement</span></p></td></tr><tr><td style="width:25.7pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="TableHeading"><span>Item</span></p></td><td style="width:70.05pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="TableHeading"><span>Column 1</span></p><p class="TableHeading"><span>Entity</span></p></td><td style="width:99.5pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="TableHeading"><span>Column 2</span></p><p class="TableHeading"><span>Kind of accredited entity</span></p></td><td style="width:188pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="TableHeading"><span>Column 3</span></p><p class="TableHeading"><span>Conditions</span></p></td></tr></thead><tbody><tr><td style="width:25.7pt; border-top:1.5pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>1</span></p></td><td style="width:70.05pt; border-top:1.5pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>Australian Postal Corporation</span></p></td><td style="width:99.5pt; border-top:1.5pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>Accredited identity service provider</span></p></td><td style="width:188pt; border-top:1.5pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tablea"><span class="normaltextrun">(a)</span><span style="width:3.1pt; text-indent:0pt; display:inline-block"> </span><span class="normaltextrun">The entity’s </span><span>accredited</span><span class="normaltextrun"> services must only be provided:</span></p><p class="Tablei" style="margin-left:33.75pt; text-indent:-19.55pt"><span class="normaltextrun">(i)</span><span style="width:10.11pt; text-indent:0pt; display:inline-block"> </span><span class="normaltextrun">for the purpose of the service known as </span><span>Digital iD™; and</span></p><p class="Tablei" style="margin-left:33.75pt; text-indent:-19.55pt"><span>(ii)</span><span style="width:7.33pt; text-indent:0pt; display:inline-block"> </span><span>directly through</span><span class="normaltextrun"> the entity’s </span><span>Digital iD™</span><span class="normaltextrun"> </span><span>mobile application.</span></p><p class="Tablea"><span class="normaltextrun">(b)</span><span style="width:2.54pt; text-indent:0pt; display:inline-block"> </span><span class="normaltextrun">The entity’s accredited services exclude services involving any of the following:</span></p><p class="Tablei" style="margin-left:33.75pt; text-indent:-19.55pt"><span>(i)</span><span style="width:10.11pt; text-indent:0pt; display:inline-block"> </span><span>the creation and use of a Keypass credential; or</span></p><p class="Tablei" style="margin-left:33.75pt; text-indent:-19.55pt"><span>(ii)</span><span style="width:7.33pt; text-indent:0pt; display:inline-block"> </span><span>the collection of biometric information of an individual; or</span></p><p class="Tablei" style="margin-left:33.75pt; text-indent:-19.55pt"><span>(iii)</span><span style="width:4.55pt; text-indent:0pt; display:inline-block"> </span><span>the processes for biometric binding; or</span></p><p class="Tablei" style="margin-left:33.75pt; text-indent:-19.55pt"><span>(iv)</span><span style="width:5.11pt; text-indent:0pt; display:inline-block"> </span><span>creating or using a one-off digital ID; or</span></p><p class="Tablei" style="margin-left:33.75pt; text-indent:-19.55pt"><span>(v)</span><span style="width:7.89pt; text-indent:0pt; display:inline-block"> </span><span>in-person visual verification of documents or other credentials; or</span></p><p class="Tablei" style="margin-left:33.75pt; text-indent:-19.55pt"><span>(vi)</span><span style="width:5.11pt; text-indent:0pt; display:inline-block"> </span><span>the collection of an individual’s image for verification purposes.</span></p><p class="Tablea"><span>(c)</span><span style="width:3.1pt; text-indent:0pt; display:inline-block"> </span><span>The entity’s accredited services may support identity proofing up to the IP level in the following table. The IP level required or achieved </span><span class="normaltextrun">will be dependent on which of the entity’s proofing scheme or rule has been selected by a relying party for their digital services.