These rules are the Digital ID (Transitional and Consequential Provisions) Rules 2024.
1.2 Commencement
These rules commence at the same time as the Digital ID (Transitional and Consequential Provisions) Act 2024 commences.
1.3 Authority
These rules are made under item 10 of Schedule 1 to the Digital ID (Transitional and Consequential Provisions) Act 2024.
Note 1: Item 10 of Schedule 1 to the Act (the Schedule) relevantly provides that:
(a) the Minister may make rules prescribing matters required or permitted by the Schedule to be prescribed by the rules, or necessary or convenient to be prescribed for carrying out or giving effect to the Schedule;
(b) without limiting the rule-making power mentioned in paragraph (a), the rules may prescribe matters of a transitional nature (including prescribing any saving or application provisions) relating to the enactment of the Schedule or the Digital ID Act;
(c) rules made for the purposes of item 10 of the Schedule before the end of 12 months after commencement may provide that the Act or the Digital ID Act have effect with any modifications prescribed by the rules; and
(d) subject to the limitations in subitem 10(4) of the Schedule, the Act does not limit the rules that may be made.
Note 2: Subitem 10(4) of the Schedule provides that, to avoid doubt, the rules may not do the following:
(a) create an offence or civil penalty;
(b) provide powers of arrest or detention, or entry, search or seizure;
(c) impose a tax;
(d) set an amount to be appropriated from the Consolidated Revenue Fund under an appropriation in the Act;
(e) directly amend the text of the Act or the Digital ID Act.
1.4 Definitions
Note 1: A number of expressions used in these rules are defined in the Act, including the following:
Note 2: A number of expressions used in these rules are defined in the Digital ID Act, including the following:
accredited entity;
attribute;
digital ID;
participating relying party;
personal information.
Note 3: A number of expressions used in these rules are defined in the Accreditation Rules, including the following:
biometric binding;
identity proofing;
IP level;
reporting period;
special attribute.
(1) Expressions defined in the Digital ID Act and the Accreditation Rules have the same meaning in these rules.
(2) In these rules:
Act means the Digital ID (Transitional and Consequential Provisions) Act 2024.
Accreditation Data Standards means the Digital ID (Accreditation) Data Standards 2024.
Accreditation Rules means the Digital ID (Accreditation) Rules 2024.
AGDIS Data Standards means the Digital ID (AGDIS) Data Standards 2024.
AL2 means the authentication level specified as AL2 in rule 3.1 of the Accreditation Data Standards.
Designated Identity Exchange Provider means Services Australia in its capacity as an accredited identity exchange provider while participating in the Australian Government Digital ID System.
Digital ID Act means the Digital ID Act 2024.
myGov linkID means a special attribute that links a person with a service available through myGov that the person seeks to access.
one-off digital ID: see rule 5.3 of the Accreditation Rules.
1.5 Schedules
Each instrument that is specified in a Schedule to this instrument is amended or repealed as set out in the applicable items in the Schedule concerned, and any other item in a Schedule to this instrument has effect according to its terms.
Chapter 2—Transitional and application rules
Part 1—Accreditation
2.1 Entities taken to be accredited immediately after commencement
For the purposes of item 4 of the table in item 2 of Schedule 1 to the Act, the Digital ID Regulator is taken, immediately after commencement, to:
(a) have decided for the purposes of subsection 15(2) of the Digital ID Act to accredit an entity specified in column 1 of an item in Table 1 of Schedule 1 as the kind of accredited entity specified in column 2 of the item; and
(b) have imposed the conditions, if any, specified in column 3 of the item on the entity’s accreditation for the purposes of paragraph 17(2)(a) of the Digital ID Act.
Part 2—Approval to participate in the Australian Government Digital ID System
2.2 Accredited entities taken to be approved to participate in the Australian Government Digital ID System immediately after commencement
For the purposes of item 4 of the table in subitem 4(1) of Schedule 1 to the Act, the Digital ID Regulator is taken, immediately after commencement, to:
(a) have approved an entity specified in column 1 of an item in the following table to participate in the Australian Government Digital ID System for the purposes of section 62 of the Digital ID Act as the kind of accredited entity specified in column 2 of the item; and
(b) have imposed the conditions specified in column 3 of the item on the entity’s approval for the purposes of paragraph 64(2)(a) of the Digital ID Act.
