IDENTITY VERIFICATION SERVICES BILL 2023

No. , 2023

Identity Verification Services Bill 2023

Contents

Part 1

Preliminary

Division 1

Preliminary

Short title ........................................................................................... 1

Commencement ................................................................................. 2

Objects of this Act ............................................................................. 2

Simplified outline of this Act ............................................................ 3

Division 2

Definitions

Subdivision A

General definitions

Definitions ......................................................................................... 5

Definitions relating to identification information ............................ 10

Subdivision B

Common provisions for definitions of identity

verification services

Simplified outline of this Subdivision ............................................. 14

Definition of

participation agreement

............................................. 15

General privacy obligations of parties to participation

agreement ........................................................................................ 16

Extra privacy obligations of parties to participation

agreement that request services ....................................................... 18

Participation agreement must let parties limit use of

identification information they make available for identity

verification services ......................................................................... 19

Requirements relating to compliance with participation

agreement ........................................................................................ 19

NDLFRS hosting agreement............................................................ 19

Access policies for services ............................................................. 22

Subdivision C

Definition of DVS

Definition of

DVS

............................................................................ 22

Subdivision D

Definition of FIS

Definition of

FIS

............................................................................. 24

Requirements for valid request for FIS ............................................ 24

Characteristics and purpose of comparison involved in FIS ............ 26

Subdivision E

Definition of FVS

Definition of

FVS

............................................................................ 27

Characteristics and purpose of comparison involved in FVS .......... 28

Division 3

Miscellaneous

False and misleading statements in requests for services ................ 29

This Act binds Crown ...................................................................... 29

Identity Verification Services Bill 2023

No. , 2023

Part 2

Developing, operating and maintaining approved

identity verification facilities

Simplified outline of this Part .......................................................... 30

Department may develop, operate and maintain approved

identity verification facilities ........................................................... 30

How facilities are to be developed, operated and maintained .......... 30

Part 3

Authorising collection, use and disclosure of

identification information

Division 1

Simplified outline

Simplified outline of this Part .......................................................... 31

Division 2

Collection, use and disclosure of identification

information by the Department

Collection of identification information by the Department ............ 32

Use and disclosure of identification information by the

Department ...................................................................................... 33

Part 4

Protection of information

Division 1

Simplified outline

Simplified outline of this Part .......................................................... 35

Division 2

When protected information can be recorded,

disclosed or accessed

Offences by entrusted persons ......................................................... 36

Exercising powers, or performing functions or duties, as an

entrusted person ............................................................................... 38

Disclosure to lessen or prevent threat to life or health ..................... 38

Disclosure to IGIS official ............................................................... 39

Disclosure to Ombudsman official .................................................. 39

Disclosure etc. with consent ............................................................ 39

Part 5

Miscellaneous

Simplified outline of this Part .......................................................... 41

No requirement for individuals to identify themselves .................... 41

Delegation of Secretary's powers and functions under this

Act ................................................................................................... 42

Publication of agreements and policies............................................ 42

Annual assessment by Information Commissioner .......................... 43

Annual reporting .............................................................................. 43

Fees ................................................................................................. 46

Review of operation of this Act and provision of identity

verification services ......................................................................... 46

No. , 2023

Identity Verification Services Bill 2023

A Bill for an Act about dealing with information for

providing identity verification services, and for

related purposes

The Parliament of Australia enacts:

Part

1--Preliminary

Division

1--Preliminary

1 Short title

This Act is the

Identity Verification Services Act 2023.

Part 1

Preliminary

Division 1

Preliminary

Section 2

Identity Verification Services Bill 2023

No. , 2023

2 Commencement

(1) Each provision of this Act specified in column 1 of the table

commences, or is taken to have commenced, in accordance with

column 2 of the table. Any other statement in column 2 has effect

according to its terms.

Commencement information

Column 1

Column 2

Column 3

Provisions

Commencement

Date/Details

1. The whole of

this Act

The day after this Act receives the Royal

Assent.

Note:

This table relates only to the provisions of this Act as originally

enacted. It will not be amended to deal with any later amendments of

this Act.

(2) Any information in column 3 of the table is not part of this Act.

Information may be inserted in this column, or information in it

may be edited, in any published version of this Act.

3 Objects of this Act

The objects of this Act are:

(a) to authorise the Department to develop, operate and maintain

the 3 approved identity verification facilities (the DVS hub,

the Face Matching Service Hub and the NDLFRS); and

(b) to authorise the Department (but not other persons or bodies)

to collect, use and disclose identification information

communicated to an approved identity verification facility, or

generated using the NDLFRS, for purposes relating to:

(i) verifying the identity of an individual using a DVS or

FVS; or

(ii) protecting a shielded person or someone else associated

with a shielded person using an FVS or FIS; or

(iii) the NDLFRS; and

approved identity verification facilities, and certain other

information relating to the use or security of those facilities,

Preliminary

Part 1

Preliminary

Division 1

Section 4

No. , 2023

Identity Verification Services Bill 2023

from unauthorised recording, disclosure or access by certain

persons who do work for the Department; and

(d) to provide for oversight and scrutiny of the operation and

management of the approved identity verification facilities.

4 Simplified outline of this Act

The Department may develop and operate the 3 approved identity

verification facilities. They are:

(a) the DVS hub, which relays electronic communications

between persons and bodies requesting and providing

DVSs (which stands for Document Verification Service,

a particular kind of 1:1 matching service); and

(b) the Face Matching Service Hub, which relays electronic

communications between persons and bodies requesting

and providing identity verification services; and

identification information from State and Territory

authorities and may be used to provide identity

verification services.

There are 2 kinds of identity verification services:

(a) 1:1 matching services (FVS (which stands for Face

Verification Service) and DVS); and

(b) 1:many matching services (Face Identification Service

or FIS).

A 1:1 matching service matches particular biometric information

(such as a photograph) or biographic information (such as a name

or date of birth) against a particular record. A 1:many matching

service compares a facial image (such as a photograph) against

other facial images.

The Department may collect identification information through the

approved identity verification facilities for any of the following

purposes:

(a) providing or developing DVSs or FVSs for the purposes

of verifying the identity of individuals;

Part 1

Preliminary

Division 1

Preliminary

Section 4

Identity Verification Services Bill 2023

No. , 2023

(b) providing or developing FVSs or FISs for the purposes

of protecting identities of persons (or associates) who

have legally assumed identities or are under witness

protection;

The Department may use or disclose for any of those purposes

information so collected.

An identity verification service involves a request for an electronic

comparison of identification information that relates to an

individual to do any of the following:

(a)

verify the individual's identity

;

(b) protect the identity of the individual if the individual is a

shielded person;

individual in the NDLFRS.

Those requests can be made only by parties to agreements that

contain safeguards for the privacy of individuals whose

identification information is used in requesting or providing the

services. The identification information used for comparison with

that in the request must have been supplied by a government

authority that is party to such an agreement.

Persons who work for the Department, and contractors whose

duties relate to an approved identity verification facility, may

commit an offence for unauthorised recording, disclosure of or

access to certain information held in, generated using or relating to

an approved identity verification facility.

Operation and use of the approved identity verification facilities

are open to oversight and scrutiny in various ways, including

publication of documents, annual assessment by the Information

Commissioner and annual reporting.

Preliminary

Part 1

Definitions

Division 2

Section 5

No. , 2023

Identity Verification Services Bill 2023

Division

2--Definitions

Subdivision A

General definitions

5 Definitions

In this Act:

1:1 matching service

means DVS or FVS.

