Anonymity, the bush and the questions worth asking

Last week I said the under-16 ban made the demand and December supplies the keys. A reader in the UK wrote back with the question I'd been circling for three weeks: fine, but how do rural and remote people fare when all of this assumes a reliable connection? This week is for him, and for everyone who'll be sitting in a hall with me later this month holding a phone up to a login screen.

Two things today. What the law actually promises you about privacy, in its own words. And what the bush does to those promises.

What the law promises, and where it stops. I went back to the government's own Digital ID pages and the Act's summary and pulled out the sentences that matter. Here they are, with nothing added.

It's voluntary, and the sentence is stronger than I expected: "an entity cannot require an individual to create a Digital ID in order to receive or access a service." If you can't use one or don't want to, "you can keep accessing government services. This can be done over the phone or in person at government shopfronts across the country." Hold onto that line. We'll need it.

The provider can't see where you use it. The system has an exchange in the middle, run by Services Australia, and the government's page says it plainly: "the provider that verifies your identity will not know which services you are accessing." The service knows who vouched for you (myID, say). myID doesn't know you were at the bank. The page calls it "a privacy and security protection built into the system."

Your face is used once and deleted. To get to Strong you take a selfie that's matched to your passport photo, and "Soon after it is verified, the photo is deleted." An accredited provider must get your consent before collecting it, use it only for that match, and "delete your biometric information after your identity is verified."

They can't sell you. Your information is "not collected, profiled, used or sold for other purposes, such as direct marketing." The Act's summary lists the safeguards that go beyond the Privacy Act: "prohibitions on the use of single identifiers, a prohibition on disclosing information for marketing, and restrictions on the collection, use and disclosure of biometrics." Break them and there are civil penalties, and the privacy regulator takes complaints about exactly these things: sharing without express consent, keeping biometrics, profiling.

Now the part people skip. The word on those pages is never "anonymous". It's "minimum" and "consent". Your information is "only shared with providers and services with your consent, unless required by law or to investigate instances of fraud." So the provider can't follow you around and can't sell you, but it isn't a cloak; a lawful request still reaches it. And a service "may require more information with your agreement", if it justifies the ask in writing and gets your express consent. The protection is real. It's a fence, not a wall, and the gate in it is the consent screen.

The bush, and what a Strong myID needs on the day. The promises above all assume a thing that isn't written on any of those pages: a working phone with a working connection, in your hand, at the moment somebody asks.

Start with what myID itself needs. Its own setup page: "a smart device", the app from the Apple or Google store, an email address, and you must be fifteen or over. Standard strength takes two documents. Strong takes documents plus "a one-off face verification check which involves taking a selfie that's compared to the photo on your passport", done "in real time". And here's the line I didn't know until this week: setting up Strong with a driver's licence is "Western Australia only". Everywhere else, Strong means a passport, current or no more than three years expired.

Think about who that leaves out in a town like ours. Plenty of people here have never needed a passport, or let one lapse a decade ago. For them, Strong isn't ten minutes and a cuppa. It's a passport application first, at a passport fee, for a thing the government says is voluntary. Standard still gets you most government services. But it's a cost the city reader never sees.

Then the connection. The 2024 Regional Telecommunications Review, the government's own three-yearly look at the bush, opens with "Access to dependable telecommunications is not a luxury but a necessity." It found that gaps "persist, particularly in remote areas", that "achieving complete terrestrial mobile coverage across Australia's vast landscape is not possible", that "harsh weather conditions and the high cost of infrastructure can make it difficult to provide adequate coverage", and that "the 3G transition process has been fraught". None of that is news to anyone who's stood in a paddock holding a phone above their head. It is news that it's in a Commonwealth report with recommendations attached.

Now put the two together in a CWA hall. Twenty people, twenty phones, half of them on one bar, two with a cracked screen, one with a flat battery, the tower doing what it does when it rains. A face check "in real time" needs data at that moment. A code to your phone needs signal at that moment. The person who set up Basic at the Centrelink counter two years ago finds it won't open the thing she needs, and the upgrade needs the passport she doesn't have. That's not a hypothetical. That's the room I'll be standing in.

Which brings me back to the sentence I told you to hold onto: "over the phone or in person at government shopfronts across the country." That line is the whole deal for the bush. It's the government's promise, in writing, that the digital way is never the only way. What the page doesn't say is where the nearest shopfront is, how long the phone queue runs, or whether the person at the counter has been told the voluntary bit is real. I want to see what the other way looks like in Tara, and I'm going to go and look.

The bank question. A few weeks ago I walked into a branch of one of the four banks in a regional town and asked, in plain conversation, about ConnectID and myID. The person across the counter hadn't heard of ConnectID, five weeks before 1 December. I'm not telling that story to embarrass anyone; the head office may well have a plan. I'm telling it because the counter is where the bush meets this system. If the counter doesn't know, the "other way" doesn't exist yet, however well the website reads.

What I like, and what I'm watching. I like that the voluntary line, the no-marketing line and the delete-the-photo line are all written down, with a regulator and penalties behind them. I like that the provider can't see where you use it; that one's a genuine piece of engineering, not a promise. And I like that the government wrote the phone and the shopfront into the same page as the sales pitch.

What I'm watching is "unless required by law", because that's the gate nobody mentions at the launch. I'm watching the passport rule, because it quietly turns a voluntary thing into a paid one for a lot of people out here. I'm watching the review's own finding that many people in the regions "are unaware of recent advancements or alternative solutions", because that sentence is about us, and it's the reason I'll be in that hall. And I'm watching the register. The government keeps a public list of who is accredited; before I'd hand anyone the key, I'd want to find their name on it.

The questions worth asking. Not of me. Of the people who want you to use this.

• Of the government: where, exactly, is the other way for each service, and what does "deactivate it at any time" look like once I've got one?
• Of my bank: has my branch been told? What happens at your counter when my app won't load?
• Of any business that asks from December: do you need to know who I am, or only that I'm over eighteen? Which provider are you using, and are they on the register? What do you keep once you've got your yes?
• Of myself: which strength do I actually need for the things I do, and does my phone, my signal and my passport situation get me there?

Next Monday: part five, the last one. December is three weeks away. Here's what I'd do now, on one page.

What I'd do this week, and why. Not what you should do. What I'd do.

• I'd find out whether I hold a passport and when it expires, because outside WA that's the ticket to Strong, and I'd rather know now than at a counter.
• I'd write down the other way: the phone number and the nearest shopfront for the one or two government services I actually use. On paper, in the glovebox. The day the tower's down is the day I'll need it.
• I'd ask one business I deal with, the bank or the phone company, whether they plan to use any of this from December and what they'd keep. If they can't answer, that's an answer.

---