Michelle Ananda-Rajah (Higgins, Australian Labor Party) Share this | Link to this | Hansard source

There isn't an Australian from any walk of life who does not interact with the digital economy. Every Australian has an expectation that their data, personal information and identity will be protected. Identity verification services are a way of bolstering this protection, and this bill provides a clear legislative authority and framework to support this purpose. Identity verification can be achieved through one-to-one matching. This is when a person's face is paired with an identity document that they provide. We are all familiar with this process. Our drivers licenses are often used to match our face with our identity. This is a quick checkpoint that we often don't think twice about. When we replicate this simple step using digital devices, it safeguards our identity from cyberthreats. It is a way to combat identity theft, as an imposter will not be able to match their face to the photos on our identity documents.

There has never been a more important time to increase these safeguards. Last year there were over 16,000 reports of identity theft and losses totalling over $10 million. We must also consider that these crimes continue to be under-reported because people can find it difficult to navigate what can be a complex reporting process, particularly when emotions are running high. Other very public and consequential breaches in personal identity, such as the Medibank and Optus cyberattacks in the past year, have had an enormous and understandable impact on public confidence.

A constituent described how they were victim of a cybercrime at a law firm of which they were not even a client. He explained to me:

I am not a client of this firm, nor have I every provided them with my information. They have it, because businesses and organisations quite routinely transmit information and move data around without a second thought. The increased use of outsourcing and contracting out of services means our information is passed around without our consent or knowledge.

An experience like this is profoundly frightening. It shatters your sense of security. Our personal information is who we are; it is our selfhood. To have your information taken away from you leaves you exposed and vulnerable.

Another constituent, after experiencing a data breach of their personal information, said:

This exposes a lot of problems, among them, the amounts, and types of data we are providing, the degree to which data is transferred to third parties, the real risk of identity theft and financial loss, the inadequacy of redress schemes and compensation. I have spent a huge amount of time on this. I am severely stressed over this.

Australians should not be left to feel powerless by these threats. It is imperative that we have robust guardrails to fight identity fraud.

People need to know that they can rely on digital platforms and that they can rely on public and private organisations to have strong safeguards in place that protect their identity and personal information. That is what the Albanese government is committed to achieving, unlike those opposite who oversaw a decade of inaction and incompetence in this space, which led to the Medibank and Optus attacks. Their efforts can only be described as lazy attempts to address these issues, perfectly encapsulated by a bill in 2019 that was so heavily skewed towards government surveillance that it had to be withdrawn amid a public outcry.

Our bill is a step towards restoring public trust in government and confidence in the digital economy by making it safer for Australians to use online services. The Identity Verification Services Bill is about both recognising that digital identity services are the future and providing necessary safeguards to ensure Australians can embrace them with confidence and trust.

Identity verification is already being used successfully. Currently, there are more than 11.3 million Australians using the Australian government's digital ID verification service through the myGov ID platform, enabling them to securely access over 130 government agencies. Last year alone, the verification service was used over 140 million times by 2,700 government agencies and industry organisations. This uptake demonstrates these services are useful, convenient and wanted by consumers.

The bill allows one-to-one matching through Face Verification Services, whereby a person's photo is compared against the image on one of their identity documents. Last financial year, there were 2.6 million transactions completed through Face Verification Service transactions. It provides the safety and security of one-to-one matching but does not require people to attend in person for a physical check. It marries the convenience and accessibility of online services with the safety and security of matching a person's face to their ID.

This bill also supports the national drivers licence facial recognition solution by enabling the Face Verification Service to conduct one-to-one matching against drivers licences, helping more Australians create digital IDs and making the security and protections they provide even more accessible. An important part of creating a digital future that is secure and trusted is ensuring that people know when, how and why their identity or data is being used.

This bill mandates that a person's consent be required whenever a request is made for the purpose of verifying their identity. This must be informed consent and additional information must be readily provided. This is the norm in medicine. Understanding how your information is being used, when it will be retained and disposed of and what rights a person has with regard to the collection of this information will help us trust that our data is being used appropriately. This provision also ensures that agencies and companies must detail the consequences of a person declining the request for their data or identity verification, how a user can go about making a complaint and gain further information about the operation of approved identity verification facilities.