1:many matching service

means FIS.

access policy

has the meaning given by section 14.

approved identity verification facility

means:

(a) the DVS hub; or

(b) the Face Matching Service Hub; or

data breach

means an occurrence of unauthorised access to,

unauthorised disclosure of or loss of identification information.

DVS

has the meaning given by section 15.

Note:

DVS is short for Document Verification Service, a term used in the

intergovernmental agreement.

DVS document

means any of the following:

(a) a birth certificate issued by or on behalf of an authority of a

State or Territory;

(b) a death certificate issued by or on behalf of an authority of a

State or Territory;

Social Security

Act 1991

);

(d) a notice given under section 37 of the

Australian Citizenship

Act 2007

stating that a person is an Australian citizen at a

particular time;

(e) a certificate issued by an authority of a State or Territory

indi

cating that an individual has changed the individual's

name;

Part 1

Preliminary

Division 2

Definitions

Section 5

Identity Verification Services Bill 2023

No. , 2023

(f)

a driver's licence (however described) issued by or on behalf

of an authority of a State or Territory;

(g) a document issued by or on behalf of an authority of a State

or Territory to assis

t an individual to prove the individual's

age or identity;

(h) a document issued to an individual, as a person who is not an

Australian citizen, by the Department administered by the

Minister administering the

Migration Act 1958

to assist the

individual t

o prove the individual's identity;

(i) a certificate of marriage issued by or on behalf of an

authority of a State or Territory whose function it is to

(j) a document issued by a court setting out a divorce order

made under the

Family Law Act 1975

;

(k) an Australian travel document (within the meaning of the

Australian Passports Act 2005

);

(l) a certificate signed by an officer (within the meaning of the

Migration Act 1958

) stating that, at a specified time, or

during a specified period, a specified person was the holder

of a visa that was in effect;

(m) an entry in a Roll (within the meaning of the

Commonwealth

Electoral Act 1918

) relating to a particular individual;

(n) an aviation security identification card issued under

regulations made for the purposes of the

Aviation Transport

Security Act 2004

;

(o) an MSIC issued under regulations made for the purposes of

the

Maritime Transport and Offshore Facilities Security Act

2003

;

(p) a medicare card (within the meaning of subsection 84(1) of

the

National Health Act 1953

DVS hub

means a facility that:

(a) is for relaying electronic communications between persons

and bodies for the purposes of requesting and providing

DVSs; and

(b) is developed, operated and maintained by the Department

under Part 2.

Preliminary

Part 1

Definitions

Division 2

Section 5

No. , 2023

Identity Verification Services Bill 2023

DVS information

has the meaning given by section 6.

electronic communication

means a communication of information,

in the form of data, text or images by means of guided

electromagnetic energy, unguided electromagnetic energy or both,

carried by a telegraphic, telephonic or other like service within the

meaning of section 51(v) of the Constitution.

entrusted person

has the meaning given by section 30.

Face Matching Service Hub

means a facility that:

(a) is for relaying electronic communications between persons

and bodies for the purposes of requesting and providing

identity verification services; and

(b) is developed, operated and maintained by the Department

under Part 2.

face-matching service information

has the meaning given by

section 6.

facial image

means a digital still image of an individual's face

(whether or not including the shoulders).

FIS

has the meaning given by section 16.

Note:

FIS is short for Face Identification Service, a term used in the

intergovernmental agreement.

FVS

has the meaning given by section 19.

Note:

FVS is short for Face Verification Service, a term used in the

intergovernmental agreement.

government authority

means:

(a) an authority of the Commonwealth; or

(b) an authority of a State or Territory;

other than a local government authority.

government identification document

means a document or other

thing that:

(a) contains identification information; and

Part 1

Preliminary

Division 2

Definitions

Section 5

Identity Verification Services Bill 2023

No. , 2023

(b) can be used to identify an individual or to pass an individual

off as someone else (whether living, dead, real or fictitious);

and

identification information

has the meaning given by section 6.

identity verification service

means:

(a) a 1:1 matching service; or

(b) a 1:many matching service.

IGIS official

means:

(a) the Inspector-General of Intelligence and Security; or

(b) a member of the staff referred to in subsection 32(1) of the

Inspector-General of Intelligence and Security Act 1986

intergovernmental agreement

means the Intergovernmental

Agreement on Identity Matching Services made on 5 October 2017

by the Commonwealth, the States, the Australian Capital Territory

and the Northern Territory.

Note:

The intergovernmental agreement must be published on the

Departm

ent's website

(see section 39).

NDLFRS

means a system that consists of:

(a) a database of identification information that:

(i) is also either contained in government identification

documents issued by or on behalf of an authority of a

State or Territory or associated with those documents by

the authority; and

(ii) is supplied by or on behalf of the authority to the

Department by electronic communication for inclusion

in the database; and

(b) a system for biometric comparison of facial images with

facial images that are in the database described in

paragraph (a);

and is developed, operated and maintained by the Department

under Part 2.

Note:

NDLFRS is short for National Driver Licence Facial Recognition

Solution, a term used in the intergovernmental agreement.

Preliminary

Part 1

Definitions

Division 2

Section 5

No. , 2023

Identity Verification Services Bill 2023

NDLFRS hosting agreement

has the meaning given by section 13.

non-government entity

means a person, or body, other than:

(a) the Commonwealth, a State or a Territory; or

(b) a government authority.

Note:

Local government authorities are non-government entities because

they are excluded from the definition of

government authority

Authorities of New Zealand are non-government entities because they

are not covered by the definition of

government authority

Ombudsman official

means:

(a) the Commonwealth Ombudsman; or

(b) a Deputy Commonwealth Ombudsman; or

Ombudsman Act 1976

participation agreement

has the meaning given by section 8.

personal information

has the meaning given by section 6 of the

Privacy Act 1988

privacy impact assessment

has the meaning given by

subsection 33D(3) of the

Privacy Act 1988

protected information

has the meaning given by section 30.

rules

means rules made under section 44.

Secretary

means the Secretary of the Department.

shielded person

means a person to whom one or more of the

following paragraphs apply:

(a) the person has acquired or used an assumed identity under

Part IAC of the

Crimes Act 1914

or a corresponding assumed

identity law within the meaning of that Part;

(b) an authority for the person to acquire or use an assumed

identity has been granted under that Part or such a law;

person under Part IACA of the

Crimes Act 1914

;

(d) a corresponding witness identity protection certificate has

been given for the person under a corresponding witness

Part 1

Preliminary

Division 2

Definitions

Section 6

Identity Verification Services Bill 2023

No. , 2023

identity protection law within the meaning of Part IACA of

the

Crimes Act 1914

;

(e) the person is a participant (as defined in the

Witness

Protection Act 1994

);

(f) the person is or was on a witness protection program

conducted by a State or Territory in which a complementary

witness protection law (as defined in the

Witness Protection

Act 1994

) is in force;

(g) the person is involved in administering such a program under

such a law and the person has acquired an identity under that

law.

6 Definitions relating to identification information

Definition of

identification information

(1)

Identification information

is:

(a) face-matching service information; or

(b) DVS information.

