Identity Verification Services (Consequential Amendments) Bill 2023 [2023] AUSStaCSBSD 184 (18 October 2023)

• Identity Verification Services (Consequential Amendments) Bill 202358

---

Identity Verification Services (Consequential Amendments) Bill 2023^[58]

Purpose	The bill seeks to amend the Australian Passports Act 2005 to provide a legal basis for the minister to disclose personal information to share or match information relating to the identity of a person for the purpose of participating in one of the following information sharing and matching services: • the document verification service or the face verification service; or • any other service specified, or of a kind specified, in a ministerial determination.
Portfolio	Attorney-General
Introduced	House of Representatives on 13 September 2023
Bill status	Before the House of Representatives

Significant matters in delegated legislation

Privacy90F^[59]

1.88 Item 3 of the bill seeks to insert proposed subsection 46(da) into the Australian Passports Act 2005 (the Act). Proposed paragraph 46(da) provides that, on request, the minister may disclose personal information of a kind and to a person specified in a determination, for the purposes of participating in: (i) the Document Verification Service (DVS);91F^[60] (ii) the Face Verification Service (FVS);92F^[61] or (iii) any other service specified, or of a kind specified in the minister's determination; to share or match information relating to the identity of a person.

1.89 The committee's consistent scrutiny view is that significant matters should be included within primary legislation unless a sound justification for the use of delegated legislation is provided. Specifying other services or kinds of services in a ministerial determination is one such matter. This is particularly so when, as in this case, the inclusion of such matters in delegated legislation has the potential to impact on a person’s right to privacy as it relates to the sharing or matching of information relating to the identity of a person.

1.90 In this instance, the explanatory memorandum explains:

New paragraph 46(da)(iii) is intended to provide flexibility for the Minister to specify new services or kinds of services that may be used to share or match information relating the identity of a person in a determination. This ensures that a new type of identity verification service could be included should there be a need to do so. As technology advances, new services may be required to support the secure and efficient matching or verification of identity. Consistent with section 57 of the Australian Passports Act, such a determination will be a legislative instrument.93F^[62]

1.91 In Scrutiny Digest 2 of 2018 and Scrutiny Digest 3 of 2018, the committee commented on the insertion of section 46 into the Act.94F^[63] At the time, the committee raised concerns that section 46 authorised the disclosure of personal information in broad terms in delegated rather than primary legislation.95F^[64]

1.92 The committee notes that item 3 of the bill is expanding the scope of this delegation of legislative power to also include the specification of services, or kinds of services, for which personal information may be disclosed.

1.93 The committee remains concerned that the scope of personal information that may be disclosed, the person to whom the information is disclosed, and now the purpose for which it will be disclosed, will be set out in delegated legislation rather than on the face of the bill. The committee notes that a legislative instrument, made by the executive, is not subject to the full range of parliamentary scrutiny inherent in seeking proposed changes in the form of an amending bill.

1.94 The committee is also concerned that there appears to be no constraints on the ability of the minister to determine any other services for the purposes of section 46 of the Act. It is unclear to the committee why at least high-level guidance in relation to these matters cannot be provided on the face of the bill.

1.95 Further, where a bill contains provisions for the use or disclosure of personal information, the committee expects the explanatory memorandum to the bill to address why it is appropriate and what safeguards are in place to protect the personal information. In this case, the statement of compatibility notes that some privacy safeguards exist in relation to the disclosure of personal information for the purposes of the DVS and FVS, but it does not explain what protections exist for other services or kinds of services that may be specified under proposed paragraph 46(da)(iii).96F^[65]

1.96 In light of the above, the committee requests the Attorney-General’s more detailed advice as to:

• why it is both necessary and appropriate to expand, via ministerial determination, the purposes for which personal information may be disclosed under section 46 of the Australian Passports Act 2005;

• whether high-level guidance about what can be included in a ministerial determination under proposed paragraph 46(d)(iii) and any considerations the minister must make before making such a determination can be provided on the face of the bill; and

• what safeguards are in place to protect the disclosure of personal information under proposed paragraph 46(da)(iii), including whether the safeguards and limitations which apply to the disclosure of personal information under proposed paragraphs 46(da)(i) and (ii) will also apply.

Privacy97F^[66]

1.97 Item 5 of schedule 1 to the bill provides that the proposed amendments to section 46 of the Act made by schedule 1 apply in relation to any personal information disclosed after the commencement of this item, whether the information was obtained before or after that commencement. This relates to information disclosed for the purpose of participating in either the DVS, FVS or any other service specified, or of a kind specified, in the minister’s determination.

1.98 Further, proposed section 46A empowers the minister to arrange for the use of computer programs to disclose personal information about a person participating in either the DVS or FVS. Item 7 of schedule 1 to the bill provides that proposed section 46A applies in relation to any personal information disclosed after the commencement of this item, whether the information was obtained before or after that commencement.

1.99 While in this instance the amendments in items 5 and 7 apply in relation to any personal information disclosed after commencement, the committee considers that as these provisions relate to personal information obtained before commencement, it likely raises privacy concerns.

1.100 The Australian Privacy Principles (APP) outline how particular entities can collect and manage personal information. One of the key principles is that, generally, an APP entity may use or disclose personal information for a purpose for which it was collected. It appears to the committee that the operation of the amendments in items 5 and 7 mean that the personal information of Australian citizens will be disclosed for purposes for which the relevant person did not initially consent.98F^[67]

1.101 In this case, the explanatory memorandum does not address the potential privacy implications of the application of amendments provisions in items 5 and 7 of the bill.

1.102 The committee’s privacy concerns are further heightened in this instance as proposed section 46A provides for the use of computer programs to disclose personal information. While the committee acknowledges the operational needs for the department to use computer programs, the committee considers it important that there are adequate transparency and accountability mechanisms over the operation of the identity verification facilities in order to protect an individual’s privacy.

1.103 In light of the above, the committee requests the Attorney-General's advice as to whether it is appropriate for the bill to provide for the disclosure of personal information that was collected before the commencement of the bill, noting that information may be disclosed for purposes for which it was not initially collected for.

---

^[58] This entry can be cited as: Senate Standing Committee for the Scrutiny of Bills, Identity Verification Services (Consequential Amendments) Bill 2023, Scrutiny Digest 12 of 2023; [2023] AUSStaCSBSD 184.

^[59] Schedule 1, item 3, proposed paragraph 46(da)(iii) and schedule 1, item 6, proposed section 46A. The committee draws senators' attention to these provisions pursuant to Senate standing order 24(1)(a)(i) and (iv).

^[60] The Document Verification Service provides 1:1 matching to verify biographic information (such as a name or date of birth), with consent, against government issued identity credentials.

^[61] The Face Verification Service provides 1:1 matching to verify biometric information, with consent, against a Commonwealth, state or territory issued identity credential (for example, a passport).

^[62] Explanatory memorandum, p. 61.

^[63] Section 46 was inserted into the Act by the Australian Passports Amendment (Identity-matching Services) Bill 2018.

^[64] Senate Standing Committee for the Scrutiny of Bills, Scrutiny Digest 2 of 2018 (14 February 2018) pp. 14–15; Scrutiny Digest 3 of 2018 (21 March 2018) pp. 65–68.

^[65] Statement of compatibility, pp. 16-17.

^[66] Schedule 1, item 5; schedule 1, item 6, proposed section 46A; schedule 1, item 7. The committee draws senators' attention to these provisions pursuant to Senate standing order 24(1)(a)(i).

^[67] See, for example, Office of the Australian Information Commissioner - Australian Privacy Principle 3: Collection of solicited personal information.