One-to-many face identification matching describes instances where a single face can be linked to multiple identities. This presents obvious risks, and it is no surprise that services utilising one-to-many matching have encountered instances of fraud in the past. By centralising the face identification service through the national drivers licence facial recognition solution, one-to-many matching will be all but eliminated. It's only to be used in very particular circumstances, such as to protect undercover officers and protected witnesses.

The bill imposes several important obligations on the department of the Attorney-General. As Australians rightly expect their government to take action to protect their privacy, the department will be mandated to use encryption and anything else necessary to maintain the security of electronic communications related to identity verification services and protect the information from unauthorised interference or access.

Transparency and accountability are central to this legislation. This is consistent with the Albanese government's agenda to restore integrity and trust in government. In that spirit, the bill requires the publication of agreements between public and private organisations to participate in services, mandatory annual assessments by the information commissioner, annual reporting, and statutory reviews every two years. These oversight measures are robust and comprehensive and can give Australians trust and confidence in these services.

Digital products are here to stay. They assist our lives in myriad ways. But for too many Australians they have meant compromising their privacy and personal information. The Albanese government is getting the work done to make sure Australians will no longer have to make that compromise. I commend this bill to the House.

Alicia Payne (Canberra, Australian Labor Party) Share this | Link to this | Hansard source

Before the debate is resumed on this bill, I advise the Federation Chamber that in the House it had been agreed that a general debate be allowed covering this bill and the Identity Verification Services (Consequential Amendments) Bill 2023. The question is that this bill be now read a second time.

Max Chandler-Mather (Griffith, Australian Greens) Share this | Link to this | Hansard source

The Identity Verification Services Bill 2023 allows identity matching across databases and across jurisdictions. This kind of matching is essential for many practices, including in relation to real estate and mortgage transactions and banking. Too often under current laws, consent, if asked for, is in the form of bundled consent, where consent is required in order to obtain an essential service. For instance, you need to consent to having this information shared to get a driver's licence, or potentially an Opal card or a transport card. That's not really a form of consent, because obviously accessing, for instance, a driver's licence is essential, and when you're asked to then provide so-called consent for handing over all your data and allowing it to be shared, in effect you're being blackmailed to provide that consent, and the Greens don't agree with that.

Many in the sector have, rightly, questioned why this bill is being brought to parliament now, before the comprehensive privacy laws that were promised at the last election and are known to be a key priority. These comprehensive privacy laws will provide a crucial layer of protection for Australians against abuses of power and misuses of data and will provide key pillars of protection of privacy when it comes to things like sharing data across jurisdictions. It's a fundamental problem with this proposal, which is why we will be moving an amendment relating to this.

Much of the matching in this bill is already occurring with a questionable legal basis. We have asked the government for a briefing on the specific aspect of the change. Clearly a legislated scheme is preferable so that controls and protections can be implemented. But this must be done to create a scheme that truly protects privacy and the rights of people to know what happens with their data. The bill requires compliance with standards set by the Privacy Act 1998 or similar state or territory laws. This is crucial, because this poses a real risk that the weakest applicable privacy protections may be chosen by participating parties with overall negative impacts on privacy protection.

These are just some of the reasons the Greens have referred this bill to the Senate Legal and Constitutional Affairs Committee for inquiry. Key issues raised in submissions to date are inconsistency between the scheme proposed here and the significantly more robust privacy protections under the draft digital ID bill and the delay in overarching privacy laws. The OAIC, which is the government's own agency relevant to these laws, provides eight key recommendations for amendments to the bill, indicating significant issues with the consultation process that led to this bill being brought before parliament. This is why the Greens will be moving an amendment that defers the consideration of this bill until after the Privacy Act reforms are in place. We believe this is crucial for any legislative change that provides for the sharing of data across jurisdictions, in particular when this bill includes concepts of bundled consent, which, as we have said, aren't really forms of consent when, for instance, to get access to a driver's licence you need to provide consent that jurisdictions can share your face, ID and other digital and private information.

I move the second reading amendment as circulated in my name:

That all words after "That" be omitted with a view to substituting the following words:

"the House declines to give the bill a second reading until the Privacy Act reforms are in place in recognition of the significant privacy and data implications of this proposal".

Alicia Payne (Canberra, Australian Labor Party) Share this | Link to this | Hansard source

Is the amendment seconded?

