Identity Verification Services (Consequential Amendments) Bill 2023 - Commentary on Ministerial Responses [2023] AUSStaCSBSD 214 (8 November 2023)

• Identity Verification Services (Consequential Amendments) Bill 2023101
• Significant matters in delegated legislation Privacy102
• Acting Attorney-General's response106
• Committee comment
• Privacy107
• Acting Attorney-General's response108
• Committee comment

---

Identity Verification Services (Consequential Amendments) Bill 2023^[101]

Purpose	The bill seeks to amend the Australian Passports Act 2005 to provide a legal basis for the minister to disclose personal information to share or match information relating to the identity of a person for the purpose of participating in one of the following information sharing and matching services: • the document verification service or the face verification service; or • any other service specified, or of a kind specified, in a ministerial determination.
Portfolio	Attorney-General
Introduced	House of Representatives on 13 September 2023
Bill status	Before the Senate

Significant matters in delegated legislation
Privacy^[102]

2.55 Item 3 of the bill seeks to insert proposed subsection 46(da) into the Australian Passports Act 2005 (the Act). Proposed subsection 46(da) provides that, on request, the minister may disclose personal information of a kind and to a person specified in a determination, for the purposes of participating in: (i) the Document Verification Service (DVS);^[103] (ii) the Face Verification Service (FVS);^[104] or (iii) any other service specified, or of a kind specified in the minister's determination; to share or match information relating to the identity of a person.

2.56 The committee notes that item 3 of the bill would expand the scope of this delegation of legislative power to also include the specification of services, or kinds of services, for which personal information may be disclosed.

2.57 In Scrutiny Digest 12 of 2023, the committee requested the Attorney-General's more detailed advice as to:

• why it is both necessary and appropriate to expand, via ministerial determination, the purposes for which personal information may be disclosed under section 46 of the Australian Passports Act 2005;

• whether high-level guidance about what can be included in a ministerial determination under proposed paragraph 46(d)(iii) and any considerations the minister must make before making such a determination can be provided on the face of the bill; and

• what safeguards are in place to protect the disclosure of personal information under proposed paragraph 46(da)(iii), including whether the safeguards and limitations which apply to the disclosure of personal information under proposed paragraphs 46(da)(i) and (ii) will also apply.^[105]

Acting Attorney-General's response^[106]

2.58 In relation to why it is necessary and appropriate to expand the purposes for which personal information may be disclosed by ministerial determination, the Acting Attorney-General advised that the approach taken in this bill is appropriate and consistent with the policy intent and operation of section 46 of the Australian Passports Act 2005. The Acting Attorney-General advised that this ensures detail and administrative matters associated with the disclosure of personal information is provided in the minister's determination and that when enacting the Australian Passports Act 2005, the Parliament considered section 46 to be appropriate and reasonable.

2.59 The Acting Attorney-General further advised that significant matters are set out in the primary legislation and that the kind of personal information that can be disclosed, who it can be disclosed to and for what purpose are appropriate to set out in a determination. The Acting Attorney-General explained that these matters are detailed in nature and will support the effective administration of the Australian Passports Act 2005.

2.60 The Acting Attorney-General also advised that the strong privacy safeguards provided in the Identity Verification Services Bill 2023 would provide further limitations on the disclosure of personal information by the minister in accordance with any such determination. In accordance with the Identity Verification Services Bill 2023, all entities accessing the identity verification services will be required to comply with the privacy safeguards given effect to through a participation agreement.

2.61 In relation to whether high-level guidance could be provided about what can be included in a ministerial determination under proposed paragraph 46(da)(iii) and any considerations the minister must make before making such a determination, the Acting Attorney-General advised that it is not necessary to include these matters in the bill. The Acting Attorney-General advised that it is intended to provide flexibility should the need arise for a new type of identity verification service to share or match information and any such service would operate in accordance with the legislative framework set out in the Identity Verification Services Bill 2023.

2.62 In relation to what safeguards are in place to protect disclosure of personal information under proposed paragraph 46(da)(iii), the Acting Attorney-General advised that the Identity Verification Services Bill 2023 includes strong privacy protections which will apply to all entities wishing to request identity verification through the identity verification services.

Committee comment

2.63 The committee thanks the Acting Attorney-General for this response.

2.64 While the committee considers that even if the approach in the bill is consistent with section 46 of the Australian Passports Act 2005, nevertheless the disclosure of personal information for the purposes of identity sharing or matching may be considered a significant matter. This is particularly so where the information sharing may be in relation to a service or a kind of service that is currently not known.

2.65 The committee notes the Acting Attorney-General's view that high-level guidance about what can be included in a ministerial determination under proposed paragraph 46(da)(iii) and any considerations the minister must make before making such a determination is not necessary. The committee considers that while flexibility may be helpful in managing technological advances, this does not negate the ability or utility of including further guidance in the bill or explanatory memorandum about what may be included or considerations the minister must take into account. The committee considers this to be particularly important given the privacy implications of listing new services or kinds of services in such a determination.

