The federal government is trialling technology to simplify how people identify themselves when using its services online after pouring $92 million into the scheme in May's budget.

A report from the Australian Strategic Policy Institute has found weak legislative protections, a lack of attempts at communicating the changes to the public, and the potential for the ID to "turbocharge" how private companies gather details about customers could mire the reform in controversy.

Weak controls over businesses using the scheme risk laying the groundwork for an Australian, for-profit version of China's "social credit scheme" using networks of CCTV and databases to monitor citizens, the think tank said in the report released on Thursday.

The Digital Transformation Agency overseeing the technology rejected the findings, saying the scheme had no "honeypot" of personal data for private companies to raid when building profiles of potential customers, and that no digital profiles would be created as citizens verified their identity online.

Digital Transformation Agency assistant secretary Jonathon Thorpe denied data will be stored or transferred in ways that could allow business to create and sell digital profiles of citizens. Details from uploaded documents and photos are not retained by the Govpass system, he said.

But the Australian Strategic Policy Institute paper's warning about data misuse envisages that businesses using Govpass could build profiles of their customers' behaviour every time they verify their ID, and sell this information to third parties.

Under the scheme, web-users will opt in and create a digital identity to access government services by giving 100 points of ID, and uploading a "selfie" for checking against passport or driver licence photos.

Mr Thorpe said the scheme will protect personal details with a design that forces agencies to verify identity through a hub that stops them accessing the data used to cross-check information. Users will give permission for their "selfies" and information to be sent for cross-checking.

The technology is designed to stop people reconfirming their identity every time they access a government service online but Mr Thorpe said no digital profile would be created or stored when web-users register.

Australia Post has built a similar technology, called Digital iD, which the government says could become one of multiple portals to verify identity under the broader Govpass project.

The digital ID scheme is not governed by dedicated laws designed to prevent ID-holders from having their data misused, report author and head of ASPI's International Cyber Policy Centre Fergus Hanson said.

He drew a link to the Hawke government's doomed Australia Card, the first attempt in recent decades to introduce a single ID for citizens and a project that brought on a double dissolution election and was later abandoned.

"National multi-use identity schemes have a poor track record in Australia," he said.

"To gain public approval for this major reform, the government needs a fresh approach that places the citizen at the centre of the system."

Mr Hanson said privacy laws were inadequate and would not protect people from having their data misused after creating a digital ID.

"Instead of thinking about how digital identity can solve a departmental problem and focusing narrowly on users' experience in that context, a citizen-centric perspective is needed," he said.

"In a citizen-centred society, the role of government should be as the custodian of citizen data, guaranteeing its security and integrity and the citizen's inviolable rights to and control of their data."

The report called for a "root-and-branch" review to modernise data protection.

Mr Thorpe said the government would communicate more with the public about the technology after the trial stage, and that trials would shape how the scheme was rolled-out, including the creation of more protections.