Definition of

face-matching service information

(2)

Face-matching service information

that relates to an individual

(whether living, dead, real or fictitious) is any of the following,

subject to subsections (4) and (5):

(a) a name by which the individual is or has been known;

(b) a current or former address of the individual;

(d) the age of the individual (whether expressed by reference to a

range or not);

(e) the current or former sex, gender identity or intersex status of

the individual;

(f) information about whether the individual is alive or dead;

(g) any information that is:

(i)

contained in a driver's licence (however described)

issued by or on behalf of an authority of a State or

Territory in a name of the individual; or

Preliminary

Part 1

Definitions

Division 2

Section 6

No. , 2023

Identity Verification Services Bill 2023

(ii) otherwise associated with such a licence by such an

authority;

(h) any information that is:

(i) contained in any document (however described) that is

issued by or on behalf of an authority of a State or

Territory in a name of the individual, contains a

photograph purporting to be of the individual and can be

used to assist in proving the individual's identity; or

(ii) otherwise associated with such a document by the

authority;

(i) any information that is:

(i) contained in a document issued to the individual, as a

person who is not an Australian citizen, by the

Department administered by the Minister administering

the

Migration Act 1958

to assist the individual to prove

the individual's identity; or

(ii) otherwise associated with such a document by that

Department;

(j) any information that is:

(i) contained in an Australian travel document (within the

meaning of the

Australian Passports Act 2005

) issued in

a name of the individual; or

(ii) otherwise associated with the Australian travel

document by the Minister administering the

Australian

Passports Act 2005

or the Department administered by

that Minister; or

(iii) otherwise associated with the Australian travel

document by a government authority by which the

travel document may be inspected or seized under a law

of the Commonwealth or of a State or Territory;

(k) any information that is:

(i) contained in a foreign travel document (within the

meaning of the

Foreign Passports (Law Enforcement

and Security) Act 2005

) issued in a name of the

individual; or

(ii) otherwise associated with the foreign travel document

by a government authority by which the travel

Part 1

Preliminary

Division 2

Definitions

Section 6

Identity Verification Services Bill 2023

No. , 2023

document may be inspected or seized under a law of the

Commonwealth or of a State or Territory;

(l)

the individual's current or former citizenship;

(m) any information that is:

(i) contained in a current or past application for Australian

citizenship for the individual; or

(ii) contained in a document issued by an authority of the

Commonwealth to provide evidence that the individual

is or was an Australian citizen; or

(iii) otherwise associated with an application or document

described in subparagraph (i) or (ii) by the Department

administered by the Minister administering the

Australian Citizenship Act 2007

;

(n) information about a visa, or an entry permit under the

Migration Act 1958

, that the individual holds or held;

(o) any information that is:

(i) contained in a current or past application for a visa, or

entry permit, for the individual under the

Migration Act

1958

; or

(ii) contained in a visa, or entry permit, for the individual

granted under that Act; or

(iii) otherwise associated with an application, visa or entry

permit described in subparagraph (i) or (ii) by the

Department administered by the Minister administering

that Act;

(p) a facial image of the individual, a biometric template derived

from such an image or a result of biometric comparison

involving such an image;

(q) information about the outcome of a comparison involved in

an FVS requested in relation to the individual.

Definition of

DVS information

(3)

DVS information

that relates to an individual is either of the

following, subject to subsections (4) and (5):

(a) information (but not a facial image or biometric information)

that either:

Preliminary

Part 1

Definitions

Division 2

Section 6

No. , 2023

Identity Verification Services Bill 2023

(i) is contained in a document (the

specimen document

)

that relates to the individual and purports to be a DVS

document of a particular kind; or

(ii) is, or is reasonably expected to be, associated, with a

DVS document of a particular kind relating to the

individual, by a government authority that is responsible

for the issue of DVS documents of that kind;

and helps indicate whether the specimen document is a DVS

document of that kind;

(b) information about the outcome of a comparison involved in a

DVS relating to the individual.

What is not face-matching service information or DVS information

(4) The following is neither face-matching service information, nor

DVS information, that relates to an individual:

(a) information or an opinion that relates to

the individual's:

(i) racial or ethnic origin; or

(ii) political opinions; or

(iii) membership of a political association; or

(iv) religious beliefs or affiliations; or

(v) philosophical beliefs; or

(vi) membership of a professional or trade association; or

(vii) membership of a trade union; or

(viii) sexual orientation or practices; or

(ix) criminal record;

(b) health information (within the meaning of the

Privacy Act

1988

) that relates to the individual;

(5) Subsection (4) does not prevent information described in any of the

paragraphs of subsection (2) or (3) from being face-matching

service information or DVS information if the information is not

primarily of any of the kinds described in subsection (4), even if

information of any of those kinds can reasonably be inferred from

the information.

Example 1: Even

if an individual's racial or ethnic origin can reasonably be

inferred from the individual's name or place of birth, this does not

Part 1

Preliminary

Division 2

Definitions

Section 7

Identity Verification Services Bill 2023

No. , 2023

prevent the individual's name or place of birth from being

face-matching service information or DVS information.

Example 2: Ev

en if an individual's racial or ethnic origin or religious affiliations

can reasonably be inferred from a facial image of the individual, this

does not prevent the image from being face-matching service

information.

Subdivision B

Common provisions for definitions of identity

verification services

7 Simplified outline of this Subdivision

Two types of agreement govern the requesting and provision of

identity verification services:

(a) participation agreements (which are agreements between

the Department and other authorities, persons and bodies

about the requesting and provision of identity

verification services using the approved identity

verification facilities); and

(b) the NDLFRS hosting agreement (which is an agreement

between the Department and authorities of a State or

Territory that supply identification information stored

and used in the NDLFRS).

A request for an identity verification service can be made only by a

party to a participation agreement, and only identification

information made available by a party to a participation agreement

can be used in an identity verification service.

The Department may develop, operate and maintain the approved

identity verification facilities. The Department is required to

maintain the security of electronic communications to and from the

facility, including by encrypting the information, and to protect the

information from unauthorised interference or unauthorised access.

Participation agreements and the NDLFRS hosting agreement

contain safeguards for the privacy of individuals whose

identification information is used in requesting identity verification

services or responding to such requests. The safeguards include

Preliminary

Part 1

Definitions

Division 2

Section 8

No. , 2023

Identity Verification Services Bill 2023

committing the parties to the agreement to complying with

standards set by the

Privacy Act 1988

or similar State or Territory

laws (even if those standards would not otherwise apply to a party).

Participation agreements also need to provide for a range of other

privacy safeguards relating to identity verification services,

including:

(a) privacy impact assessments of requesting the services;

and

(b)

obtaining an individual's consent to the collection, use

and disclosure of the individual's identification

information for the purposes of requesting the services

(unless the collection, use and disclosure is by a

government authority authorised by another law to do

so); and

requested and on what may be done with information

received in response to requests; and

(d) annual reporting and auditing of compliance with

agreements; and

(e)

suspension or termination of a party's ability to request

services if the party has not complied with the

agreement or access policies for the services.

8 Definition of

participation agreement

(1) A

participation agreement

is a written agreement, between the

Department (representing the Commonwealth) and one or more

other parties, that:

(a) deals with the requesting and provision of identity

verification services of one or more kinds using identification

information made available by the parties; and

(b) meets the requirements in sections 9, 10, 11 and 12.

Timing and nature of agreement

(2) To avoid doubt:

Part 1

Preliminary

Division 2

Definitions

Section 9

Identity Verification Services Bill 2023

No. , 2023

(a) an agreement may be a participation agreement whether it

was made before, on or after the commencement of this

section; and

(b) different participation agreements may be made between the

Department and different other parties; and

the matters a participation agreement may deal with.