Stephen Bates (Brisbane, Australian Greens) Share this | Link to this | Hansard source

I second the amendment and reserve my right to speak.

Anne Stanley (Werriwa, Australian Labor Party) Share this | Link to this | Hansard source

I rise to make my contribution on the Identity Verification Services Bill 2023 and Identity Verification Services (Consequential Amendments) Bill 2023. Many Australians are familiar with verifying their identities, whether it be with a business or to access government services. Most wouldn't know that these verification processes rely on our national identity verification services provided by the Australian government, such as the Document Verification Service, DVS, and the Face Verification Service, FVS. These are a series of automated services that help businesses and government agencies verify personal identity by matching the information provided by existing government records. Last year alone, the DVS was used 140 million times, and in the 2022-23 financial year the FVS was used 2.6 million times.

The use of these systems includes common interactions we're all familiar with, from identifying our ID with our banks to verifying our identification when creating a myGovID, but these systems are also used in difficult times for Australians, helping government agencies verify people's identities and effectively deliver disaster relief and social security payments. The past few years have highlighted the importance of these systems, with a pandemic, bushfires and floods. Millions of Australians had to navigate various state and federal government services, from the myGov portal to Service NSW, in order to access social security payments and support when they needed it most.

In the background, the verification services underpin and support essential government services. These bills before the House today will ensure these systems have a clear legislative underpinning and are subject to robust privacy safeguards. They will authorise one-to-one matching for DVS, which allows the verification of biographic information, such as a name and date of birth, against government issued IDs. They will also authorise one-to-one matching through FVS, which will allow the matching of photographs with government issued IDs.

One-to-one matching will also be authorised through the National Driver Licence Facial Recognition Solution, which stores drivers licence data from across the country, enabling the use of FVS with license data. The states and territories that participate in the NDLFRS will be subject to the new privacy rules. The use of the NDLFRS to verify the identity of a person will be vital in helping more Australians create a stronger myGovID. A strong myGovID is necessary to access services such as Centrelink and the ATO through myGov. Without the NDLFRS, an Australian passport would be the only ID that could be used. We know more Australians have a drivers licence than a passport, so strengthening the privacy safeguards around the NDLFRS will give Australians that extra security and assurance that their license data is well protected and can be safely used to get the strong myGovID.

These bills will also limit the use of one-to-many matching by authorising its use for specific circumstances. It may only be used when protecting the identity of persons with a legally assumed identity, such as undercover officers or those in witness protection. There is a strong case for one-to-many matching for these individuals. One-to-many matching in these circumstances is necessary to ensure that the person's safety and security is not compromised by the intentional or unintentional exposure of their true identities. All other uses of one-to-many matching will be prohibited.

As we continue to rely on these identity verification services, we must ensure that there are strong privacy safeguards in place. Australians are becoming more and more conscious of their privacy, and they must be able to trust that their information is being used responsibly. This legislation will ensure these services are underpinned by strong privacy requirements. Private and public organisations that use the identity verification services to verify an individual's identity will be subject to the Privacy Act 1988 or a state or territory privacy law or have agreed to comply with the Australian Privacy Principles.

Requesting organisations must be a party to a participation agreement, which will contain minimum security standards and privacy obligations for the parties involved. This will require requesting organisations to provide a privacy impact assessment regarding the use of identity verification services, and organisations will require informed consent from individuals. 'Informed consent' means that an individual has been informed on how the information will be used, how facial images will be used and disposed of, whether those images will be retained or used for other purposes, the rights of an individual in relation to the collection of that information, the consequences of declining to consent, information about how to make a complaint and the legal obligations of the parties seeking that information.

Being a party to a participation agreement will prevent the disclosure of identification information obtained through the verification services and will be subject to extensive compliance requirements. Parties will be subjected to annual auditing to ensure that they are compliant with the agreement, and the outcomes must be reported to the department. Parties that breach their obligation under participation agreements may have their access and use of verification services suspended. Additionally, the department will be required to use encryption when identification information is being transferred to and from their databases.

To ensure that Australians can trust that their data is being protected, this legislation contains a number of measures to increase transparency and accountability in all these services. Participation agreements and relevant documents must be published. There will be mandatory annual assessments of the operation of verification services, and security instances and data breaches must also be reported. In the event of a data breach, the department will be required to inform the Information Commissioner of the breach if it may result in serious harm to an individual, in line with the obligations under the Privacy Act. Within two years of the commencement of this bill, a review of the operations and provisions of verification services must commence.

