NAB News

The challenge of identifying data being exposed by criminals continues to be a major issue in Australia. Every week, there are reports of organisations becoming the victims of cyber-attacks, resulting in significant volumes of Australian’s personal data being leaked on the dark web and used illegally by criminals.

What can we do to help stop data being stolen? One idea is not needing to give that data to begin with – enter Digital ID.

Following the Digital ID bill passing the Australian Senate in March,  and with the expected introduction of the Digital ID Bill in the House of Representatives this week, there is increased momentum to implement this idea, and as more concerns are raised about ID theft, the technology can’t come quick enough.

Essentially, a Digital ID can reduce the need for Australians to repetitively hand over sensitive identity documents to multiple organisations. For example, it could stop the requirement of having your driver’s license scanned to enter a licensed venue or providing ID documents to sign-up to membership programs. Given the benefits, there is now growing urgency around implementing a well-functioning Digital ID ecosystem in Australia to help minimise the amount of personal data being unnecessarily collected and stored.

How will this work?

The Digital ID technology can help reduce the impact of data breaches by providing a simple method for identification. Currently, individuals regularly must provide various personal documents for different service needs. This includes, needing to have their license scanned to prove they are over 18 years old to enter a venue, or provide documents to a real estate agent to validate your identity.

Successfully rolling out Digital ID – which will act as a simple and economy-wide way you can verify your identity or other attribute, such as proof of age – will require education and awareness about how it works and how it will benefit the community to help ensure people take it up. That’s why NAB has put together a second Digitial ID explainer that shows the milestones so far and what’s next for Digital ID.

Catch up with a Digital ID 101 explainer here. 

The journey to date

If passed, these laws would establish:

• An accreditation scheme for Digital ID services, meaning organisations, including banks can apply to become accredited to participate in the Australian Government Digital ID System (‘AGDIS’). Effectively this means that a bank could verify your identity to another organisation who requires this information – minimising the need to give them a whole bunch of your personal identity documents again which they then store. Accreditation is voluntary.
• Under the Accreditation Rules, organisations applying for accreditation would need to demonstrate and attest to how their Digital ID services meet certain minimum standards including relating to security, fraud control, privacy, incident management and reporting, disaster recovery, user experience and inclusion.
• Businesses which are accredited will be permitted to join the AGDIS within two years of the legislation commencement date, creating greater certainty regarding private sector inclusion.

What will this mean for individuals and businesses?  

A key benefit of Digital ID is to minimise unnecessary data collection and sharing. By using digital ID, it reduces the number of places an individual must give sensitive documents to. It also means minimising the need for business to collect and store those records, reducing the impact on individuals if they are caught up in a data breach.

What about privacy and consumer safeguards?

Under the proposed laws, Digital ID service providers must comply with the Commonwealth privacy laws (or state/territory equivalent), and in addition must also comply with additional privacy safeguards.

In brief, these safeguards include:

• Prohibitions on the collection of certain attributes;
• Requirements for express consent;
• Restricting disclosure of unique/single identifiers, restricting data profiling and the use of personal information for marketing; and
• Prohibitions on one-to-many matching using biometrics and restrictions on the use of biometric data.

For more information on how the Government is addressing privacy concerns, visit Legislation | Digital Identity.

To learn more about key issues in technology listen to the NAB Digital Next Podcast. More episodes are available on the NAB News podcast page.