Identity Verification Services Act 2023

Each provision of this Act specified in column 1 of the table commences, or is taken to have commenced, in accordance with column 2 of the table. Any other statement in column 2 has effect according to its terms.

This table relates only to the provisions of this Act as originally enacted. It will not be amended to deal with any later amendments of this Act.

Any information in column 3 of the table is not part of this Act. Information may be inserted in this column, or information in it may be edited, in any published version of this Act.

to authorise the Department to develop, operate and maintain the 3 approved identity verification facilities (the DVS hub, the Face Matching Service Hub and the NDLFRS); and

to authorise the Department (but not other persons or bodies) to collect, use and disclose identification information communicated to an approved identity verification facility, or generated using the NDLFRS, for purposes relating to:

verifying the identity of an individual using a DVS or FVS; or

protecting a shielded person or someone else associated with a shielded person using an FVS or FIS; or

the NDLFRS; and

to protect identification information communicated to approved identity verification facilities, and certain other information relating to the use or security of those facilities, from unauthorised recording, disclosure or access by certain persons who do work for the Department; and

to provide for oversight and scrutiny of the operation and management of the approved identity verification facilities.

The objects in paragraphs 3(a), (b) and (d) are authorised and provided for by Parts 2, 3 and 5. In accordance with the object in paragraph 3(c), Part 4 prohibits the use or disclosure of, or access to, identification information, unless it is in accordance with the objects of this Act or in other limited circumstances.

the DVS hub, which relays electronic communications between persons and bodies requesting and providing DVSs (which stands for Document Verification Service, a particular kind of 1:1 matching service); and

the Face Matching Service Hub, which relays electronic communications between persons and bodies requesting and providing identity verification services; and

the NDLFRS, which includes a database of identification information from State and Territory authorities and may be used to provide identity verification services.

1:1 matching services (FVS (which stands for Face Verification Service) and DVS); and

1:many matching services (Face Identification Service or FIS).

providing or developing DVSs or FVSs for the purposes of verifying the identity of individuals;

providing or developing FVSs or FISs for the purposes of protecting identities of persons (or associates) who have legally assumed identities or are under witness protection;

developing, operating or maintaining the NDLFRS.

verify the individual’s identity;

protect the identity of the individual if the individual is a shielded person;

manage identification information that relates to the individual in the NDLFRS.

the DVS hub; or

the Face Matching Service Hub; or

the NDLFRS.

DVS is short for Document Verification Service, a term used in the intergovernmental agreement.

a birth certificate issued by or on behalf of an authority of a State or Territory;

a death certificate issued by or on behalf of an authority of a State or Territory;

a concession card (within the meaning of the Social Security Act 1991);

a notice given under section 37 of the Australian Citizenship Act 2007 stating that a person is an Australian citizen at a particular time;

a certificate issued by an authority of a State or Territory indicating that an individual has changed the individual’s name;

a driver’s licence (however described) issued by or on behalf of an authority of a State or Territory;

a document issued by or on behalf of an authority of a State or Territory to assist an individual to prove the individual’s age or identity;

a document issued to an individual, as a person who is not an Australian citizen, by the Department administered by the Minister administering the Migration Act 1958 to assist the individual to prove the individual’s identity;

a certificate of marriage issued by or on behalf of an authority of a State or Territory whose function it is to register marriages;

a document issued by a court setting out a divorce order made under the Family Law Act 1975;

an Australian travel document (within the meaning of the Australian Passports Act 2005);

a certificate signed by an officer (within the meaning of the Migration Act 1958) stating that, at a specified time, or during a specified period, a specified person was the holder of a visa that was in effect;

an entry in a Roll (within the meaning of the Commonwealth Electoral Act 1918) relating to a particular individual;

an aviation security identification card issued under regulations made for the purposes of the Aviation Transport Security Act 2004;

an MSIC issued under regulations made for the purposes of the Maritime Transport and Offshore Facilities Security Act 2003;

a medicare card (within the meaning of subsection 84(1) of the National Health Act 1953).

is for relaying electronic communications between persons and bodies for the purposes of requesting and providing DVSs; and

is developed, operated and maintained by the Department under Part 2.

is for relaying electronic communications between persons and bodies for the purposes of requesting and providing identity verification services; and

is developed, operated and maintained by the Department under Part 2.