A division having been called in the House of Representatives—

Sitting suspended from 10 : 42 to 10 : 54

Public and private organisations regularly ask individuals for sensitive identification data to verify their identities, and individuals should be able to do so with confidence that these services are underpinned by strong transparency and accountability measures so that their data is subject to strong privacy safeguards. These bills will ensure that they can trust the Australian government's identification verification services and continue to access vital government and non-government services. I commend the bills to the House.

Keith Wolahan (Menzies, Liberal Party) Share this | Link to this | Hansard source

These two bills, the Identity Verification Services Bill 2023 and the Identity Verification Services (Consequential Amendments) Bill 2023, deal with identity verification. There are many studies that show there are enormous efficiencies for productivity, the economy and red tape to be had through this process. Where we disagree with the government is on the way that it has been done. There are many pages of ink being written about what happened on Saturday. I don't want to relitigate those here, but some of it is about not taking people with you. It's not simply the case that our democracy is about commanding the numbers and doing whatever you want. It can't be like that, and it isn't like that.

It is particularly important in this area because there is some legitimate concern in the community about how privacy is protected, particularly in the digital sphere. Once upon a time we would often think just about DNA or fingerprints. But all of us are walking fingerprints. When you link the prevalence of CCTV across just about every major city and village, every building and every suburb, we are walking facial fingerprints. How the government protects and deals with identity is of real concern to people. They're right to ask that we properly consider that. One of the things I've observed in this place—not just in this parliament but in any other parliaments—is that there is necessarily a technological lag with our understanding of technology and where it's going and our ability to react, compared to what's actually happening in the community. It's moving at a frightening pace. To have done the proper consultation here is important.

I want to give a personal example, something I experienced recently, about how well-intentioned digital verification efforts had real-life consequences for me. I'm not doing it to complain about what happened; I'm just giving it as an example. I had gone to my children's running club at a school. We do that, when parliament is not sitting here, every Tuesday and Friday. One of the joys of that—they're primary school students—is we have breakfast together and then I walk them over to school. We had done that, and I went to pay, and my card didn't work. I thought that was strange. I did another one. It didn't work. I looked at my internet banking, and they were all well over limit. I didn't understand why, but I knew I had to take my kids to school. I then called the bank and realised there was a long wait, so I had to get my brother to quickly come and take my kids to school. Again, I'm not complaining about that. When I eventually got through to the bank, what I found out was they wanted to talk to me about verifying my drivers license, and, to get my attention, they shut down all my banking, when I had kids to take to school. Again, I'm not complaining about me, but I have since learnt that that happened not just with my bank but with many other banks and many other people.

Jason Wood (La Trobe, Liberal Party, Shadow Minister for Community Safety, Migrant Services and Multicultural Affairs) Share this | Link to this | Hansard source

Name the bank; it's CBA.

Keith Wolahan (Menzies, Liberal Party) Share this | Link to this | Hansard source

I will. The two that I know of are NAB and CBA—there you go. They did that at a time when many people were exiting car parks and couldn't pay for them, with a huge queue behind them; many people, like me, were embarrassed in front of their friends and family at restaurants; many people had things to do. For the convenience of the bank, just to know what your ID was, even if you had been with them for decades, they could switch off your banking like that. They could disconnect you from your ability to be part of the economy. Very few people carry cash after COVID. There's even a push to get rid of cash. We make people vulnerable to that. So you can understand the suspicion that people will have with how their digital identification is used and the suspicion that they have with how vulnerable they are in the digital economy.

At the heart of this is trust. I don't want to relitigate the referendum, but those same banks donated millions of dollars to one side of a campaign that was out of whack with the same people whom they were shutting off from being able to pay for things. Perhaps those millions would have been better served (a) paying for Indigenous disadvantage directly and (b) having people on the call lines so that people who were struck in restaurants and shops, who were having bills cut off and who were stuck in carparks weren't waiting for an emergency call like that. There is a disconnect between the priorities of some of corporate Australia and the realities of what Australians are facing. We saw that on the weekend, and I hope they reflect on that.