9 General privacy obligations of parties to participation agreement

(1) Each party to a participation agreement must:

(a) be subject to the

Privacy Act 1988

; or

(b) be subject to a privacy law that:

(i) is a law of a State or Territory; and

(ii) is prescribed by the rules for the purposes of this

subparagraph; or

Principles, with any modifications of subclauses 7.8 and 12.2

of those principles (about laws of the Commonwealth)

specified in the agreement, as if the party were an APP

entity; or

(d) be a government authority prescribed by the rules for the

purposes of this paragraph; or

(e) if the agreement deals only with the requesting of DVSs by,

and provision of DVSs to, an authority of New Zealand or a

person or body operating in New Zealand

be an authority,

person or body subject to the

Privacy Act 1993

of New

Zealand.

Note:

A DVS is the only identity verification service available to a party to

an agreement described in paragraph (e).

(2) A participation agreement must provide for:

(a) privacy impact assessments of requesting identity verification

services; and

(b) the obtaining of a

n individual's consent to the collection, use

and disclosure, for the purposes of requesting identity

verification services, of identification information that relates

to the individual included in such a request, unless:

Preliminary

Part 1

Definitions

Division 2

Section 9

No. , 2023

Identity Verification Services Bill 2023

(i) the request is made by or on behalf of a government

authority; and

(ii) collection, use and disclosure of that information for the

purposes of protecting a shielded person, or someone

else associated with a shielded person,

are implicit in

functions conferred by law on the authority; and

being sought, of information about matters described in

subsection (3); and

(d) each party to have arrangements for dealing with complaints

by individuals whose identification information is held by the

party; and

(e) each party to the agreement (except the Department) to report

to the Department on breaches of security that relate to the

party and are relevant to a matter dealt with in the agreement;

and

(f) the Department to inform the Information Commissioner of a

breach of security that:

(i) is reported to the Department under a provision of the

agreement covered by paragraph (e); and

(ii) is a data breach that is reasonably likely to result in

serious harm to an individual whose identification

information is involved in the breach.

(3) For the purposes of paragraph (2)(c), the matters are as follows:

(a) how the party seeking consent uses identity verification

services;

(b) how any facial images of the individual collected by the party

from the individual for requesting an identity verification

service or from a response to a request for an identity

verification service will be used and disposed of;

purposes other than those for which the identity verification

service is to be requested;

(d) what legal obligations the party seeking to collect the

identification information has in relation to that collection;

(e) what rights the individual has in relation to the collection of

the identification information;

Part 1

Preliminary

Division 2

Definitions

Section 10

Identity Verification Services Bill 2023

No. , 2023

(f) the consequences of the individual declining to consent;

(g) where the individual can get information about making

complaints relating to the collection, use and disclosure of

the identification information for the purposes of requesting

and provision of identity verification services;

(h) where the individual can get information about the operation

and management of the approved identity verification

facilities by the Department in connection with the requesting

and provision of identity verification services.

10 Extra privacy obligations of parties to participation agreement

that request services

(1) A participation agreement must require each party to the agreement

that proposes to request identity verification services:

(a) either:

(i) to request a DVS or FVS for the purposes of verifying

the identity of an individual; or

(ii) to request an FVS or FIS for the purposes of protecting

a shielded person or someone else associated with such

a person; and

(b) to comply with the access policy for each service the party

requests; and

party requested in relation to an individual as the only

evidence of the individual's identity in crimina

l or civil

proceedings to which the individual is a party.

(2) A participation agreement must provide for each party to the

agreement that proposes to request identity verification services:

(a) not to disclose identification information received by the

party as a result of an identity verification service the party

requested, except:

(i) as required by law; or

(ii) as permitted by law in circumstances specified in, or

identified in accordance with, the agreement; and

Preliminary

Part 1

Definitions

Division 2

Section 11

No. , 2023

Identity Verification Services Bill 2023

(b) if the party is a government authority

not to permit an

individual who is an officer, member of staff, employee or

contractor of the party to:

(i) make on behalf of the authority a request for an identity

verification service that may result in a facial image

being provided in response; or

(ii) deal with a facial image provided in response to such a

request;

unless the individual has been trained in facial recognition

and image comparison.

Note:

Facial images are not provided in response to requests by or on behalf

of non-government entities.

11 Participation agreement must let parties limit use of

identification information they make available for

identity verification services

A participation agreement must provide for a party that is a

government authority that makes available identification

information for an identity verification service (except in a request

for the service) to be able to limit the use of that information.

12 Requirements relating to compliance with participation

agreement

A participation agreement must provide for:

(a) annual auditing of compliance with the agreement; and

(b) each party to the agreement (except the Department) to report

annually to the Department on the party's compliance with

the agreement; and

agreement to request identity verification services if the party

does not comply with the agreement or access policies for

those services.

13 NDLFRS hosting agreement

(1) The

NDLFRS hosting agreement

is a written agreement that:

Part 1

Preliminary

Division 2

Definitions

Section 13

Identity Verification Services Bill 2023

No. , 2023

(a) is between the Department (representing the Commonwealth)

and each authority that:

(i) is an authority of a State or Territory; and

(ii) meets the requirement in subsection (2); and

(iii) supplies or proposes to supply identification information

to the Department for inclusion in a database in the

NDLFRS; and

(b) deals with the NDLFRS and the collection, use and

disclosure of identification information in a database in the

NDLFRS; and

State and Territory parties must be subject to privacy obligations

(2) Each authority of a State or Territory that is party to the agreement

must:

(a) be subject to a privacy law that:

(i) is a law of the State or Territory; and

(ii) is prescribed by the rules for the purposes of this

subparagraph; or

(b) be one of the following to which the

Privacy Act 1988

applies (with or without modifications) as if it were an

organisation:

(i) a State or Territory authority (as defined in that Act);

(ii) an instrumentality of a State or Territory; or

Principles, with any modifications of subclauses 7.8 and 12.2

of those principles (about laws of the Commonwealth)

specified in the agreement, as if the party were an APP

entity.

Note:

The Department, which is the other party to the agreement, is subject

to the

Privacy Act 1988

Requirements on each State or Territory party

(3) The agreement must provide for each party that is an authority of a

State or Territory:

Preliminary

Part 1

Definitions

Division 2

Section 13

No. , 2023

Identity Verification Services Bill 2023

(a) to take reasonable steps to inform each individual whose

identification information is, or is to be, included in a

database in the NDLFRS of that inclusion; and

(b) to provide each individual whose identification information

is included in a database in the NDLFRS with means of:

(i) finding out what that information is; and

(ii) having any errors in that information corrected in the

database; and

data breaches that:

(i) involve identification information that relates to the

individual and the NDLFRS; and

(ii) are reasonably likely to result in serious harm to the

individual; and

(d) to provide means for dealing with complaints by individuals

relating to the NDLFRS and identification information that

relates to them that is included in a database in the NDLFRS;

and

(e)

to report annually to the Department on the party's

compliance with the agreement.

Requirements on the Department

(4) The agreement must provide for the Department:

(a) to maintain the security of identification information

included in a database in the NDLFRS, including by

encrypting the information; and

(b) to inform the other parties to the agreement of any data

breaches involving that information and the NDLFRS; and

breaches that:

(i) involve that information and the NDLFRS; and

(ii) are reasonably likely to result in serious harm to an

individual to whom that information relates.

Note:

For paragraph (4)(a), see also paragraph 25(a).