<table cellspacing="0" cellpadding="0" style="width:100%; border-collapse:collapse"><thead><tr><td colspan="4" style="width:415.65pt; border-top:1.5pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="TableHeading"><span>Accredited entities taken to be approved to participate in the Australian Government Digital ID System</span></p></td></tr><tr><td style="width:32.2pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="TableHeading"><span>Item</span></p></td><td style="width:90.95pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="TableHeading"><span>Column 1</span></p><p class="TableHeading"><span>Entity</span></p></td><td style="width:91.55pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="TableHeading"><span>Column 2</span></p><p class="Tabletext"><span style="font-weight:bold">Kind of accredited entity</span></p></td><td style="width:168.55pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="TableHeading"><span>Column 3</span></p><p class="TableHeading"><span>Conditions</span></p></td></tr></thead><tbody><tr><td style="width:32.2pt; border-top:1.5pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>1</span></p></td><td style="width:90.95pt; border-top:1.5pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>Services Australia</span></p></td><td style="width:91.55pt; border-top:1.5pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>Accredited attribute service provider</span></p></td><td style="width:168.55pt; border-top:1.5pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tablea"><span>The entity must:</span></p><p class="Tabletext" style="margin-left:18.85pt; text-indent:-18.85pt"><span>(a)</span><span style="width:7.75pt; text-indent:0pt; display:inline-block"> </span><span>provide its accredited services to issue and manage the myGov linkID attribute; and</span></p><p class="Tabletext" style="margin-left:18.85pt; text-indent:-18.85pt"><span>(b)</span><span style="width:7.19pt; text-indent:0pt; display:inline-block"> </span><span>directly connect to the Designated Identity Exchange Provider.</span></p></td></tr><tr><td style="width:32.2pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext" style="page-break-inside:avoid; page-break-after:avoid"><span>2</span></p></td><td style="width:90.95pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext" style="page-break-inside:avoid; page-break-after:avoid"><span>Services Australia</span></p></td><td style="width:91.55pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext" style="page-break-inside:avoid; page-break-after:avoid"><span>Accredited identity exchange provider</span></p></td><td style="width:168.55pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext" style="page-break-inside:avoid; page-break-after:avoid"><span>The entity must undertake all of the following if, during a reporting period for the entity, the entity has informed a participating relying party, in accordance with section</span><span> </span><span>2.2.1 of Schedule</span><span> </span><span>1 to the AGDIS Data Standards, which accredited identity service provider an individual used to authenticate (</span><span style="font-weight:bold; font-style:italic">the disclosure</span><span>):</span></p><p class="Tablea"><span>(a)</span><span style="width:3.1pt; text-indent:0pt; display:inline-block"> </span><span>arrange, in respect of that reporting period, an independent audit of the entity’s compliance with:</span></p><p class="Tablei"><span>(i)</span><span style="width:4.76pt; text-indent:0pt; display:inline-block"> </span><span>section</span><span> </span><span>2.2.1.4 and the data representation in Table</span><span> </span><span>30 of Schedule</span><span> </span><span>3 to the AGDIS Data Standards in relation to the disclosure; and</span></p><p class="Tablei"><span>(ii)</span><span style="width:1.98pt; text-indent:0pt; display:inline-block"> </span><span>any requirements in the federation protocol used by the participating relying party in relation to the disclosure;</span></p><p class="Tablea"><span>(b)</span><span style="width:2.54pt; text-indent:0pt; display:inline-block"> </span><span>provide the auditor’s findings in relation to that reporting period to the Digital ID Regulator before the end of the next reporting period; and</span></p><p class="Tablea"><span>(c)</span><span style="width:3.1pt; text-indent:0pt; display:inline-block"> </span><span>publish the auditor’s findings in relation to that reporting period on the entity’s website.</span></p></td></tr></tbody></table>
2.3 Relying parties taken to be approved to participate in the Australian Government Digital ID System immediately after commencement
For the purposes of item 10 of the table in subitem 4(2) of Schedule 1 to the Act, the Digital ID Regulator is taken, immediately after commencement, to:
(a) have approved an entity specified in column 1 of an item in Table 2 of Schedule 1 to participate in the Australian Government Digital ID System for the purposes of section 62 of the Digital ID Act as a participating relying party; and
(b) have imposed the conditions specified in column 2 of the item on the entity’s approval for the purposes of paragraph 64(2)(a) of the Digital ID Act.