When we combine those two issues of bringing people with you—not taking them for granted—and acknowledging their legitimate distrust in how the digital economy can be weaponised against them in the most significant way, where you cannot even pay for basics and you are humiliated in front of others on a large scale—I've had a significant amounts of calls on that—I think this is an example and a process that should be done much better. We have to respect the legitimate concerns of people, particularly when it comes to privacy and their digital identity, and that is one of the many lessons that should be learned from Saturday.

Michael McCormack (Riverina, National Party, Shadow Minister for International Development and the Pacific) Share this | Link to this | Hansard source

The two bills before us deal with identity verification. Identity verification is such that a person's identity is electronically confirmed by comparing a person's face or biographic details with existing records. I come to this place as somebody who ran the 2016 census. I don't want anybody to smile or laugh, but having been given not much notice before that census, I can remember the concerns then about identity theft. I can remember the concerns expressed by many senators and many members in opposition at the time about the whole process. I was assured that everything would be fine and, as we know, on the night the systems failed. But in the long run, a huge percentage—more than 94 per cent, as I recall—of answers were returned and it was, in the main, a successful census.

The census is important. Making sure someone is who they say they are is also very important. We oppose this legislation as, if you like, a holding position, because not enough information has been provided. It once again is legislation on the run by a government which came to office in May 2022 promising transparency and that they would be better than the last government at ensuring that everything was on the table. Yet, no one knew these particular bills were coming. There is no regulation impact analysis. Dare I say, there is no consultation, and this isn't good enough. It's simply not good enough. When I ran that census, I said at the time—and was ridiculed for it—that the large supermarket chains probably have more information on people than do the government agencies. That's probably true: anybody who has a loyalty card probably gives up so much information, they just don't realise it. I hark back—and perhaps I'll get frowns from the other side too for doing this—to the Australia Card. The famous—some might say infamous—Australia Card, was a proposal made in 1985 and abandoned in 1987. The proposal was made by the Hawke government. It was raised at the National Tax Summit, as I recall. Indeed, the proposal was put and defeated by the Senate, blocked by the upper house on a number of occasions. The former member for Hotham, Lewis Kent, absolutely pilloried the Australia Card.

There are probably three types of people in society. There are conspiracy theorists, who don't want anyone to have any information about them. There are those who, quite frankly, couldn't care less, who just go with the flow. And then there are those who think if you've got nothing to fear; you've got nothing to hide. I'm probably one of those who are halfway between the middle and 'nothing to fear, nothing to hide'. Because if you're not doing the wrong thing then you've probably got nothing to fear from somebody knowing what you're taking off the shelf and putting through the cash register, such as a government agency or if you've got a loyalty card.

Interestingly, the Australia Card brought about a double dissolution. The government went to the people and were re-elected. It was interesting that, following their re-election, the Labor government then came unstuck with the Australia Card because a retired public servant by the name of Ewart Smith noticed the there was a flaw in the drafting of the Australia Card legislation which no one, on either side, had ever picked up. Even if the bill had been passed in a joint sitting, certain regulations necessary for the functioning of the system could have been overturned by the Senate. This is an interesting point because questions are raised: what protections do we have for privacy? Privacy, to a lot of people, is very important.

Only on the weekend, and the day before yesterday, and again yesterday, I received a text message from, supposedly, myGov—'my g.o.v.' I looked at the text and thought, initially, it was a scam. When it came in the next day I thought, 'I'm not even going to open that.' Then I got a final notice. I still don't know what it is on my phone because I haven't opened it. I'm not game to, but I'm assuming it's a scam.

I will commend the Minister for Communications, opposite, the member for Greenway, for the work that she has done to stop scammers. She, in conjunction with, I believe, the Assistant Treasurer, the member for Whitlam, have continued the previous government's work in making sure there are rules and controls around finding scammers and bringing the full force of the law against those people; that is a very good thing.