Part 1

Preliminary

Division 2

Definitions

Section 14

Identity Verification Services Bill 2023

No. , 2023

Requirement relating to compliance

(5) The agreement must provide for suspension or termination of the

ability of a party to the agreement to request identity verification

services involving the NDLFRS if the party does not comply with

the agreement.

Timing and nature of agreement

(6) To avoid doubt:

(a) an agreement may be the NDLFRS hosting agreement

whether it was made before, on or after the commencement

of this section; and

(b) paragraph (1)(c) and subsections (3), (4) and (5) do not limit

the matters the agreement may deal with.

14 Access policies for services

The

access policy

for a service is the conditions that:

(a) are to be complied with by parties to participation

agreements for the parties to have access (on request by the

parties) to services of that kind; and

(b) are set out in a document approved by the Coordination

Group provided for by the intergovernmental agreement; and

Secretary statements of the legal basis for disclosing and

using identification information for the purposes of

requesting and providing services of that kind to the parties.

Note:

Under section 39, the Secretary must publish documents setting out

access policies.

Subdivision C

Definition of DVS

15 Definition of

DVS

(1) A service is a

DVS

if:

(a) it is, or is sought to be, provided on a request made by or on

behalf of an authority, person or body (each the

requesting

party

); and

Preliminary

Part 1

Definitions

Division 2

Section 15

No. , 2023

Identity Verification Services Bill 2023

(b) the requesting party is a party to a participation agreement;

and

individual (other than information described in

paragraph 6(3)(b)), and to a specimen document purporting

to be a DVS document that:

(i) is of a kind specified in the request; and

(ii) is issued by a government authority that is or was

responsible for the issue of DVS documents of that

kind; and

(d) the service involves, or is to involve, an electronic

comparison of the DVS information described in

paragraph (c) and information that:

(i) is contained in DVS documents of the kind specified in

the request, or is associated with such documents by the

government authority (the

issuing authority

) that is

responsible for issuing them and is a party to a

participation agreement; and

(ii) is made available for the comparison by the issuing

authority; and

(e) the comparison is carried out in accordance with any

limitations, provided for under that participation agreement,

subject to which the issuing authority made the information

available for the comparison; and

(f) the purpose of the comparison is to help determine whether

the specimen document is a DVS document of the kind

identified in the request; and

(g) the response to the requesting party about the outcome of the

comparison is limited to either:

(i) a statement that the information compared matched; or

(ii) a statement that the information compared did not

match, with or without reasons why the information did

not match; and

(h) the request and the response to the request are communicated

by electronic communications relayed through the DVS hub

or the Face Matching Service Hub.

Part 1

Preliminary

Division 2

Definitions

Section 16

Identity Verification Services Bill 2023

No. , 2023

Note 1:

DVS is short for Document Verification Service, a term used in the

intergovernmental agreement.

Note 2:

DVS is an example of a 1:1 matching service (see the definition of

1:1

matching service

in section 5).

(2) The following provisions do not apply in relation to a service

requested within 12 months after the commencement of this

section:

(a) paragraph (1)(b);

(b) subparagraph (1)(d)(i), so far as it relates to the issuing

authority being a party to a participation agreement;

Subdivision D

Definition of FIS

16 Definition of

FIS

A service is an

FIS

if:

(a) it is, or is sought to be, provided on a request; and

(b) the requirements in section 17 are met in relation to the

request; and

the characteristics and purpose set out in section 18; and

(d) the request and the outcome of the comparison are

communicated by electronic communications relayed

through the Face Matching Service Hub.

Note 1:

FIS is short for Face Identification Service, a term used in the

intergovernmental agreement.

Note 2:

FIS is the only kind of 1:many matching service that is permitted

under this Act.

17 Requirements for valid request for FIS

Requesting authorities

(1) A request for an FIS must be made only:

(a) by any of the following officers of a Commonwealth, State or

Territory government authority that is a party to a

participation agreement:

Preliminary

Part 1

Definitions

Division 2

Section 17

No. , 2023

Identity Verification Services Bill 2023

(i) a law enforcement officer or intelligence officer (within

the meaning of section 15K of the

Crimes Act 1914

);

(ii) an officer (however described) of an agency authorised

under a corresponding assumed identity law (within the

meaning of section 15K of the

Crimes Act 1914

);

(iii) an officer (however described) of an approved authority

(within the meaning of the

Witness Protection Act 1994

)

that is permitted to participate in the National Witness

Protection Program under that Act, or a complementary

witness protection law declared under section 3AA of

that Act; and

(b) if the officer is required to make the request for the purpose

of protecting the identity of a shielded person or someone

else associated with a shielded person.

Person making request

(2) The person making the request on behalf of the authority must be

an officer who is approved as a suitable person to make the request

(or requests of that kind) by:

(a) the head (however described) of the authority; or

(b) a person who:

(i) is the holder of a management office or position in the

authority; and

(ii) is authorised, by notice in writing given to the

Department, by that head to approve persons to make

requests for FISs on behalf of the authority; and

(iii) is senior to the person making the request.

Note:

To comply with the participation agreement to which the authority is

party, an officer approved to make the request must have been trained

in facial recognition and image comparison: see paragraph 10(2)(b).

Request stating relevant activity

(3) The request must:

(a) include a single facial image of an individual (whether or not

other face-matching service information that relates to the

individual is included); and

Part 1

Preliminary

Division 2

Definitions

Section 18

Identity Verification Services Bill 2023

No. , 2023

(b) specify the kinds of government identification documents

against which the face-matching service information in the

request is to be compared, partly by reference to whether the

authority by or on behalf of which the documents are issued

is:

(i) an authority of the Commonwealth; or

(ii) an authority of a specified State; or

(iii) an authority of a specified Territory.

Note:

Making a false or misleading statement in the request may be an

offence against section 136.1 of the

Criminal Code

Endorsement of request

(4) The request must be:

(a) endorsed by the head (however described) of the authority, or

a person who:

(i) is the holder of a management office or position in the

authority; and

(ii) is authorised, by notice in writing given to the

Department, by that head to endorse requests for FISs

made on behalf of the authority; and

(iii) is senior to the person making the request; and

(b) made by electronic communication to the Face Matching

Service Hub.

Note:

The endorsement may be given at the same time as, or after, the

request is made by electronic communication to the Face Matching

Service Hub.

(5) A person must not endorse a request made on behalf of an

authority unless the person is satisfied that the request is made for

the purposes of:

(a) protecting the shielded person, or associate, stated in the

request; and

(b)

the performance of the authority's functions

18 Characteristics and purpose of comparison involved in FIS

(1) The comparison involved in an FIS is an electronic comparison of:

Preliminary

Part 1

Definitions

Division 2

Section 19

No. , 2023

Identity Verification Services Bill 2023

(a) a single facial image of an individual, and other

face-matching service information (if any) that relates to the

individual, that is included in the request for the service; and

(b) face-matching service information that:

(i) relates to one or more individuals; and

(ii) is contained in, or associated with, one or more

government identification documents of one or more

kinds specified in the request; and

(iii) is made available for the comparison by a government

authority (the

supplying authority

) that is a party to a

participation agreement.

(2) The comparison is carried out in accordance with any limitations,

provided for under the participation agreement, subject to which

the supplying authority made the face-matching service

information available for the comparison.

(3) The comparison is for the purpose of protecting an individual who

is a shielded person, or someone else associated with a shielded

person.

