myID privacy notice

How we manage the personal information we collect through myID.

Key definitions

Personal information – is information that identifies an individual or information about an identifiable individual who is reasonably identifiable.

This includes your:

name
date of birth
address
email address
details from an Australian Government issued identity document such as, but not limited to
- type of document
- document issuer
- document numbers
- effective dates
- photographic images
- signatures
- biometrics for the purpose of automated verification or biometric identification.
personal information may also include
- information about services you have accessed or attempted to access
- information on the method of access
- date and time your identity was verified
- your internet protocol number (IP address).

Sensitive information – is a subset of personal information and attracts a higher level of protection. It includes (not exhaustive) racial or ethnic origin, political opinions, religious or philosophical beliefs, sexual orientation, criminal record, health or biometric or genetic information.

Biometrics – is the measurement and statistical analysis of people’s unique physical and behavioural characteristics.

Biometric matching – refers to the use of a Face Verification Service to electronically compare your personal information (an image of your face) against a specific biometric government record to verify your identity.

The Face Verification Service can measure the biometric information of your facial image. That is, the measurements of calculations related to your physical appearance.

If you use your Australian passport or travel document to build your Digital ID in the myID app, the facial image and personal information you provide will be electronically compared with your Australian biometric passport photo and records held by the Department of Foreign Affairs and Trade.

We will only collect biometric information with your express consent.

Collection of personal information

To create your Digital ID, we collect and verify your personal information when you choose to:

register for myID
increase the identity strength associated with your myID account
update your personal information.

We will collect information:

directly from you, when you register or complete online forms and upload documents
indirectly from your device and browser, about your use of the myID app
from third parties, to validate your identity documents.

Use and disclosure of personal information

Your personal information is used to:

verify your identity and validate your details with the government authorities that have issued your identity documents
create and manage your myID account
investigate and verify the operation of the myID system
analyse, prevent, detect, manage and investigate fraudulent activity that may lead to criminal prosecution.

By agreeing to this privacy notice, you are providing your express consent to myID sharing the following personal information we have collected with the service you are attempting to access:

full name
previous name (if required)
date of birth
contact details, including email and phone number (optional).

If you don’t consent to provide or share your personal information, you cannot create a myID account.

If you don’t or cannot verify and authenticate your identity by creating a myID account, alternative options may be available from the agency or service you are attempting to access.

With your express consent provided, we will share with third parties details contained in government issued identity documents, for example, from your drivers licence or travel documents (Australian passport or travel visa). This is for the purpose of document verification and to authenticate your identity. It may include the type of document, document issuer, document numbers and effective dates.

We will only disclose your personal information if you have provided your consent, or we are authorised or required to do so by law.

We may disclose your personal information to other Digital ID System participants, such as:

the Australian Competition and Consumer Commission (ACCC), in its role as the Digital ID Regulator for the Australian Government Digital ID System (AGDIS)
the Office of the Australian Information Commissioner (OAIC), in its role as the Privacy Regulator for the AGDIS
Services Australia, in its capacity as the System Administrator of the AGDIS
Treasury, in its capacity as the Data Standards Body for the AGDIS.

Your personal information will be stored securely in Australia.

We won’t use or disclose your personal information:

to overseas recipients
for the purpose of direct marketing.

You can withdraw your express consent by deleting your myID at any time; however, some personal information may be retained as required by law, the Digital ID Act 2024, Digital ID Accreditation Rules 2024 and Archives Act 1983. By withdrawing your express consent, you will no longer be able to use myID to access participating online services.

Information about your computer, browser and information you provide will be recorded for authentication purposes as part of the myID authentication process, such as:

your internet protocol number (IP address)
date and time of the use of the authentication service
authentication information you provided
successful and unsuccessful attempts at authenticating.

How we hold personal information

When we have completed validating your identity documents, we will store the following information:

document type used
information on the document that was verified
record of your express consent
the document verification outcome.

Biometric images and photographs used by third-party providers as part of the verification process are destroyed within 14 days.

When personal and sensitive information is collected as part of the operations of the myID system, it will be managed and destroyed in accordance with the law.

We will retain records of information associated with your myID while your registration remains active.

If you choose to uninstall your myID, we will retain and dispose of your personal information in accordance with the Digital ID Act 2024 and Archives Act 1983.

More information

The myID Privacy Policy contains more information about how we handle your personal information, including information about how:

you can access and seek correction of your personal information held by us
to make a complaint if you think we have breached the Australian Privacy Principles or APP agency code
we will deal with complaints.

For more information about myID and your privacy, or if you believe your privacy has been breached, you can:

phone 1300 661 542 and ask for the privacy hotline
phone the ATO complaints hotline on 1800 199 010
write to
AUSTRALIAN TAXATION OFFICE
GPO BOX 9990
[insert the name and postcode of your capital city]

For example: