Mark Dreyfus (Isaacs, Australian Labor Party, Cabinet Secretary) Share this | Hansard source

I move:

That this bill be now read a second time.

Secure and efficient identity verification that protects the privacy of Australians is vital to the digital economy. It ensures Australians can access the services they need without exposing them to identity crime.

Identity verification services, such as the Document Verification Service and Face Verification Service, are the only national capability that can be used by industry and government to securely verify the identity of their customers.

These automated services are provided by the Commonwealth and are used every day by government and industry to verify the personal information on a passport, drivers licence, birth certificate or other government issued credential.

In 2022 alone, the Document Verification Service was used over 140 million times by approximately 2,700 government agencies and industry organisations. In the 2022-23 financial year, there were approximately 2.6 million Face Verification Services transactions.

Today, there are more than 11.3 million myGovID accounts that people can use to authenticate their identity for government websites and services. All of these were created using the Document Verification Service, and one-third were verified using the Face Verification Service, which provides access to Centrelink, the Australian tax office and other critical services.

The significance of identity verification services to our day-to-day lives will continue to grow as technology advances and the uptake of digital IDs increases.

Legislative authority for identity verification services

The government is committed to supporting the effective ongoing operation of identity verification services, and ensuring they provide appropriate privacy protections and security safeguards.

The Identity Verification Services Bill 2023 will provide clear legislative authority to ensure the continued operation of identity verification services. It will limit the purposes for which requests can be made using the services, providing increased certainty and transparency for Australians about how the services can be used.

The bill will authorise 1:1 matching of identity through identity verification services. This means that an individual's identity can be verified through particular biometric information such as a photograph or biographic information being matched with an existing government record.

The bill will only authorise the use of 1:1 matching by public and private sector entities with consent of the relevant individual. This process will be enabled by the Document Verification Services and the Face Verification Services.

The National Driver Licence Facial Recognition Solution will also facilitate 1:1 matching identity services. This will enable the Face Verification Service to conduct 1:1 matching against driver licences and ensure more Australians can create digital IDs.

The bill will only authorise 1:many matching for a very limited purpose. The matching of identity through a 1:many service allows a facial image like a photograph to be matched against other facial images. The bill will authorise 1:many matching through the Face Identification Service for the very confined purpose of protecting the identity of persons with a legally assumed identity, such as undercover officers and protected witnesses. There is substantial public interest in allowing 1:many matching to be undertaken in these circumstances given the risks to such persons if their true identity is not appropriately protected.

All other uses of 1:many matching through identity verification services will be prohibited. Let me be clear—1:many matching will not be able to be conducted through identity verification services for law enforcement, intelligence gathering or community protection.

Privacy safeguards

The government will ensure identity verification services are subject to robust privacy safeguards. This will give the Australian community confidence that the government is protecting their personal information.

The bill requires organisations who make requests through identity verification services to be subject to the Privacy Act 1988 or a state or territory privacy law. Alternatively, they must agree to be bound by the Australian Privacy Principles. Privacy impact assessments must be undertaken.

Where requests are made for the purpose of verifying a person's identity, that person's consent will be required. This must be informed consent, and the requesting agency or organisation will need to provide extensive information about, among other things:

The bill will also require requesting agencies or organisations to have appropriate complaint-handling processes, and data breaches must be reported. The Notifiable Data Breach Scheme under the Privacy Act 1988and similar state and territory schemes will apply.

These protections will be implemented through participation agreements between the department and the requesting agencies or organisations, which can be suspended or terminated if terms are breached. These participation agreements will be made public, to ensure transparency.

Security and protection of information

The bill authorises the department to develop, operate and maintain identity verification facilities, and places a number of important obligations on the department to protect the privacy of individuals.

The department must:

The bill further protects the personal information of Australians by:

Transparency

The bill contains a number of additional transparency, accountability and oversight measures to ensure privacy standards are upheld. These include:

A statutory review of the bill will be required within two years of the commencement of the bill.

Conclusion

In conclusion, this bill will ensure the continued use of strong and secure identity verification, enhancing the privacy of Australians.

The bill meets public expectations that identity verification services have extensive privacy safeguards and effective oversight and transparency requirements.

The bill enables Australians to conveniently and securely engage with the digital economy and access critical services while minimising the risk of identity fraud and theft.

I commend this bill to the House.

Debate adjourned.

See this speech in context