Subdivision E

Definition of FVS

19 Definition of

FVS

A service is an

FVS

if:

(a) it is, or is sought to be, provided on a request, made by or on

behalf of a party (the

requesting party

) to a participation

agreement that does not deal only with the requesting of

DVSs by, and provision of DVSs to, an authority of New

Zealand or a person or body operating in New Zealand; and

(b) the request includes face-matching service information that

relates to the individual; and

the characteristics and purpose set out in section 20; and

(d) if the requesting party is a non-government entity

the

response to the requesting party about the outcome of the

comparison:

Part 1

Preliminary

Division 2

Definitions

Section 20

Identity Verification Services Bill 2023

No. , 2023

(i) is either that the comparison resulted in a match for the

individual or that the comparison did not result in a

match for the individual; and

(ii) does not contain any other face-matching service

information that relates to the individual; and

(e) the request and the response are communicated by electronic

communications relayed through the Face Matching Service

Hub.

Note 1:

FVS is short for Face Verification Service, a term used in the

intergovernmental agreement.

Note 2:

FVS is an example of a 1:1 matching service (see the definition of

1:1

matching service

in section 5).

20 Characteristics and purpose of comparison involved in FVS

(1) The comparison involved in an FVS is an electronic comparison

of:

(a) face-matching service information that relates to the

individual that is included in the request for the service; and

(b) face-matching service information that:

(i) is contained in, or associated with, a government

identification document of a kind specified in the

request that was issued to the individual; and

(ii) is made available for the comparison by a government

authority (the

supplying authority

) that is a party to a

participation agreement.

(2) The comparison is carried out in accordance with any limitations,

provided for under the participation agreement, subject to which

the supplying authority made the face-matching service

information available for the comparison.

(3) The comparison is for the purpose of:

(a) verifying the identity of the individual; or

(b) protecting an individual who is a shielded person, or

someone else associated with a shielded person.

Preliminary

Part 1

Miscellaneous

Division 3

Section 21

No. , 2023

Identity Verification Services Bill 2023

Division

3--Miscellaneous

21 False and misleading statements in requests for services

To avoid doubt, a request for an identity verification service is an

application for a benefit for the purposes of section 136.1 of the

Criminal Code

Note:

That section creates offences for making false or misleading

statements in applications for benefits.

22 This Act binds Crown

This Act binds the Crown in each of its capacities.

Part 2

Developing, operating and maintaining approved identity verification facilities

Section 23

Identity Verification Services Bill 2023

No. , 2023

Part

2--Developing, operating and maintaining

approved identity verification facilities

23 Simplified outline of this Part

The Department may develop, operate and maintain the 3 approved

identity verification facilities (the DVS hub, the Face Matching

Service Hub and the NDLFRS).

The Department is required to maintain the security of electronic

communications to and from the facility, including by encrypting

the information, and to protect the information from unauthorised

interference or unauthorised access.

24 Department may develop, operate and maintain approved

identity verification facilities

(1) The Department may develop, operate and maintain the approved

identity verification facilities.

(2) The authorisation by subsection (1) to develop, operate and

maintain the DVS hub does not limit the authorisation by that

subsection to develop, operate and maintain the Face Matching

Service Hub.

25 How facilities are to be developed, operated and maintained

In developing, operating and maintaining an approved identity

verification facility, the Department must:

(a) maintain the security of electronic communications to and

from the facility, including by encrypting the information;

and

(b) protect the information from unauthorised interference or

unauthorised access.

Authorising collection, use and disclosure of identification information

Part 3

Simplified outline

Division 1

Section 26

No. , 2023

Identity Verification Services Bill 2023

Part

3--Authorising collection, use and disclosure

of identification information

Division

1--Simplified outline

26 Simplified outline of this Part

The Department may collect certain identification information by

means of particular approved identity verification facilities for any

of the following purposes:

(a) providing or developing DVSs or FVSs for the purposes

of verifying the identity of individuals;

(b) providing or developing FVSs or FISs for the purposes

of protecting identities of persons (or associates) who

have legally assumed identities or are under witness

protection;

The Department may use or disclose for any of those purposes:

(a) information so collected (regardless of the purpose for

which it was collected); and

(b) identification information generated by the NDLFRS.

Part 3

Authorising collection, use and disclosure of identification information

Division 2

Collection, use and disclosure of identification information by the

Department

Section 27

Identity Verification Services Bill 2023

No. , 2023

Division

2--Collection, use and disclosure of identification

information by the Department

27 Collection of identification information by the Department

General

(1) The Department may collect identification information (whether or

not it is sensitive information as defined in the

Privacy Act 1988

)

that relates to an individual from someone other than the

individual, if the collection:

(a) is for a purpose described in subsection (2); and

(b) is covered by subsection (3), (4) or (5).

Note:

One effect of this section is that such collection of identification

information is authorised for the purposes of provisions of Australian

Privacy Principle 3, such as paragraph 3.4(a) (about sensitive

information) and subparagraph 3.6(a)(ii) (about personal information).

Purpose of collection

(2) The purposes for which identification information may be collected

under this section (or used or disclosed under section 28) are as

follows:

(a) providing a DVS and FVS for the purpose of verifying the

identity of a person;

(b) providing an FVS or FIS for the purpose of protecting a

shielded person or someone else associated with such a

person;

providing those services, for the purpose mentioned in

paragraph (a) or (b) (as applicable);

(d) developing, operating or maintaining the NDLFRS.

Collection of DVS information via DVS hub

(3) This subsection covers collection of DVS information by means of

an electronic communication to the DVS hub requesting provision

of a DVS or responding to a request for provision of a DVS.

Authorising collection, use and disclosure of identification information

Part 3

Collection, use and disclosure of identification information by the Department

Division

Section 28

No. , 2023

Identity Verification Services Bill 2023

Collection of identification information via Face Matching Service

Hub

(4) This subsection covers collection of identification information by

means of an electronic communication to the Face Matching

Service Hub that:

(a) requests provision of an identity verification service; or

(b) responds to a request for provision of an identity verification

service; or

Collection of identification information via NDLFRS

(5) This subsection covers collection of identification information by

means of an electronic communication to the NDLFRS that:

(a) requests provision of an identity verification service; or

(b) supplies the information to a database in the NDLFRS.

This section does not authorise disclosure to the Department

(6) This section does not, by implication:

(a) authorise the disclosure of identification information to the

Department; or

(b) affect whether another provision of a law of the

Commonwealth or of a State or Territory providing for

collection of information authorises (by implication)

disclosure of that information to the person or body

authorised by that provision to collect it.

28 Use and disclosure of identification information by the

Department

(1) The Department may, for any purpose described in

subsection 27(2), use or disclose identification information:

(a) collected by means of an electronic communication to an

approved identity verification facility; or

(b) held in, or generated using, the NDLFRS.

Note:

One effect of this section is that such use or disclosure of

identification information by the Department is authorised for the

Part 3

Authorising collection, use and disclosure of identification information

Division 2

Collection, use and disclosure of identification information by the

Department

Section 28

Identity Verification Services Bill 2023

No. , 2023

purposes of provisions of Australian Privacy Principle 6, such as

paragraph 6.2(b) (use or disclosure of personal information authorised

by law).

(2) This section does not, by implication:

(a) authorise a person or body to collect identification

information disclosed by the Department under

subsection (1); or

(b) affect whether another provision of a law of the

Commonwealth or of a State or Territory providing for

disclosure of information authorises (by implication)

collection of that information by a person or body to which

the information is disclosed under that provision.