</span></p><p class="Tabletext"><span class="normaltextrun">Accredited proofing schemes/rules include:</span><span class="eop"></span></p><table cellspacing="0" cellpadding="0" style="width:100%; border-collapse:collapse"><tbody><tr><td style="width:115.5pt; border-top:1.5pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="paragraph" style="margin-top:0pt; font-size:10pt"><span class="normaltextrun" style="font-weight:bold">Scheme/rule</span></p></td><td style="width:46.25pt; border-top:1.5pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="paragraph" style="margin-top:0pt; font-size:10pt"><span class="normaltextrun" style="font-weight:bold">IP level</span></p></td></tr><tr><td style="width:115.5pt; border-top:1.5pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="paragraph" style="margin-top:0pt; font-size:10pt"><span class="normaltextrun">TDIF: TDIF IP2</span></p></td><td style="width:46.25pt; border-top:1.5pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="paragraph" style="margin-top:0pt; font-size:10pt"><span class="normaltextrun">IP2</span></p></td></tr><tr><td style="width:115.5pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="paragraph" style="margin-top:0pt; font-size:10pt"><span class="normaltextrun">TDIF: TDIF IP1 PLUS</span></p><p class="paragraph" style="margin-top:0pt; font-size:10pt"><span class="normaltextrun">STARS: 2-Star (rule 2)</span></p><p class="paragraph" style="margin-top:0pt; font-size:10pt"><span class="normaltextrun">STARS: 2-Star (rule 3)</span></p><p class="paragraph" style="margin-top:0pt; font-size:10pt"><span class="normaltextrun">STARS: 1-Star (rule 2)</span></p></td><td style="width:46.25pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="paragraph" style="margin-top:0pt; font-size:10pt"><span class="normaltextrun">IP1 Plus</span></p></td></tr><tr><td style="width:115.5pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="paragraph" style="margin-top:0pt; font-size:10pt"><span class="normaltextrun">STARS: 1-Star (rule 1)</span></p><p class="paragraph" style="margin-top:0pt; font-size:10pt"><span class="normaltextrun">STARS: 1-Star (rule 3)</span></p><p class="paragraph" style="margin-top:0pt; margin-left:0pt; text-indent:0.1pt; font-size:10pt"><span class="normaltextrun">AML KYC Safe Harbour – Premium</span></p><p class="paragraph" style="margin-top:0pt; margin-left:0pt; text-indent:0.1pt; font-size:10pt"><span class="normaltextrun">AML KYC Safe Harbour – Basic</span></p></td><td style="width:46.25pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="paragraph" style="margin-top:0pt; font-size:10pt"><span class="normaltextrun">IP1</span></p></td></tr></tbody></table><p class="Tablea"><span>(d)</span><span style="width:2.54pt; text-indent:0pt; display:inline-block"> </span><span>The entity must advise each of its relying parties and clearly express in any promotional material to relying parties:</span></p><p class="Tablei" style="margin-left:33.75pt; text-indent:-19.55pt"><span>(i)</span><span style="width:10.11pt; text-indent:0pt; display:inline-block"> </span><span>that only the accredited</span><span class="normaltextrun"> proofing </span><span>schemes and rules specified in the table in paragraph</span><span> </span><span>(c) are accredited; and</span></p><p class="Tablei" style="margin-left:33.75pt; text-indent:-19.55pt"><span>(ii)</span><span style="width:7.33pt; text-indent:0pt; display:inline-block"> </span><span>the equivalent IP level for each of the accredited</span><span class="normaltextrun"> proofing schemes and rules as specified in the table in</span><span> paragraph</span><span> </span><span>(c)</span><span class="normaltextrun">.</span></p><p class="Tablea"><span class="normaltextrun">(e)</span><span style="width:3.1pt; text-indent:0pt; display:inline-block"> </span><span class="normaltextrun">The entity’s accredited services may support binding of digital identities to AL2 level authenticators.</span></p></td></tr><tr><td style="width:25.7pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>2</span></p></td><td style="width:70.05pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>ConnectID Pty Ltd</span></p></td><td style="width:99.5pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>Accredited identity exchange provider</span></p></td><td style="width:188pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tablea"><span>(a)</span><span style="width:3.1pt; text-indent:0pt; display:inline-block"> </span><span>The entity’s accredited services must be </span><span class="normaltextrun">provided</span><span> only for the purposes of conveying, managing and coordinating the flow of data or other information between identity service providers and relying parties (</span><span style="font-weight:bold; font-style:italic">ConnectID participants</span><span>) in the identity exchange system known as ConnectID</span><span style="font-size:6.67pt; vertical-align:super">®</span><span> and operated by the entity.