2.4 Relying parties taken to be approved to participate in the Australian Government Digital ID System on a specified date after commencement
(1) Subitem 4(2) of Schedule 1 to the Act has effect in relation to an entity mentioned in subrule (2) with the modifications prescribed in that subrule.
(2) For the purposes of item 10 of the table in subitem 4(2) of Schedule 1 to the Act, the Digital ID Regulator is taken, on the specified date, to:
(a) have approved an entity specified in column 1 of an item in Table 3 of Schedule 1 to participate in the Australian Government Digital ID System for the purposes of section 62 of the Digital ID Act as a participating relying party; and
(b) have imposed the conditions specified in column 2 of the item on the entity’s approval for the purposes of paragraph 64(2)(a) of the Digital ID Act.
(3) Item 5 of Schedule 1 to the Act has effect in relation to an entity mentioned in subrule (2) with the modifications prescribed in subrules (4) to (11).
(4) Item 5 of Schedule 1 to the Act applies in relation to an entity that holds an approval to participate in the Australian Government Digital ID System because of the operation of subitem 4(2) of Schedule 1 to the Act as modified by this rule.
(5) For the purposes of paragraph 62(5)(a) of the Digital ID Act:
(a) the Digital ID Regulator is taken to have given written notice of the decision to approve the entity to participate in the Australian Government Digital ID System; and
(b) the notice referred to in paragraph (a) is taken to have complied with subsection 62(6) of the Digital ID Act.
(6) For the purposes of paragraph 62(6)(a) of the Digital ID Act, the Digital ID Regulator is taken to have notified the entity that the day the entity’s approval to participate in the Australian Government Digital ID System comes into force is the specified date.
(7) For the purposes of paragraph 62(6)(c) of the Digital ID Act, the Digital ID Regulator is taken to have notified the entity of the conditions set out in column 2 of the item in Table 3 of Schedule 1 that relates to the entity.
(8) For the purposes of paragraph 62(6)(d) of the Digital ID Act, the Digital ID Regulator is taken to have notified the entity that the day on which the entity must begin to participate in the Australian Government Digital ID System is the specified date.
(9) For the purposes of paragraph 64(1)(c) of the Digital ID Act, the entity is taken to have begun participating in the Australian Government Digital ID System on the specified date.
(10) A decision taken to have been made because of the operation of paragraph 4(2)(b) of Schedule 1 to the Act as modified by this rule is not a reviewable decision for the purposes of the Digital ID Act.
(11) In this rule:
specified date, in relation to an entity mentioned in subrule (2), means the date specified in column 3 of the item in Table 3 in Schedule 1 that relates to the entity.
Part 3—Transitional liability arrangements
2.5 Application of statutory contract provisions in the Digital ID Act
(1) Division 2 of Part 3 of Chapter 4 of the Digital ID Act does not apply until the earlier of the following:
(a) 2 years after commencement; and
(b) the first date on which rules made under subsection 85(5) of the Digital ID Act commence.
(2) For the avoidance of doubt, this rule does not limit or modify the power of the Minister to make rules in accordance with subsection 85(5) or section 87 of the Digital ID Act.
Part 4—Other modifications to the Act
2.6 References to myGovID in the Act
References to ‘myGovID’ in the Act are taken to be references to ‘myID’.
Part 5—Other modifications to the Digital ID Act
2.7 Conditions on accreditation relating to restricted attributes of individuals
Subsections 18(2) and (3) of the Digital ID Act (about conditions relating to restricted attributes of individuals) do not apply in relation to:
(a) the conditions taken to be imposed under paragraph (h) of column 3 of item 2 of the table in item 2 of Schedule 1 to the Act; and
(b) the conditions taken to be imposed under paragraph (c) of column 3 of item 3 of Table 1 in Schedule 1.