2.66 The committee notes that the Acting Attorney-General has advised that particular privacy safeguards in the Identity Verification Services Bill 2023 apply in relation to information disclosure under proposed subsection 46(da) of the bill. In response to the request for information about safeguards in place to protect disclosure of personal information under proposed paragraph 46(da)(iii), the committee notes the Acting Attorney-General's response indicated that the protections in the Identity Verification Services Bill 2023 apply. The committee considers it is unclear on the face of the bill that entities would be required to enter into a participation agreement for services other than the DVS or FVS. It is also unclear from the explanatory memorandum that these safeguards would apply to any other specified service or kind of service. If the intention is that the safeguards applicable for the DVS and FVS similarly apply for any service or kind of service entered into under proposed paragraph 46(da)(iii), the committee considers that it would be helpful if the bill clarified that these safeguards are available or, at a minimum, that the explanatory memorandum was updated to reflect this.

2.67 The committee requests that an addendum to the explanatory memorandum containing the key information provided by the Acting Attorney-General in relation to the privacy safeguards available for services or kinds of services that may be included under paragraph 46(da)(iii) be tabled in the Parliament as soon as practicable. The committee notes the importance of these explanatory materials as a point of access to understanding the law and, if needed, as extrinsic material to assist with interpretation (see section 15AB of the Acts Interpretation Act 1901).

2.68 The committee draws this matter to the attention of senators and leaves to the Senate as a whole the appropriateness of expanding the purposes for which personal information may be disclosed by ministerial determination, with limited high-level guidance as to what can be included in a ministerial determination and any considerations that must be taken into account before such a determination is made.

2.69 The committee draws this matter to the attention of the Senate Standing Committee for the Scrutiny of Delegated Legislation.

Privacy^[107]

2.70 Item 5 of schedule 1 to the bill provides that the proposed amendments to section 46 of the Act made by schedule 1 apply in relation to any personal information disclosed after the commencement of this item, whether the information was obtained before or after that commencement. This relates to information disclosed for the purpose of participating in either the DVS, FVS or any other service specified, or of a kind specified, in the minister's determination.

2.71 Further, proposed section 46A empowers the minister to arrange for the use of computer programs to disclose personal information about a person participating in either the DVS or FVS. Item 7 of schedule 1 to the bill provides that proposed section 46A applies in relation to any personal information disclosed after the commencement of this item, whether the information was obtained before or after that commencement.

2.72 While in this instance the amendments in items 5 and 7 apply in relation to any personal information disclosed after commencement, the committee considers that as these provisions relate to personal information obtained before commencement, it likely raises privacy concerns.

2.73 In Scrutiny Digest 12 of 2023, the committee requested the Attorney-General's advice as to whether it is appropriate for the bill to provide for the disclosure of personal information that was collected before the commencement of the bill, noting that information may be disclosed for purposes for which it was not initially collected for.

Acting Attorney-General's response^[108]

2.74 The Acting Attorney-General advised that items 5 and 7 are necessary to ensure that individuals can continue to use an Australian passport that was issued prior to the commencement of the bill when seeking to have their identity verified. If the disclosure of personal information is limited to information obtained after commencement of the bill, the Attorney-General advised that this will have serious and negative impacts on Australians and cause operational issues.

2.75 The Acting Attorney-General further advised that privacy safeguards and limitations in the Identity Verification Services Bill 2023 will ensure that any such disclosures are appropriate. In practice the disclosure of personal information on an Australian passport for identity verification purposes will occur in response to requests made with the relevant individual's consent.

Committee comment

2.76 The committee thanks the Acting Attorney-General for this response.

2.77 The committee notes the Acting Attorney-General's advice that while the information may be collected before the bill commenced, in practice the disclosure of personal information will only occur in response to requests made with an individual's consent.

2.78 In light of the information provided, the committee makes no further comment on this matter.

---

^[101] This entry can be cited as: Senate Standing Committee for the Scrutiny of Bills, Identity Verification Services (Consequential Amendments) Bill 2023, Scrutiny Digest 13 of 2023; [2023] AUSStaCSBSD 214.

^[102] Schedule 1, item 3, proposed paragraph 46(da)(iii). The committee draws senators' attention to these provisions pursuant to Senate standing order 24(1)(a)(i) and (iv).

^[103] The Document Verification Service provides 1:1 matching to verify biographic information (such as a name or date of birth), with consent, against government issued identity credentials.

^[104] The Face Verification Service provides 1:1 matching to verify biometric information, with consent, against a Commonwealth, state or territory issued identity credential (for example, a passport).

^[105] Senate Scrutiny of Bills Committee, Scrutiny Digest 12 of 2023 (18 October 2023) pp. 24–27.

^[106] The minister responded to the committee's comments in a letter dated 6 November 2023. A copy of the letter is available on the committee's website: see correspondence relating to Scrutiny Digest 13 of 2023 available at: http://www.aph.gov.au/senate_scrutiny_digest.

^[107] Schedule 1, item 5; schedule 1, item 6, proposed section 46A; schedule 1, item 7. The committee draws senators' attention to these provisions pursuant to Senate standing order 24(1)(a)(i).

^[108] The minister responded to the committee's comments in a letter dated 6 November 2023. A copy of the letter is available on the committee's website: see correspondence relating to Scrutiny Digest 13 of 2023 available at: http://www.aph.gov.au/senate_scrutiny_digest.