Digital ID Rules 2024 (Cth)

Digital ID Rules 2024

I, Katy Gallagher, Minister for Finance, make the following rules.

Dated 7 November 2024

Katy Gallagher Minister for Finance

Contents Chapter 1—Preliminary 1.1 Name 1.2 Commencement 1.3 Authority 1.4 Definitions Chapter 2—Fit and proper person considerations 2.1 Application of this Chapter 2.2 Mandatory relevant matters Chapter 3—Participation in the Australian Government Digital ID System Part 1—Applications for approval to participate 3.1 Application of this Part 3.2 Applications for approval to participate—all entities 3.3 Applications for approval to participate—relying parties Part 2—Approval to participate 3.4 Conditions on approval to participate Chapter 4—Reportable incidents 4.1 Application of this Chapter 4.2 Cyber security incidents and digital ID fraud incidents 4.3 Other incidents 4.4 Other digital ID systems 4.5 System Administrator may give information Chapter 5—Trustmarks 5.1 Application of this Chapter 5.2 Digital ID trustmark 5.3 Use or display of digital ID trustmark—accredited entities 5.4 Use or display of digital ID trustmark—authorised entities Chapter 6—Record-keeping 6.1 Application of this Chapter 6.2 Record keeping requirements Schedule 1—Digital ID trustmark

Chapter 1—Preliminary

1.1 Name These rules are the Digital ID Rules 2024.

1.2 Commencement These rules commence at the same time as the Digital ID Act 2024 commences.

1.3 Authority These rules are made under section 168 of the Digital ID Act 2024 for the purposes of the provisions in the Act in which the term 'Digital ID Rules' occurs.

1.4 Definitions Note 1: A number of expressions used in these rules are defined in the Act, including the following: (a) accredited entity; (b) accredited service; (c) cyber security incident; (d) digital ID; (e) participating relying party. Note 2: A number of expressions used in these rules are defined in the Accreditation Rules, including the following: 1. DI data environment; 2. identity proofing level; 3. public-facing accredited services; 4. public-facing information related to accredited services. (1) Unless otherwise specified, expressions defined in the Accreditation Rules have the same meaning in these rules. (2) In these rules: Accreditation Data Standards means the Digital ID (Accreditation) Data Standards 2024. Accreditation Rules means the Digital ID (Accreditation) Rules 2024. Act means the Digital ID Act 2024. AGDIS Data Standards means the Digital ID (AGDIS) Data Standards 2024. associated person, of an entity, means any of the following: (a) a person who makes, or participates in making, decisions that affect: (i) the entity's management of its DI data environment; or (ii) for a participating relying party—the performance of the entity's functions when operating in the Australian Government Digital ID System; or (b) a person who has the capacity to significantly affect: (i) the entity's management of its DI data environment; or (ii) for a participating relying party—the performance of the entity's functions when operating in the Australian Government Digital ID System; or (c) a person who would be a person mentioned in paragraphs (a) or (b) if the entity was an accredited entity or a participating relying party; or (d) if the entity is a body corporate—a person who: (i) is an associate (within the meaning of the Corporations Act) of the entity; or (ii) is an associated entity (within the meaning of the Corporations Act) of the entity. authentication level has the same meaning as in the Accreditation Data Standards. Corporations Act means the Corporations Act 2001. IXP means an accredited identity exchange provider. material change has its ordinary meaning. Note: The definition of 'material change' in these rules is different to the definition of the same expression in the Accreditation Rules. material effect, in relation to the operation of the Australian Government Digital ID System, includes: (a) any degradation or loss of functionality within the Australian Government Digital ID System; and (b) any detrimental effect on the ability of an entity that participates in the Australian Government Digital ID System to access the System. pairwise identifier, in relation to an individual, means an identifier that: (a) identifies the individual to an accredited entity or a participating relying party; and (b) cannot be correlated with: (i) the individual's identifier used by a different accredited entity or participating relying party; or (ii) another individual's identifier. participating entity means an entity that holds an approval to participate in the Australian Government Digital ID System. Privacy Act means the Privacy Act 1988. reportable incident requirement means a requirement in these rules in respect of an incident specified in Chapter 4.