FIS is short for Face Identification Service, a term used in the intergovernmental agreement.

FVS is short for Face Verification Service, a term used in the intergovernmental agreement.

an authority of the Commonwealth; or

an authority of a State or Territory;

contains identification information; and

can be used to identify an individual or to pass an individual off as someone else (whether living, dead, real or fictitious); and

is issued by or on behalf of a government authority.

a 1:1 matching service; or

a 1:many matching service.

The intergovernmental agreement must be published on the Department’s website (see section 39).

a database of identification information that:

is also either contained in government identification documents issued by or on behalf of an authority of a State or Territory or associated with those documents by the authority; and

is supplied by or on behalf of the authority to the Department by electronic communication for inclusion in the database; and

a system for biometric comparison of facial images with facial images that are in the database described in paragraph (a);

NDLFRS is short for National Driver Licence Facial Recognition Solution, a term used in the intergovernmental agreement.

the Commonwealth, a State or a Territory; or

a government authority.

Local government authorities are non‑government entities because they are excluded from the definition of government authority. Authorities of New Zealand are non‑government entities because they are not covered by the definition of government authority.

the person has acquired or used an assumed identity under Part IAC of the Crimes Act 1914 or a corresponding assumed identity law within the meaning of that Part;

an authority for the person to acquire or use an assumed identity has been granted under that Part or such a law;

a witness identity protection certificate has been given for the person under Part IACA of the Crimes Act 1914;

a corresponding witness identity protection certificate has been given for the person under a corresponding witness identity protection law within the meaning of Part IACA of the Crimes Act 1914;

the person is a participant (as defined in the Witness Protection Act 1994);

the person is or was on a witness protection program conducted by a State or Territory in which a complementary witness protection law (as defined in the Witness Protection Act 1994) is in force;

the person is involved in administering such a program under such a law and the person has acquired an identity under that law.

Identification information is:

face‑matching service information; or

DVS information.

Face‑matching service information that relates to an individual (whether living, dead, real or fictitious) is any of the following, subject to subsections (4) and (5):

a name by which the individual is or has been known;

a current or former address of the individual;

the place or date the individual was born;

the age of the individual (whether expressed by reference to a range or not);

the current or former sex, gender identity or intersex status of the individual;

information about whether the individual is alive or dead;

any information that is:

contained in a driver’s licence (however described) issued by or on behalf of an authority of a State or Territory in a name of the individual; or

otherwise associated with such a licence by such an authority;

any information that is:

contained in any document (however described) that is issued by or on behalf of an authority of a State or Territory in a name of the individual, contains a photograph purporting to be of the individual and can be used to assist in proving the individual’s identity; or

otherwise associated with such a document by the authority;

any information that is:

contained in a document issued to the individual, as a person who is not an Australian citizen, by the Department administered by the Minister administering the Migration Act 1958 to assist the individual to prove the individual’s identity; or

otherwise associated with such a document by that Department;

any information that is:

contained in an Australian travel document (within the meaning of the Australian Passports Act 2005) issued in a name of the individual; or

otherwise associated with the Australian travel document by the Minister administering the Australian Passports Act 2005 or the Department administered by that Minister; or

otherwise associated with the Australian travel document by a government authority by which the travel document may be inspected or seized under a law of the Commonwealth or of a State or Territory;

any information that is:

contained in a foreign travel document (within the meaning of the Foreign Passports (Law Enforcement and Security) Act 2005) issued in a name of the individual; or

otherwise associated with the foreign travel document by a government authority by which the travel document may be inspected or seized under a law of the Commonwealth or of a State or Territory;

the individual’s current or former citizenship;

any information that is:

contained in a current or past application for Australian citizenship for the individual; or

contained in a document issued by an authority of the Commonwealth to provide evidence that the individual is or was an Australian citizen; or

otherwise associated with an application or document described in subparagraph (i) or (ii) by the Department administered by the Minister administering the Australian Citizenship Act 2007;

information about a visa, or an entry permit under the Migration Act 1958, that the individual holds or held;

any information that is:

contained in a current or past application for a visa, or entry permit, for the individual under the Migration Act 1958; or

contained in a visa, or entry permit, for the individual granted under that Act; or

otherwise associated with an application, visa or entry permit described in subparagraph (i) or (ii) by the Department administered by the Minister administering that Act;

a facial image of the individual, a biometric template derived from such an image or a result of biometric comparison involving such an image;

information about the outcome of a comparison involved in an FVS requested in relation to the individual.