</span></p><p class="Tablea"><span>(b)</span><span style="width:2.54pt; text-indent:0pt; display:inline-block"> </span><span>The entity’s accredited services must be provided by way of a partly decentralised peer-to-peer-based identity exchange model or distributed technical approach which:</span></p><p class="Tablei" style="margin-left:33.75pt; text-indent:-19.55pt"><span>(i)</span><span style="width:10.11pt; text-indent:0pt; display:inline-block"> </span><span>supports the interconnectivity of the ConnectID participants;</span></p><p class="Tablei" style="margin-left:33.75pt; text-indent:-19.55pt"><span>(ii)</span><span style="width:7.33pt; text-indent:0pt; display:inline-block"> </span><span>must not require the end-user to directly engage with the ConnectID</span><span style="font-size:6.67pt; vertical-align:super">®</span><span> identity exchange;</span></p><p class="Tablei" style="margin-left:33.75pt; text-indent:-19.55pt"><span>(iii)</span><span style="width:4.55pt; text-indent:0pt; display:inline-block"> </span><span>facilitates digital transactions between relying parties and accredited and unaccredited identity service providers;</span></p><p class="Tablei" style="margin-left:33.75pt; text-indent:-19.55pt"><span>(iv)</span><span style="width:5.11pt; text-indent:0pt; display:inline-block"> </span><span>does not retain or access the information (other than system logs, transactional metadata and billing data) that is generated in, obtained from, or collected for the purposes of, the ConnectID</span><span style="font-size:6.67pt; vertical-align:super">®</span><span> identity exchange by the ConnectID participants and passes through the ConnectID</span><span style="font-size:6.67pt; vertical-align:super">®</span><span> identity exchange;</span></p><p class="Tablei" style="margin-left:33.75pt; text-indent:-19.55pt"><span>(v)</span><span style="width:7.89pt; text-indent:0pt; display:inline-block"> </span><span>is subject to rules, procedures, standards and ConnectID participant contracts to govern each ConnectID participant’s access to and use of the ConnectID</span><span style="font-size:6.67pt; vertical-align:super">®</span><span> identity exchange, and is not inconsistent with the Digital ID Act, the Accreditation Rules and the Accreditation Data Standards; and</span></p><p class="Tablei" style="margin-left:33.75pt; text-indent:-19.55pt"><span>(vi)</span><span style="width:5.11pt; text-indent:0pt; display:inline-block"> </span><span>must have an integrated ConnectID participant registry that is administered by the entity and contains the personal information of the ConnectID participant’s key business contacts.</span></p></td></tr><tr><td style="width:25.7pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>3</span></p></td><td style="width:70.05pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>Makesure Consulting Pty Ltd</span></p></td><td style="width:99.5pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>Accredited identity service provider</span></p></td><td style="width:188pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tablea"><span>(a)</span><span style="width:3.1pt; text-indent:0pt; display:inline-block"> </span><span>The entity’s accredited services must be provided only for the purposes of the RatifyID mobile application, which may only allow users to:</span></p><p class="Tablei" style="margin-left:33.75pt; text-indent:-19.55pt"><span>(i)</span><span style="width:10.11pt; text-indent:0pt; display:inline-block"> </span><span>create a reusable digital ID up to the IP2 IP level; and</span></p><p class="Tablei" style="margin-left:33.75pt; text-indent:-19.55pt"><span>(ii)</span><span style="width:7.33pt; text-indent:0pt; display:inline-block"> </span><span>bind an AL2 level authenticator to that digital ID.</span></p><p class="Tablea"><span>(b)</span><span style="width:2.54pt; text-indent:0pt; display:inline-block"> </span><span>The entity must only disclose personal information to a relying party that reasonably requires that information to enable the relying party to provide, or provide access to, the service requested by the individual.</span></p><p class="Tablea"><span>(c)</span><span style="width:3.1pt; text-indent:0pt; display:inline-block"> </span><span>The entity may only disclose, to any relying party within the class of industry segments specified in sub-column</span><span> </span><span>1 of a sub-item in the following table, the restricted attributes specified in sub-column</span><span> </span><span>2 of that sub-item if the restricted attributes to be disclosed:</span></p><p class="Tablei" style="margin-left:33.75pt; text-indent:-19.55pt"><span>(i)</span><span style="width:10.11pt; text-indent:0pt; display:inline-block"> </span><span>have been collected and verified by the entity through direct interaction with an individual; and</span></p><p class="Tablei" style="margin-left:33.75pt; text-indent:-19.55pt"><span>(ii)</span><span style="width:7.33pt; text-indent:0pt; display:inline-block"> </span><span>have been selected by the requesting relying party in the entity’s information technology system as a restricted attribute that is necessary for the requesting relying party to provide, or provide access to, a service to an individual.