The Australian Government releases exposure draft of the Digital ID Bill

On 19 September 2023, two years after the initial exposure draft was released, the Australian Government has released the exposure draft of its proposed Digital ID Bill (Digital ID Bill), accompanied by two sets of supporting rules, being the Digital ID Rules and the Digital ID Accreditation Rules (together, the Rules).

The proposed national Digital ID scheme will involve:

• a voluntary accreditation scheme of Digital ID service providers; and
• an Australian Government Digital ID System (AGDIS), initially based around government services which will eventually be expanded to include participating private sector organisations.

The Government has been seeking feedback on the drafts, with consultation on the Digital ID Accreditation Rules remaining open until 31 October 2023.

Overview of framework

The draft Digital ID legislation has been introduced to allow for a phased expansion of the AGDIS (see ‘Phased Implementation’ for more information on the ‘phased approach’).

The key objectives of the Digital ID Bill include:

• establishing accreditation and government system schemes;
• building on the TDIF to strengthen the voluntary accreditation scheme for Digital ID service providers;
• building upon protections in the Privacy Act 1988 (Cth) (Privacy Act) to enshrine additional privacy safeguards for Australians creating and using a Digital ID;
• introducing penalties for accredited Digital ID service providers who fail to protect privacy and security to the standard that their accreditation requires; and
• establishing an independent Digital ID Regulator (see ‘What is Digital ID?’ for further detail on the proposed regulatory approach).

The Digital ID Bill is supplemented by two sets of supporting Rules:

• the Accreditation Rules, which set out a nationally consistent set of accreditation standards and requirements; and
• the Digital ID Rules, which deal with transparency measures, the use of trustmarks by accredited service providers, and government system onboarding requirements (including technical standards and service levels).

Overall, the Digital ID scheme aims to instil confidence in Australian consumers who choose to use the services of accredited providers that their personal information will be protected, provide greater choice of trusted providers to be used to access more services, offer a convenient and reusable way for consumers to prove their identity online, reduce the risk of cyber security theft, and provide a simpler and safer way for businesses to verify the identity of their customers online.

Commentary on the proposed framework

Being in the early stages of the consultation process, public sentiment and industry opinion on the new Digital ID scheme remains unclear. However, it is likely that key concerns will centre around the introduction of the new Digital ID scheme adding to an already disjunct approach to privacy and cybersecurity regulation in Australia, and the need to ensure that the Australian system for digital identity verification aligns to international approaches.

The Digital ID Bill and Rules have significant crossover with both privacy laws and cybersecurity laws, both of which are currently undergoing significant reform. For example, the Digital ID Bill and Rules provide specific and extended requirements for cyber incident reporting, increasing the compliance burden on accredited service providers and businesses that are already required to comply with corresponding obligations under privacy and cybersecurity laws. Further, many obligations under the Privacy Act are already applicable to a digital environment, evidenced by the Australian Government’s decision to allow the Information Commissioner to oversee certain privacy-related aspects of the Digital ID scheme and apply the powers and penalty provisions available under the Privacy Act to Digital IDs, despite not being the appointed Digital ID Regulator (for more information on the Digital ID Regulator, see ‘What is Digital ID?’).

The privacy, cybersecurity and Digital ID regulators will need to work together to ensure their powers and responsibilities are applied consistently and fairly. The introduction of new Digital ID legislation while privacy and cybersecurity reforms are on-foot will make it more difficult to ensure that the overlapping regimes fit together. On the other hand, if the Government waited for privacy and cybersecurity reforms to be completed before introducing the Digital ID Bill and the Rules, Australia would have fallen behind key international players who have already implemented national digital identity systems (see ‘International Approaches’ below).

A further point to consider is that the current draft Digital ID Bill does not contemplate application of the Digital ID to non-Australian citizens or permanent residents, or non-Australian entities. While this may not pose any issues during the implementation period, it will become increasingly important for Australia to align its approach with its international partners to promote global harmonisation in relation to the use of digital identities. As noted by the UK Government during its rollout (see ‘UK’ under ‘International Approaches’ below for further details on the UK approach), the UK intends to work with Australia and other countries to allow citizens to use their digital IDs around the world, and for UK businesses to trust digital IDs created elsewhere. These types of collaborations are likely to support greater adoption of digital identities by individuals and entities alike, but cybersecurity and national security issues will need to be evaluated in implementing these arrangements.

Regulation 

The Digital ID Bill provides for independent regulation of the Digital ID system and names the Australian Competition and Consumer Commission (ACCC) as the Digital ID Regulator. While the ACCC has been appointed as the initial regulator (given its consumer focus and expertise), the Government expects that a more digital-specific regulator may be established as the Digital ID system expands and grows.

The Digital ID Regulator will be responsible for accreditation (determined against the Digital ID Accreditation Rules), approvals to participate in the AGDIS, compliance and enforcement (through broad powers to issue infringement notices, seek enforceable undertakings, injunctions or civil penalties). We note that the proposed accreditation and enforcement functions overlap with the ACCC’s ongoing role in relation to the Consumer Data Right.

Alongside the Digital ID Regulator, the Digital ID Bill contemplates further functions and responsibilities split across:

• Services Australia for the more operational aspects of the AGDIS (such as risk, fraud and cybersecurity incident management). However, the draft Digital ID Bill notes that the sharing of functions between the Digital ID Regulator and Services Australia remains under consideration;
• the Information Commissioner in relation to the privacy-related aspects of the scheme (see ‘Commentary on the proposed framework’ above); and
• a Digital ID Data Standards Chair to develop nationally consistent standards to regulate technical, data and design aspects required for participation in the AGDIS (including by emerging technologies, such as verifiable credentials and digital wallets).

Phased implementation

The Government has outlined its plan to roll out the Digital ID in four phases, namely:

• Phase One: establish the Digital ID legislation and accompanying Rules, set up the Digital ID Regulator, expand use of the Digital ID across government services, and continue accreditation of public and private providers;
• Phase Two: allow State and Territory digital IDs to be used to access Commonwealth government services;
• Phase Three: expand use of the Digital ID to the private sector; and
• Phase Four: allow certain accredited private sector digital IDs to verify individuals when accessing some government services.

This approach seeks to first implement the Digital ID nationally, and then economy-wide (being the expansion into the private sector).

The phased implementation is similar to the approach taken in the UK, which is further advanced than Australia in its rollout of an equivalent digital ID scheme (see ‘UK’ under ‘International Approaches’ below). While not characterised in distinct phases, the UK model also seeks to first create a trusted legislative framework, and then second, expand the digital ID across both the public and private sector.

International approaches

While Australia is in the process of rolling out its own Digital ID framework, it is helpful to observe international developments in this space. Several jurisdictions around the world have implemented, or are implementing a similar framework, to varying degrees of success.

UK

Singapore

Japan