Protection of information

Part 4

Simplified outline

Division 1

Section 29

No. , 2023

Identity Verification Services Bill 2023

Part

4--Protection of information

Division

1--Simplified outline

29 Simplified outline of this Part

Current and former entrusted persons may commit an offence if

they record, disclose or access certain information connected with

an approved identity verification facility.

Basically, entrusted persons are the following:

(a) persons who work for the Department;

(b) contractors (and their officers and employees) engaged

to provide services to the Department in connection with

an approved identity verification facility.

There are exceptions for recording, disclosure or access authorised

by a law of the Commonwealth or of a State or Territory. The

exceptions include recording, disclosure or access:

(a) for the purposes of this Act; or

(b) in exercising powers, or performing functions or duties,

relating to an approved identity verification facility; or

threat to human life or health; or

(d) relating to the work of an IGIS official or Ombudsman

official; or

(e) with the consent of the person to whom the information

recorded, disclosed or accessed relates.

Part 4

Protection of information

Division 2

When protected information can be recorded, disclosed or accessed

Section 30

Identity Verification Services Bill 2023

No. , 2023

Division

2--When protected information can be recorded,

disclosed or accessed

30 Offences by entrusted persons

Offence for recording or disclosing information

(1) A person commits an offence if:

(a) the person is, or has been, an entrusted person; and

(b) the person has

obtained protected information in the person's

capacity as an entrusted person; and

(i) makes a record of the information; or

(ii) discloses the information to another person.

Note:

The fault element for the physical elements in paragraphs (a) and (b)

is recklessness: see section 5.6 of the

Criminal Code

Penalty: Imprisonment for 2 years.

Offence for accessing information

(2) A person commits an offence if:

(a) the person is an entrusted person; and

(b) the person accesses protected information.

Note:

The fault element for the physical elements in paragraph (a) is

recklessness: see section 5.6 of the

Criminal Code

Penalty: Imprisonment for 2 years.

Exceptions

(3) Each of the following is an exception to the prohibition in

subsection (1) or (2):

(a) the conduct is authorised by a law of the Commonwealth or

of a State or Territory;

(b) the conduct is in compliance with a requirement under a law

of the Commonwealth or of a State or Territory.

Protection of information

Part 4

When protected information can be recorded, disclosed or accessed

Division 2

Section 30

No. , 2023

Identity Verification Services Bill 2023

Note 1:

A defendant bears an evidential burden in relation to the matter in

subsection (3): see subsection 13.3(3) of the

Criminal Code

Note 2:

For paragraph (3)(a), see also sections 31 to 35 which authorise

conduct.

Definitions of

entrusted person

and

protected information

(4) In this Act:

entrusted person

means:

(a) the Secretary; or

(b) an APS employee in the Department; or

(i) an employee of an Agency (within the meaning of the

Public Service Act 1999

); or

(ii) an officer or employee of a State or Territory; or

(iii) an officer or employee of a government authority; or

(iv) an officer or employee of the government of a foreign

country; or

(v) an officer or employee of an authority of a foreign

country; or

(vi) an officer or employee of a public international

organisation (within the meaning of section 70.1 of the

Criminal Code

);

and whose services are made available to the Department; or

(d) a contractor engaged to provide services to the Department in

connection with an approved identity verification facility

(whether the contractor is engaged directly by the

Commonwealth or as a subcontractor); or

(e) an officer or employee of such a contractor whose duties

relate wholly or partly to an approved identity verification

facility.

protected information

means any of the following:

(a) identification information that was obtained by a person, in

the person's capacity as an entrusted person, from:

(i) an electronic communication to or from an approved

identity verification facility; or

Part 4

Protection of information

Division 2

When protected information can be recorded, disclosed or accessed

Section 31

Identity Verification Services Bill 2023

No. , 2023

(ii) the NDLFRS;

(b) information about either of the following:

(i) the making, content or addressing of an electronic

communication made to or from an approved identity

verification facility;

(ii) identification information relating to a particular

individual held in, or generated using, the NDLFRS;

that was obtained by a person, in the person's capacity as an

entrusted person;

verification facility and was obtained by a person, in the

person's capacity as an entrusted person.

31 Exercising powers, or performing functions or duties, as an

entrusted person

An entrusted person may make a record of, disclose or access

protected information if the record is made, or the information is

disclosed or accessed:

(a) for the purposes of this Act; or

(b) in the course of exercising powers, or performing functions

or duties, relating wholly or partly to an approved identity

verification facility.

32 Disclosure to lessen or prevent threat to life or health

(1) An entrusted person may disclose protected information if:

(a) the entrusted person reasonably believes that the disclosure is

necessary to lessen or prevent a serious and imminent threat

to the life or health of an individual; and

(b) the disclosure is for the purpose of lessening or preventing

that threat.

(2) An entrusted person may make a record of or access protected

information for the purpose of disclosing the protected information

under subsection (1).

Protection of information

Part 4

When protected information can be recorded, disclosed or accessed

Division 2

Section 33

No. , 2023

Identity Verification Services Bill 2023

33 Disclosure to IGIS official

(1) An entrusted person may disclose protected information to an IGIS

official for the purpose of the IGIS official exercising a power, or

performing a function or duty, as an IGIS official.

(2) An entrusted person may make a record of or access protected

information for the purpose of disclosing the protected information

under subsection (1).

34 Disclosure to Ombudsman official

(1) An entrusted person may disclose protected information to an

Ombudsman official for the purpose of the Ombudsman official

exercising a power, or performing a function or duty, as an

Ombudsman official.

(2) An entrusted person may make a record of or access protected

information for the purpose of disclosing the protected information

under subsection (1).

35 Disclosure etc. with consent

Consent of person to whom protected information relates

(1) An entrusted person may make a record of, disclose or access

protected information that relates to the affairs of a person if:

(a) the person has consented to the recording,

disclosure or

access; and

(b) the recording, disclosure or access is in accordance with that

consent.

Consent of jurisdiction responsible for NDLFRS protected

information

(2) An entrusted person may make a record of, disclose or access

protected information that was:

(a) held in, or generated using, NDLFRS; and

(b) supplied by an authority of a State or Territory;

if the authority consents to the recording, disclosure or access.

Miscellaneous

Part 5

Section 36

No. , 2023

Identity Verification Services Bill 2023

Part

5--Miscellaneous

36 Simplified outline of this Part

The Secretary may delegate

the Secretary's

powers and functions

under this Act.

The Secretary must publish certain documents relating to identity

verification services, including the intergovernmental agreement,

participation agreements, the NDLFRS hosting agreement and

documents setting out access policies.

The Information Commissioner is to assess the operation and

management of the approved identity verification facilities

annually.

Annual reports must be prepared and tabled in Parliament about

things done in connection with certain identity verification

services.

A review of the operation of this Act and the provision of identity

verification services must be started within 2 years. A report of the

review must be tabled in Parliament.

The Minister may make rules for the purposes of this Act,

including rules for fees.

37 No requirement for individuals to identify themselves

(1) To avoid doubt, this Act does not affect whether individuals have

the option of not identifying themselves, or of using pseudonyms,

when dealing with another person or body.

Note:

This Act does not affect the operation of Australian Privacy

Principle 2 (about anonymity and pseudonymity).

(2) Subsection (1) does not affect the circumstances in which an

identity verification service may be requested or provided.