DVS information that relates to an individual is either of the following, subject to subsections (4) and (5):

information (but not a facial image or biometric information) that either:

is contained in a document (the specimen document) that relates to the individual and purports to be a DVS document of a particular kind; or

is, or is reasonably expected to be, associated, with a DVS document of a particular kind relating to the individual, by a government authority that is responsible for the issue of DVS documents of that kind;

information about the outcome of a comparison involved in a DVS relating to the individual.

The following is neither face‑matching service information, nor DVS information, that relates to an individual:

information or an opinion that relates to the individual’s:

racial or ethnic origin; or

political opinions; or

membership of a political association; or

religious beliefs or affiliations; or

philosophical beliefs; or

membership of a professional or trade association; or

membership of a trade union; or

sexual orientation or practices; or

criminal record;

health information (within the meaning of the Privacy Act 1988) that relates to the individual;

genetic information that relates to the individual.

Subsection (4) does not prevent information described in any of the paragraphs of subsection (2) or (3) from being face‑matching service information or DVS information if the information is not primarily of any of the kinds described in subsection (4), even if information of any of those kinds can reasonably be inferred from the information.

Even if an individual’s racial or ethnic origin can reasonably be inferred from the individual’s name or place of birth, this does not prevent the individual’s name or place of birth from being face‑matching service information or DVS information.

Even if an individual’s racial or ethnic origin or religious affiliations can reasonably be inferred from a facial image of the individual, this does not prevent the image from being face‑matching service information.

Identification information is taken to be personal information for the purposes of the Privacy Act 1988.

participation agreements (which are agreements between the Department and other authorities, persons and bodies about the requesting and provision of identity verification services using the approved identity verification facilities); and

the NDLFRS hosting agreement (which is an agreement between the Department and authorities of a State or Territory that supply identification information stored and used in the NDLFRS).

privacy impact assessments of requesting the services; and

obtaining an individual’s express consent to the collection, use and disclosure of the individual’s identification information for the purposes of requesting the services (unless the collection, use and disclosure is by a government authority authorised by another law to do so); and

limits on the purposes for which the services may be requested and on what may be done with information received in response to requests; and

annual reporting and auditing of compliance with agreements; and

suspension or termination of a party’s ability to request services if the party has not complied with the agreement or access policies for the services.

A participation agreement is a written agreement, between the Department (representing the Commonwealth) and one or more other parties, that:

deals with the requesting and provision of identity verification services of one or more kinds using identification information made available by the parties; and

meets the requirements in sections 9, 10, 11 and 12.

To avoid doubt:

an agreement may be a participation agreement whether it was made before, on or after the commencement of this section; and

different participation agreements may be made between the Department and different other parties; and

paragraph (1)(b) and sections 9, 10, 11 and 12 do not limit the matters a participation agreement may deal with.

Each party to a participation agreement must:

be subject to the Privacy Act 1988; or

be subject to a privacy law that:

is a law of a State or Territory; and

is prescribed by the rules for the purposes of this subparagraph; or

agree in the agreement to comply with the Australian Privacy Principles, with any modifications of subclauses 7.8 and 12.2 of those principles (about laws of the Commonwealth) specified in the agreement, as if the party were an APP entity; or

be a government authority prescribed by the rules for the purposes of this paragraph; or

if the agreement deals only with the requesting of DVSs by, and provision of DVSs to, an authority of New Zealand or a person or body operating in New Zealand—be an authority, person or body subject to the Privacy Act 2020 of New Zealand.

A DVS is the only identity verification service available to a party to an agreement described in paragraph (e).

