Senator CHISHOLM (Queensland—Assistant Minister for Education, Assistant Minister for Regional Development and Deputy Manager of Government Business in the Senate) (17:36): I table a supplementary explanatory memorandum relating to the government's amendments to be moved to the Digital ID Bill 2023. The PRESIDENT: The question is that the amendments on sheet UP109 be agreed to. Government's circulated amendments— (1) Clause 9, page 8 (after line 12), after the definition of affected entity, insert: AFP Minister means the Minister administering the Australian Federal Police Act 1979. (2) Clause 9, page 12 (after line 6), after the definition of identity service provider, insert: law enforcement agency has the same meaning as in the Australian Crime Commission Act 2002. (3) Clause 29, page 36 (after line 7), at the end of the clause, add: (3) If a digital ID of an individual is deactivated under subsection (2), the digital ID of the individual: (a) must not be used by the accredited identity service provider for verifying the identity of the individual or authenticating a digital ID of the individual; and (b) if it can be reactivated, must not be reactivated by the accredited identity service provider without the express consent of the individual. (4) Page 39 (after line 19), after clause 35, insert: 35A Small business operator that is an accredited entity (1) If a small business operator is an accredited entity, the Privacy Act 1988 applies, with the prescribed modifications (if any), in relation to the small business operator as if it were an organisation. (2) In this section: organisation has the same meaning as in the Privacy Act 1988. prescribed modifications means modifications prescribed by the Digital ID Rules for the purposes of this definition. small business operator has the same meaning as in the Privacy Act 1988. (5) Heading to clause 38, page 41 (line 7), after "Division 2", insert "and section 136". (6) Clause 38, page 41 (line 9), after "this Part", insert "or section 136". (7) Clause 38, page 41 (line 24), after "this Part", insert "or section 136". (8) Clause 49, page 49 (line 27), omit "that is in control of the individual", substitute "that is in the individual's control". (9) Clause 49, page 50 (lines 2 and 3), omit "(within the meaning of the Australian Crime Commission Act 2002)". (10) Clause 51, page 54 (line 16), after "preventing", insert "or". (11) Clause 59, page 63 (after line 10), after subclause (3), insert: (3A) Subsection (2) does not apply to an entity if the entity is conducting testing in accordance with an authorisation granted to the entity under section 81. (12) Clause 59, page 63 (line 14), at the end of subclause (4), add "or (3A)". (13) Clause 61, page 65 (line 16), omit "2001).", substitute "2001); or". (14) Clause 61, page 65 (after line 16), after paragraph (c), insert: (d) the application is made more than 2 years after the day this Act commenced and the entity is: (i) an accredited entity; or (ii) an entity that has applied for accreditation under section 14; or (iii) a relying party that is an Australian entity; or (iv) a relying party that is a registered foreign company (within the meaning of the Corporations Act 2001). (15) Heading to clause 81, page 88 (line 20), omit "relation to". (16) Clause 81, page 88 (line 23), omit "relation to". (17) Clause 82, page 89 (line 8), omit "relation to". (18) Clause 84, page 90 (lines 6 to 20), omit subclause (1), substitute: (1) An accredited entity (the first entity) is not liable to an action or other proceeding, whether civil or criminal, for or in relation to the provision or non-provision of an accredited service of the entity to another accredited entity (the other entity) participating in the Australian Government Digital ID System, or to a participating relying party, if: (a) the action or other proceeding is brought by the other entity or the participating relying party; and (b) subsection (1A) or (1B) applies. (1A) This subsection applies if the first entity provides or does not provide the accredited service, in good faith, in compliance with this Act (other than the service levels determined under section 80). (1B) This subsection applies if: (a) the first entity does not comply with this Act (other than the service levels determined under section 80) in relation to the accredited service; and (b) the non-compliance is not the ground or cause for the action or other proceeding. (19) Clause 123, page 120 (line 17), after "safeguards)", insert "and section 136 of this Act (about destruction etc. of certain information)". (20) Clause 124, page 121 (line 14), after "safeguards)", insert "and section 136 of this Act (about destruction etc. of certain information)". (21) Clause 125, page 122 (line 6), after "safeguards)", insert "and section 136 of this Act (about destruction etc. of certain information)". (22) Clause 126, page 123 (line 6), after "safeguards)", insert "and section 136 of this Act (about destruction etc. of certain information)". (23) Clause 136, page 134 (line 11), after "Commonwealth", insert "(other than a prescribed law)". (24) Clause 136, page 134 (after line 21), at the end of the clause, add: (3) In this section: prescribed law means a law of the Commonwealth prescribed by the Digital ID Rules for the purposes of this definition. (25) Clause 145, page 143 (lines 17 and 18), omit subclause (4), substitute: (4) The Minister must cause a written report about each review: (a) to be prepared; and (b) to be tabled in each House of the Parliament within 15 sitting days of that House after the Minister receives the report. (26) Clause 149, page 146 (lines 16 and 17), omit "and the Information Commissioner", substitute ", the Information Commissioner, law enforcement agencies, enforcement bodies and the AFP Minister". (27) Page 152 (after line 5), after clause 155, insert: 155A Annual reports by law enforcement agencies etc. on disclosure or use of personal information (1) This section applies to: (a) a law enforcement agency, if the agency requests or requires, during a financial year, an accredited entity to disclose biometric information of an individual obtained as part of the provision of the entity's accredited services; or (b) an enforcement body, if the body requests or requires, during a financial year, an accredited entity to use or disclose personal information of an individual obtained as part of the provision of the entity's accredited services for the purposes of enforcement related activities conducted by, or on behalf of, the enforcement body. Note: An accredited entity is authorised to disclose biometric information of an individual to a law enforcement agency only in certain circumstances, such as under a warrant (see subsection 49(3)). An accredited entity can disclose personal information of an individual to an enforcement body in certain circumstances, but the personal information must not be biometric information (see section 54). (2) At the end of the financial year, the law enforcement agency or the enforcement body (as the case requires) must prepare and give a report to the AFP Minister that includes the following: (a) the total number of requests or requirements made by the agency or body during the financial year; (b) details of the type of information requested or required (but not including personal information of a particular individual or details that would identify a particular individual) during the financial year; (c) the total number of requests or requirements that were complied with (in whole or in part) by an accredited entity during the financial year. (3) The report must be given to the AFP Minister by: (a) the 30th day of September; or (b) the end of any further period granted under subsection 34C(5) of the Acts Interpretation Act 1901. 155B Annual report by AFP Minister (1) The AFP Minister must prepare a report in relation to the provision of reports (section 155A reports) under section 155A for a financial year. (2) If no section 155A reports were provided for the financial year, the report by the AFP Minister must include a statement to that effect. (3) If subsection (2) does not apply, the report by the AFP Minister must include the following in relation to each law enforcement agency and enforcement body that provided a section 155A report for the financial year: (a) the total number of requests or requirements made by the law enforcement agency or enforcement body during the financial year; (b) details of the type of information requested or required (but not including personal information of a particular individual or details that would identify a particular individual) by the law enforcement agency or enforcement body during the financial year; (c) the total number of requests or requirements made by the law enforcement agency or enforcement body that were complied with (in whole or in part) by an accredited entity during the financial year. (4) The AFP Minister must prepare the report referred to in subsection (1) as soon as practicable after the end of each financial year. (5) The AFP Minister must cause a copy of the report prepared under subsection (1) to be tabled in each House of the Parliament within 15 sitting days of the day on which the report is completed.