</span></p><table cellspacing="0" cellpadding="0" style="width:100%; border-collapse:collapse"><tbody><tr><td style="width:21.45pt; border-top:1.5pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span style="font-weight:bold">Sub-Item</span></p></td><td style="width:62.55pt; border-top:1.5pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span style="font-weight:bold">Sub-column</span><span style="font-weight:bold"> </span><span style="font-weight:bold">1</span></p><p class="Tabletext"><span style="font-weight:bold">Segment</span></p></td><td style="width:66.25pt; border-top:1.5pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span style="font-weight:bold">Sub-column</span><span style="font-weight:bold"> </span><span style="font-weight:bold">2</span></p><p class="Tabletext"><span style="font-weight:bold">Restricted attributes permitted to be disclosed</span></p></td></tr><tr><td style="width:21.45pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>1</span></p></td><td style="width:62.55pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>Aviation infrastructure, security &amp; operations</span></p></td><td style="width:66.25pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>Aviation Security Identity Card reference number.</span></p></td></tr><tr><td style="width:21.45pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>2</span></p></td><td style="width:62.55pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>Corrective services</span></p></td><td style="width:66.25pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>Driver’s licence document number.</span></p><p class="Tabletext"><span>Passport document number.</span></p><p class="Tabletext"><span>Birth certificate document number.</span></p></td></tr><tr><td style="width:21.45pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>3</span></p></td><td style="width:62.55pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>Delivery services</span></p></td><td style="width:66.25pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>Driver’s licence document number.</span></p></td></tr><tr><td style="width:21.45pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>4</span></p></td><td style="width:62.55pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>Healthcare</span></p></td><td style="width:66.25pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>Medicare card Individual Reference Number and card number.</span></p></td></tr><tr><td style="width:21.45pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>5</span></p></td><td style="width:62.55pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>International travel</span></p></td><td style="width:66.25pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>Passport document number.</span></p></td></tr><tr><td style="width:21.45pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>6</span></p></td><td style="width:62.55pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>Labour hire</span></p></td><td style="width:66.25pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>Driver’s licence document number.</span></p></td></tr><tr><td style="width:21.45pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>7</span></p></td><td style="width:62.55pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>Maritime infrastructure, security &amp; operations</span></p></td><td style="width:66.25pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>Maritime Security Identity Card reference number.</span></p></td></tr><tr><td style="width:21.45pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>8</span></p></td><td style="width:62.55pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>Vehicle hire</span></p><p class="Tabletext"><span></span></p></td><td style="width:66.25pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>Driver’s licence document number.</span></p></td></tr></tbody></table><p class="Tablea"><span>(d)</span><span style="width:2.54pt; text-indent:0pt; display:inline-block"> </span><span>The entity must ensure, in relation to the entity’s accredited services provided through the RatifyID mobile application, that:</span></p><p class="Tablei" style="margin-left:33.75pt; text-indent:-19.55pt"><span>(i)</span><span style="width:10.11pt; text-indent:0pt; display:inline-block"> </span><span>the accredited services are hosted by infrastructure situated in Australia;</span></p><p class="Tablei" style="margin-left:33.75pt; text-indent:-19.55pt"><span>(ii)</span><span style="width:7.33pt; text-indent:0pt; display:inline-block"> </span><span>any personal information held by the entity is not disclosed to persons outside of Australia; and</span></p><p class="Tablei" style="margin-left:33.75pt; text-indent:-19.55pt"><span>(iii)</span><span style="width:4.55pt; text-indent:0pt; display:inline-block"> </span><span>third party access to the entity’s server is under the entity’s control and time limited.</span></p></td></tr><tr><td style="width:25.7pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext" style="page-break-inside:avoid; page-break-after:avoid"><span>4</span></p></td><td style="width:70.05pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext" style="page-break-inside:avoid; page-break-after:avoid"><span>OCR Labs Pty Ltd trading as IDVerse</span></p></td><td style="width:99.5pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext" style="page-break-inside:avoid; page-break-after:avoid"><span>Accredited identity service provider</span></p></td><td style="width:188pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tablea" style="page-break-inside:avoid; page-break-after:avoid"><span>(a)</span><span style="width:3.1pt; text-indent:0pt; display:inline-block"> </span><span>The entity’s accredited services must be provided only for the purposes of the service known as iDKit which:</span></p><p class="Tablei" style="margin-left:33.75pt; text-indent:-19.55pt; page-break-inside:avoid; page-break-after:avoid"><span>(i)</span><span style="width:10.11pt; text-indent:0pt; display:inline-block"> </span><span>must only be capable of being ordered in the configuration that existed at the start of 8 July 2024 (</span><span style="font-weight:bold; font-style:italic">accredited configuration</span><span>);</span></p><p class="Tablei" style="margin-left:33.75pt; text-indent:-19.55pt; page-break-inside:avoid; page-break-after:avoid"><span>(ii)</span><span style="width:7.33pt; text-indent:0pt; display:inline-block"> </span><span>must not be changed from the accredited configuration; and</span></p><p class="Tablei" style="margin-left:33.75pt; text-indent:-19.55pt; page-break-inside:avoid; page-break-after:avoid"><span>(iii)</span><span style="width:4.55pt; text-indent:0pt; display:inline-block"> </span><span>must be limited to one-off digital IDs at the IP1 Plus, IP2, IP2 Plus, or IP3 IP levels.</span></p><p class="Tablea" style="page-break-inside:avoid; page-break-after:avoid"><span>(b)</span><span style="width:2.54pt; text-indent:0pt; display:inline-block"> </span><span>Subject to paragraph</span><span> </span><span>(c), the entity may collect biometric information of an individual for the purposes of verifying an individual’s identity or authenticating the individual to their digital ID.</span></p><p class="Tablea" style="page-break-inside:avoid; page-break-after:avoid"><span>(c)</span><span style="width:3.1pt; text-indent:0pt; display:inline-block"> </span><span>The entity must destroy the biometric information of an individual collected in accordance with the preceding condition immediately following successful biometric binding, unless:</span></p><p class="Tablei" style="margin-left:33.75pt; text-indent:-19.55pt; page-break-inside:avoid; page-break-after:avoid"><span>(i)</span><span style="width:10.11pt; text-indent:0pt; display:inline-block"> </span><span>the entity is authorised by section</span><span> </span><span>49 of the Digital ID Act to retain the information; and</span></p><p class="Tablei" style="margin-left:33.75pt; text-indent:-19.55pt; page-break-inside:avoid; page-break-after:avoid"><span>(ii)</span><span style="width:7.33pt; text-indent:0pt; display:inline-block"> </span><span>the entity complies with any requirements prescribed by the Accreditation Rules and the Accreditation Data Standards.</span></p></td></tr><tr><td style="width:25.7pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>5</span></p></td><td style="width:70.05pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>Services Australia</span></p></td><td style="width:99.5pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>Accredited attribute service provider</span></p></td><td style="width:188pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tablea" style="margin-left:0pt; text-indent:0pt"><span>The entity’s accredited services must be provided only for the purpose of issuing and managing the myGov linkID attribute.</span></p></td></tr></tbody></table>