Last updated May 2024
This notice explains how we manage the personal information we collect through myGovID.
myGovID is the Australian Government’s Digital Identity Service Provider. The ATO delivers and administers the myGovID system as a secure digital environment for individuals to establish and verify their identity for authenticated access to participating online services.
We will verify and validate personal information with the identity-document issuer with your consent when you:
- create your digital identity
- provide personal information from your identity documents.
We will only disclose your personal information with these organisations and agencies with your consent.
If you choose to increase your digital identity strength to ‘Strong’, myGovID will use a biometric image of your face to verify your identity.
We do not disclose your personal information to overseas recipients and we will not use your personal information for any direct marketing purposes.
Key definitions
Personal information – is information that identifies an individual or information about an identifiable individual who is reasonably identifiable.
Sensitive information – is a subset of personal information and attracts a higher level of protection. It includes (not exhaustive) racial or ethnic origin, political opinions, religious or philosophical beliefs, sexual orientation, criminal record, health or biometric or genetic information.
This includes your:
- name
- date of birth
- address
- email address
- details from Australian Government issued identity document such as, but not limited to
- the type of document
- document issuer
- document numbers
- effective dates
- photographic images
- signatures
- biometrics for the purpose of automated verification or biometric identification.
- personal information may also include
- information about services you have accessed or attempted to access
- information on the method of access
- the date and time your identity was verified
- your internet provider number (IP address).
Biometrics – is the measurement and statistical analysis of people’s unique physical and behavioural characteristics.
Biometric matching – refers to the use of a Face Verification Service to electronically compare your personal information (an image of your face) against a specific biometric government record to verify your identity.
The Face Verification Service can measure the biometric information of your facial image. That is, the measurements of calculations related to your physical appearance.
If you use your Australian Passport or travel document to build your digital identity in the myGovID app, the facial image and personal information you provide will be electronically compared with your Australian biometric passport photo and records held by the Department of Foreign Affairs and Trade.
We will only collect biometric information with your express consent.
Collection of personal information
To create your digital identity, we collect and verify your personal information when you choose to:
- register for myGovID
- increase the identity strength associated with your myGovID account
- update your personal information.
We will collect information:
- directly from you, when you register or complete online forms and upload documents
- indirectly from your device and browser, about your use of the myGovID app
- from third parties, to validate your identity documents.
Use and disclosure of personal information
Your personal information is used to:
- verify your identity and validate your details with the government authorities that have issued your identity documents
- create and manage your myGovID account
- investigate and verify the operation of the myGovID system
- analyse, detect, manage and investigate fraudulent activity that may lead to criminal prosecution.
By agreeing to this privacy notice, you are consenting to myGovID sharing the following personal information we have collected with the service you are attempting to access:
- your full name
- previous name (if required)
- date of birth
- contact details, including email and phone number (optional).
If you do not consent to provide or share your personal information, you cannot create a myGovID account.
If you do not or cannot verify and authenticate your identity by creating a myGovID account, alternative options will be available from the agency or service you are attempting to access.
With your consent we will share with third parties’ details contained in government issued identity documents for example, from your driver's licence or travel documents (Australian Passport or travel visa). This is for the purpose of document verification and to authenticate your identity. It may include the type of document, document issuer, document numbers and effective dates.
We will only disclose your personal information if you have provided your consent, or we are authorised or required to do so by law.
We may disclose your personal information to other Digital ID System participants, such as:
- the Department of Finance in their capacity as the Interim Oversight Authority (IOA) for the Trusted Digital Identity Framework (TDIF).
- Services Australia in their capacity as the Operational Oversight Authority of the Australian Government's Digital Identity System (AGDIS).
We will not use or disclose personal information for the purpose of direct marketing. Your personal information will be stored securely in Australia. We will not disclose your personal information with overseas recipients.
You can withdraw your express consent by deleting your myGovID at any time; however, some personal information may be retained as required by the Archives Act 1983. By withdrawing your express consent, you will no longer be able to use myGovID to access participating online services.
Information about your computer, your browser and information you provide will be recorded for authentication purposes as part of the myGovID authentication process such as:
- your internet provider number (IP address)
- the date and time of the use of the authentication service
- the authentication information you provided
- successful and unsuccessful attempts at authenticating.
How we hold personal information
When we have completed validating your identity documents, we will store the following information:
- the document type used
- the information on the document that was verified
- a record of your consent
- the result of the document verification check.
Biometric information (photographs and images) disclosed to third party providers as part of the verification process is destroyed within 14 days.
When personal and sensitive information is collected as part of the operations of the myGovID system, it will be managed and destroyed in accordance with the law.
We will retain records of information associated with your myGovID while your registration remains active.
If you choose to uninstall myGovID, we will retain and dispose of your personal information in accordance with the Archives Act 1983.
More information
The myGovID Privacy Policy contains more information about how we handle your personal information, including information about:
- how you can access and seek correction of your personal information held by us
- how to make a complaint if you think we have breached the Australian Privacy Principles or APP agency code
- how we will deal with complaints.
For more information about myGovID and your privacy, or if you believe your privacy has been breached, you can:
- phone 1300 661 542 and ask for the Privacy Hotline
- phone the ATO Complaints and Feedback Line on 1800 199 010
- write to
Australian Taxation Office
GPO Box 9990
[insert the name and postcode of your capital city]
For example:
Australian Taxation Office
GPO Box 9990
SYDNEY NSW 2001