A participation agreement must provide for:

privacy impact assessments of requesting identity verification services; and

the obtaining of an individual’s express consent to the collection, use and disclosure, for the purposes of requesting identity verification services, of identification information that relates to the individual included in such a request, unless:

the request is made by or on behalf of a government authority; and

collection, use and disclosure of that information for the purposes of protecting a shielded person, or someone else associated with a shielded person, are implicit in functions conferred by law on the authority; and

the provision, to an individual from whom such express consent is being sought, of information about matters described in subsection (3); and

each party to have arrangements for dealing with complaints by individuals whose identification information is held by the party; and

each party to the agreement (except the Department) to report to the Department on breaches of security that relate to the party and are relevant to a matter dealt with in the agreement; and

the Department to inform the Information Commissioner of a breach of security that:

is reported to the Department under a provision of the agreement covered by paragraph (e); and

is a data breach that is reasonably likely to result in serious harm to an individual whose identification information is involved in the breach; and

the Department to notify each party to the agreement that is relevant to, or impacted by, a data breach of which the Information Commissioner is informed under paragraph (f); and

each party notified under paragraph (g) of a data breach, that is impacted by that breach, to take reasonable steps to notify each individual to whom the identification information relates.

For the purposes of paragraph (2)(c), the matters are as follows:

how the party seeking express consent uses identity verification services;

how any facial images of the individual collected by the party from the individual for requesting an identity verification service or from a response to a request for an identity verification service will be used and disposed of;

whether any such facial images will be retained or used for purposes other than those for which the identity verification service is to be requested;

what legal obligations the party seeking to collect the identification information has in relation to that collection;

what rights the individual has in relation to the collection of the identification information;

the consequences of the individual declining to consent;

where the individual can get information about making complaints relating to the collection, use and disclosure of the identification information for the purposes of requesting and provision of identity verification services;

where the individual can get information about the operation and management of the approved identity verification facilities by the Department in connection with the requesting and provision of identity verification services.

A participation agreement must provide that a party to the agreement is not authorised to use or disclose identification information obtained for the purposes of requesting or providing identity verification services for the purposes of any of the following:

engaging in activities that would allow the party to create a data profile of the person whose identity is being verified (including where it would allow the person’s behaviour to be tracked (whether or not online));

offering to supply goods or services;

advertising or promoting goods or services;

enabling another person or entity to offer to supply goods or services;

enabling another person or entity to advertise or promote goods or services;

market research.

A participation agreement must require each party to the agreement that proposes to request identity verification services:

either:

to request a DVS or FVS for the purposes of verifying the identity of an individual; or

to request an FVS or FIS for the purposes of protecting a shielded person or someone else associated with such a person; and

to comply with the access policy for each service the party requests; and

not to use the outcome of an identity verification service the party requested in relation to an individual as the only evidence of the individual’s identity in criminal or civil proceedings to which the individual is a party.

A participation agreement must provide for each party to the agreement that proposes to request identity verification services:

not to disclose identification information received by the party as a result of an identity verification service the party requested, except:

as required by law; or

as permitted by law in circumstances specified in, or identified in accordance with, the agreement; and

if the identity verification service is an FVS—to take reasonable steps to destroy each facial image of an individual that is created, for the purposes of the request, by the party requesting the service, as soon as reasonably practicable after the image is no longer required for the purposes of the request, unless the image is:

a Commonwealth record (within the meaning of the Archives Act 1983); or

required by a law of the Commonwealth, a State or a Territory, or by an order of a court or tribunal, to be retained; and

if the party is a government authority—not to permit an individual who is an officer, member of staff, employee or contractor of the party to:

make on behalf of the authority a request for an identity verification service that may result in a facial image being provided in response; or

deal with a facial image provided in response to such a request;

Facial images are not provided in response to requests by or on behalf of non‑government entities.

This section applies if:

a party to a participation agreement is subject to the Privacy Act 1988; and

an act or practice of the party, relating to personal information about an individual, does not comply with a requirement of:

the agreement in relation to a matter covered by section 9 or 10 (other than paragraph 10(1)(b)) of this Act; or

rules prescribed for the purposes of subsection 44(1A) of this Act.

For the purposes of the Privacy Act 1988, the act or practice is taken to be:

an interference with the privacy of the individual; and

covered by sections 13, 13G and 13H of that Act.