The OpenID Foundation, through its Australian Digital Trust Community Group (ADT CG), has responded to the Australian Government's consultation on the Exposure Draft Privacy Amendment (Personal Data Protection) Bill 2026. The consultation seeks to modernize and strengthen Australia's privacy laws. 

The response, which can be found here, addresses how the Bill would work in practice for identity providers, wallet providers, credential issuers, verifiers, and brokers operating under Australian trust schemes. 

It does not address direct marketing, research, or large digital platform provisions.

Where clarity is needed

The ADT CG asks the Government to clarify how the Bill applies to common features of digital identity schemes. These include:

• identifiers that differ for each business, so businesses cannot match records
• biometric checks, including those that stay on the user's device
• selective disclosure, where people share only some of the information in a credential
• which party is responsible for data in a transaction involving several organizations
• scheme fees paid through a third party
• the exchange of fraud signals using the OpenID Shared Signals Framework and CAEP
• how the Bill fits with the Digital ID Act 2024
• consent screens used in OAuth 2.0 and OpenID Connect sign-in

For each area, the response sets out the issue and a specific request, such as a confirmation, a worked example, or guidance from the regulator.

David Hyland, co-founder of ID Partners and co-chair of the ADT CG, said: “We encourage the Australian Government to keep its focus on interoperability and to use existing capability when putting this legislation into practice. OpenID Foundation standards are likely to play a growing role in securing infrastructure in Australia and other nations. As part of a global open standards body, we welcome the opportunity to support the Australian community.”

Testing and certification

The ADT CG encourages the Australian community to use the OpenID Foundation's free, open-source tests. Implementers can use them to show their deployments meet the security, privacy, interoperability, and scale properties of the specifications.

If the Government sets up an accreditation or conformance scheme that includes OpenID Foundation specifications, the ADT CG suggests it consider two services. These are the Foundation's low-cost self-certification program and its future accreditation program. Both are available to ecosystems.

The ADT CG's full response is available here.

About the OpenID Foundation

The OpenID Foundation (OIDF) is a global open standards body committed to building trusted identity ecosystems. Our mission is to lead the global community in identity standards that are secure, interoperable, and privacy respecting. Founded in 2007, we are a community of technical experts. The Foundation's OpenID Connect standard is now used by billions of people across millions of applications. More recently, the FAPI security profile - built on OAuth 2.0 - has become the standard of choice for interoperable Open Banking and Open Data implementations, while OpenID for Verifiable Credentials specifications are underpinning a new generation of digital wallets. Today, the OpenID Foundation's standards are the connective tissue that enable people to assert their identity and access their data at scale, the scale of the internet, enabling "networks of networks" to interoperate globally. Individuals, companies, governments and non-profits are encouraged to join or participate. Find out more at openid.net.