Part 5

Miscellaneous

Section 38

Identity Verification Services Bill 2023

No. , 2023

Delegation of Secretary's powers

and functions under this Act

(1) The Secretary may, in writing, delegate all or any of the

Secretary's

powers or functions under this Act to an SES employee

or acting SES employee in the Department.

Note 1:

SES employee

and

acting SES employee

are defined in section 2B of

the

Acts

Interpretation Act 1901

Note 2:

Sections 34AA to 34A of the

Acts Interpretation Act 1901

contain

provisions relating to delegations.

(2) In performing a delegated function or exercising a delegated

power, the delegate must comply with any written directions of the

Secretary.

39 Publication of agreements and policies

(1)

The Secretary must publish on the Department's website a copy of

each of the following documents:

(a) the intergovernmental agreement;

(b) a participation agreement;

(d) an instrument that causes a person or body to become, or

cease to be, a party to a participation agreement or the

NDLFRS hosting agreement;

(e) a document that is approved by the Coordination Group

provided for by the intergovernmental agreement and sets out

an access policy for a service;

(f) a document varying, terminating or revoking a document

described in paragraph (a), (b), (c), (d) or (e).

(2) However, the copy need not include part of the document if the

Secretary considers that publication of the part:

(a) creates a risk to the security of identification information or

an approved identity verification facility; or

(b) unreasonably discloses personal information that relates to an

individual; or

described in paragraph (1)(e)

--creates a risk to Australia's

national security (within the meaning of the

National

Miscellaneous

Part 5

Section 40

No. , 2023

Identity Verification Services Bill 2023

Security Information (Criminal and Civil Proceedings) Act

2004

(3) If the Secretary publishes the copy without part of the document

because of subsection (2), the Secretary must publish on the

Department's website written reasons for not publishing the part,

except so far as publication of the reasons would create a risk

described in subsection (2) or unreasonably disclose personal

information.

40 Annual assessment by Information Commissioner

(1) The Information Commissioner has the function of doing both of

the following within 6 months of the end of each financial year

ending after the commencement of this section:

(a) assessing the operation and management of the approved

identity verification facilities by the Department in the

financial year;

(b) giving the Secretary a written report on the assessment.

(2) The Secretary must ensure that there is in place an arrangement

with the Information Commissioner for providing information to

the Information Commissioner for making assessments under

subsection (1).

(3) To avoid doubt, the arrangement may have been made before, or

be made on or after, the commencement of this section.

41 Annual reporting

(1) The Secretary must give the Minister a report including the

following information for each financial year ending after the

commencement of this section:

(a) statistics relating to all requests in the financial year, by or on

behalf of government authorities, for 1:1 matching services,

broken down by:

(i) requesting authority (identified by name); and

(ii) the service requested; and

(iii) requests in response to which there was provided either

information contained in, or associated with, a

Part 5

Miscellaneous

Section 41

Identity Verification Services Bill 2023

No. , 2023

government identification document, or an indication of

a match being the outcome of the comparison involved

in the service; and

(iv) requests in response to which there was provided neither

information contained in, or associated with, a

government identification document nor an indication of

a match being the outcome of the comparison involved

in the service;

(b) statistics relating to all requests in the financial year from

non-government entities for 1:1 matching services, including:

(i) the total number of those requests; and

(ii) the names of the non-government entities that made

those requests; and

(iii) the number of those requests the response to which was

that the requested comparison resulted in a match for an

individual; and

(iv) the number of those requests the response to which was

that the requested comparison did not result in a match

for an individual;

(i) the number of times that the service was used in the

year; and

(ii) whether the requests were endorsed as required by

section 17 or not;

(d) information about the accuracy of each system for biometric

comparison of facial images that is operated by:

(i) the Department; or

(ii) the Department administered by the Minister

administering the

Australian Passports Act 2005

;

for the purpose of providing identity verification services; or

(e) the following material relating to disclosures of identification

information that were made in the financial year and were

authorised by subsection 32(1) (about disclosures to lessen or

prevent threats to life or health):

(i) the total number of disclosures;

(ii) the number of individuals whose identification

information was disclosed;

Miscellaneous

Part 5

Section 41

No. , 2023

Identity Verification Services Bill 2023

(f) information about security incidents occurring in the

financial year in connection with one or more of the

approved identity verification facilities;

(g) information about actions taken in the financial year in

response to security incidents that occurred (in the financial

year or earlier) in connection with any of the approved

identity verification facilities;

(h) information about data breaches connected with the operation

of any of the approved identity verification facilities in the

financial year;

(i) information about actions taken in the financial year in

response to data breaches connected with the operation of

any of the approved identity verification facilities in the

financial year or earlier;

(j) information about termination or suspension in the financial

year of the ability of a party to a participation agreement or

the NDLFRS hosting agreement to request an identity

verification service because the party does not or did not

comply with the agreement or the access policy for the

service;

(k) any other information that:

(i) relates to the financial year and either an identity

verification service or the administration of this Act;

and

(ii) is required by the Minister.

(2) The report must not unreasonably disclose personal information

that relates to an individual.

Timing of annual report

(3) The Secretary must give the Minister the report as soon as

practicable after the end of the financial year and in any case

within 6 months after the end of the financial year.

Part 5

Miscellaneous

Section 42

Identity Verification Services Bill 2023

No. , 2023

Tabling of annual report

(4) The Minister must, subject to subsection (5), cause a copy of the

report to be tabled in each House of the Parliament within 15

sitting days of that House after the Minister receives the report.

(5) For the purposes of tabling the report, the Minister may make any

deletions from the report as the Minister considers necessary to

avoid prejudicing an investigation or compromising the operational

activities of a Commonwealth, State or Territory government

authority referred to in paragraph 17(1)(a).

42 Fees

(1) The rules may make provision relating to the imposition, collection

and recovery of fees for either or both of the following:

(a) connections to the approved identity verification facilities, to

allow the making of electronic communications to, and the

receipt of electronic communications from, those facilities;

(b) requests for identity verification services.

(2) A fee must not be such as to amount to taxation.

43 Review of operation of this Act and provision of identity

verification services

(1) The Minister must cause a review of the operation of this Act and

the provision of identity verification services to be started within 2

years of the commencement of this section.

(2) The Minister must cause a report of the review to be prepared and

given to the Minister.

(3) The Minister must cause a copy of the report to be tabled in each

House of the Parliament within 15 sitting days of that House after

the Minister receives the report.

44 Rules

(1) The Minister may, by legislative instrument, make rules

prescribing matters:

Miscellaneous

Part 5

Section 44

No. , 2023

Identity Verification Services Bill 2023

(a) required or permitted by this Act to be prescribed by the

rules; or

(b) necessary or convenient to be prescribed for carrying out or

giving effect to this Act.

(2) To avoid doubt, the rules may not do the following:

(a) create an offence or civil penalty;

(b) provide powers of:

(i) arrest or detention; or

(ii) entry, search or seizure;

(d) set an amount to be appropriated from the Consolidated

Revenue Fund under an appropriation in this Act;

(e) directly amend the text of this Act.

(3) Despite subsection 44(1) of the

Legislation Act 2003

, section 42

(disallowance) of that Act applies to the rules.

(4) Despite subsection 54(1) of the

Legislation Act 2003

, Part 4 of

Chapter 3 (sunsetting) of that Act applies to the rules.

Commonwealth of Australia Bills

IDENTITY VERIFICATION SERVICES BILL 2023