Australia Online Safety Act 2021 s63F: Limit use and disclosure of age assurance data and destroy it after use

Personal information collected for, or for purposes including, taking reasonable steps to prevent age-restricted users having accounts may be used or disclosed only to determine whether the individual is an age-restricted user, where Australian Privacy Principle 6.2(b), (c), (d) or (e) applies, or with the individual's voluntary, informed, current, specific and unambiguous consent that can be withdrawn easily; and the entity must destroy the information after using or disclosing it for the purposes for which it was collected. Other use or disclosure, and failure to destroy, is an interference with privacy under the Privacy Act 1988 (complaint under s 36 of that Act); the Information Commissioner may publish a statement (s 63K). Applies to any entity holding such information, including age assurance vendors.