Michelle Ananda-Rajah (Higgins, Australian Labor Party) Share this | Hansard source

There isn't an Australian from any walk of life who does not interact with the digital economy. Every Australian has an expectation that their data, personal information and identity will be protected. Identity verification services are a way of bolstering this protection, and this bill provides a clear legislative authority and framework to support this purpose. Identity verification can be achieved through one-to-one matching. This is when a person's face is paired with an identity document that they provide. We are all familiar with this process. Our drivers licenses are often used to match our face with our identity. This is a quick checkpoint that we often don't think twice about. When we replicate this simple step using digital devices, it safeguards our identity from cyberthreats. It is a way to combat identity theft, as an imposter will not be able to match their face to the photos on our identity documents.

There has never been a more important time to increase these safeguards. Last year there were over 16,000 reports of identity theft and losses totalling over $10 million. We must also consider that these crimes continue to be under-reported because people can find it difficult to navigate what can be a complex reporting process, particularly when emotions are running high. Other very public and consequential breaches in personal identity, such as the Medibank and Optus cyberattacks in the past year, have had an enormous and understandable impact on public confidence.

A constituent described how they were victim of a cybercrime at a law firm of which they were not even a client. He explained to me:

I am not a client of this firm, nor have I every provided them with my information. They have it, because businesses and organisations quite routinely transmit information and move data around without a second thought. The increased use of outsourcing and contracting out of services means our information is passed around without our consent or knowledge.

An experience like this is profoundly frightening. It shatters your sense of security. Our personal information is who we are; it is our selfhood. To have your information taken away from you leaves you exposed and vulnerable.

Another constituent, after experiencing a data breach of their personal information, said:

This exposes a lot of problems, among them, the amounts, and types of data we are providing, the degree to which data is transferred to third parties, the real risk of identity theft and financial loss, the inadequacy of redress schemes and compensation. I have spent a huge amount of time on this. I am severely stressed over this.

Australians should not be left to feel powerless by these threats. It is imperative that we have robust guardrails to fight identity fraud.

People need to know that they can rely on digital platforms and that they can rely on public and private organisations to have strong safeguards in place that protect their identity and personal information. That is what the Albanese government is committed to achieving, unlike those opposite who oversaw a decade of inaction and incompetence in this space, which led to the Medibank and Optus attacks. Their efforts can only be described as lazy attempts to address these issues, perfectly encapsulated by a bill in 2019 that was so heavily skewed towards government surveillance that it had to be withdrawn amid a public outcry.

Our bill is a step towards restoring public trust in government and confidence in the digital economy by making it safer for Australians to use online services. The Identity Verification Services Bill is about both recognising that digital identity services are the future and providing necessary safeguards to ensure Australians can embrace them with confidence and trust.

Identity verification is already being used successfully. Currently, there are more than 11.3 million Australians using the Australian government's digital ID verification service through the myGov ID platform, enabling them to securely access over 130 government agencies. Last year alone, the verification service was used over 140 million times by 2,700 government agencies and industry organisations. This uptake demonstrates these services are useful, convenient and wanted by consumers.

The bill allows one-to-one matching through Face Verification Services, whereby a person's photo is compared against the image on one of their identity documents. Last financial year, there were 2.6 million transactions completed through Face Verification Service transactions. It provides the safety and security of one-to-one matching but does not require people to attend in person for a physical check. It marries the convenience and accessibility of online services with the safety and security of matching a person's face to their ID.

This bill also supports the national drivers licence facial recognition solution by enabling the Face Verification Service to conduct one-to-one matching against drivers licences, helping more Australians create digital IDs and making the security and protections they provide even more accessible. An important part of creating a digital future that is secure and trusted is ensuring that people know when, how and why their identity or data is being used.

This bill mandates that a person's consent be required whenever a request is made for the purpose of verifying their identity. This must be informed consent and additional information must be readily provided. This is the norm in medicine. Understanding how your information is being used, when it will be retained and disposed of and what rights a person has with regard to the collection of this information will help us trust that our data is being used appropriately. This provision also ensures that agencies and companies must detail the consequences of a person declining the request for their data or identity verification, how a user can go about making a complaint and gain further information about the operation of approved identity verification facilities.

One-to-many face identification matching describes instances where a single face can be linked to multiple identities. This presents obvious risks, and it is no surprise that services utilising one-to-many matching have encountered instances of fraud in the past. By centralising the face identification service through the national drivers licence facial recognition solution, one-to-many matching will be all but eliminated. It's only to be used in very particular circumstances, such as to protect undercover officers and protected witnesses.

The bill imposes several important obligations on the department of the Attorney-General. As Australians rightly expect their government to take action to protect their privacy, the department will be mandated to use encryption and anything else necessary to maintain the security of electronic communications related to identity verification services and protect the information from unauthorised interference or access.

Transparency and accountability are central to this legislation. This is consistent with the Albanese government's agenda to restore integrity and trust in government. In that spirit, the bill requires the publication of agreements between public and private organisations to participate in services, mandatory annual assessments by the information commissioner, annual reporting, and statutory reviews every two years. These oversight measures are robust and comprehensive and can give Australians trust and confidence in these services.

Digital products are here to stay. They assist our lives in myriad ways. But for too many Australians they have meant compromising their privacy and personal information. The Albanese government is getting the work done to make sure Australians will no longer have to make that compromise. I commend this bill to the House.

See this speech in context