Responding partly to heightened cybersecurity concerns following major incidents like the Optus data breach, the Law Council of Australia is urging the government to replace mandatory business data retention requirements for identity verification with its national digital identity scheme. The proposal argues this shift would significantly ease compliance burdens on companies and bolster data security by reducing the vast amounts of sensitive customer information businesses are currently forced to store.
This proposal leverages Australia’s expanding national digital identity infrastructure, recently enhanced with improved biometric authentication frameworks and undergoing a rebranding (including myGovID becoming myID). The Law Council contends that a mature, government-run system could reliably perform identity verification, removing the need for countless businesses to hold onto potentially risky data stockpiles merely for identification purposes.
Current anti-money laundering and counter-terrorism financing (AML/CTF) laws compel Australian businesses to collect and retain customer identification data for at least seven years. This not only creates significant operational costs but also makes companies attractive targets for cyberattacks. The Law Council’s plan would shift the primary responsibility for identity verification away from individual businesses and onto the government’s centralized, authenticated digital identity platform, exemplified by systems like the Australian Taxation Office’s platform using biometric checks.
While Australia’s move aligns with global trends towards national digital IDs, seen in countries like the Philippines and Canada’s development of comprehensive digital identity frameworks, the Law Council’s recommendations also stress specific privacy-preserving techniques. They advocate exploring options like self-sovereign identity (SSI) structures and ensuring robust user consent mechanisms are built into the national system.
Significant hurdles remain. Transitioning away from established data retention practices requires careful navigation of public concerns about data privacy within a government-managed system, addressing implementation costs, and likely enacting complex legislative reforms. Building and maintaining public trust through transparency and demonstrably robust security will be critical, alongside ensuring technical interoperability. If successful, this shift could significantly reduce the systemic risk associated with widespread data retention by businesses across the Australian economy.
Source: InnovationAus
—
April 02, 2025 – by Cass Kennedy