But this particular legislation allows private companies to be involved in matching photo ID. There are potential security and privacy concerns around that. It allows for photo ID to be cross-checked with state and territory driving licences—previously it was only passport photos. As a former transport minister who, on many occasions, headed up the transport forum with the states—once when Warren Truss could not make a meeting and I was his assistant minister, and then on the occasions when I was the transport minister for three years and I headed that particular important forum—one of the things that I thought the state transport ministers and I were all as-one on was making sure that we had the best possible cross-matching rules when it came to drivers licences. If photo licences identification was one of those things then I was all for it. But you sometimes agree to those things and then state ministers go back to their various state cabinets and it will be knocked out. It was so hard. It is always so hard to get all the states to agree with the Commonwealth—I could almost end that sentence with 'all the states to agree'. But Labor has a chance to do some good things in that regard at the moment because all the mainland states are Labor. The Commonwealth should be able to get some good policy through transport and various other fora, because on the mainland they are all red states.

My point about that is that it would be a good thing if the states had been consulted. Apparently the states have not been consulted about photo ID being cross-checked with state and territory driving licences. The state government opinions are not clear regarding this, and the states haven't been properly consulted, and that is such a shame, if there is good legislation to be brought forward. And I'm not saying this is bad legislation. I'm just saying that the government came to office on the promise and the pretext that they would be more transparent, they claimed, than the previous government. I would argue that we, as a former coalition government, were very transparent.

At times there are policies that are brought forward in a rush; hence the pins-in-strawberries affair some years ago, when as a Commonwealth we acted very quickly to ensure in a bipartisan way that we stamped that out. There was an absolute rush, and the former home affairs minister, the member for McPherson, sitting in the chair, were very good in that regard as well as in regard to ensuring that identity theft was not an issue in this country. There are always going to be nefarious people. Many people think our jails are filled with criminals who are generally, you'd argue, blue-collar criminals. But white-collar criminals are probably just as bad, if not worse, because they can steal people's livelihoods, hopes and futures and indeed lead to loss of life. The work that you did, Deputy Speaker Andrews, in that regard, in your home affairs portfolio, was very much appreciated.

The way this legislation has come before the parliament is characteristic of the presumptuous approach that is the hallmark of the Albanese government. I don't like saying that, but it is the truth. And I would urge and encourage ministers to think about consultation with the opposition when bringing forward bills such as this, because there is a lot of experience on the opposition frontbench and, dare I say, backbench. And legislation such as this, while I appreciate that it will pass the lower house, because of sheer weight of numbers, is important.

I know that the communications minister comes to this place in good faith. I have a lot of regard for her, and that is not diminished. But when the views of states and territories are unclear, when the Attorney-General wants to rush legislation through the parliament, you do get a little bit suspicious—in fact, you get a lot suspicious. We know, for example, that the government tried to limit scrutiny of this legislation. Why? I do not know. With the Australia Card, I must admit, I didn't think at the time that it was such a bad thing to do. I know that even at election time and dare I say at referendum time there are so many people who do not have ID but should have, and the process at election time whereby people don't vote at all and claim they do, or vote multiple times—all that sort of thing—would potentially be avoided if people had a photo identification saying that they are who they say they are when it comes time to fill out those boxes.

We just saw that at last Saturday's referendum. When I was at the booth, and following that, people were complaining to me about either lack of transparency or the fact that certain things were said to them by the AEC that they didn't appreciate or didn't think was good enough. I have every faith in the AEC to do their job, but it is a big job, and people do need to have the proper identification to ensure that they are who they say they are. We can't be sure of the impact. As I said, with the National Taxation Summit leading to the Australia Card there was the situation whereby a public servant belled the cat when it came to the flaws within that particular legislation.

So, regarding these particular bills, I ask: what potentially may have been missed, given the rush to bring the legislation into the chamber and get it through to the Senate? What has been missed? What is the operational effect on businesses that use DVS daily? What are the wider implications for the Australian economy—an economy already crushed by the full weight of the cost-of-living crisis?

A division having been called in the House of Representatives—

Sitting suspended from 11:15 to 11:26

Principally, the coalition does not object to the ethos of this legislation, but we are concerned that the Senate committee apparently asked to not hold even a single hearing. Concerns have already been raised in submissions. There are far too many questions unanswered and too much uncertainty. We simply cannot, as an opposition, effectively just wave legislation such as this through.

Interestingly enough, this is based on coalition legislation. In fact, in 2018 we introduced the Identity-matching Services Bill and a related bill amending the Australian Passports Act, but we did the right thing: we referred the bills to the Parliamentary Joint Committee on Intelligence and Security for report. After the 2019 election, we reintroduced them and referred them again to the PJCIS. That's the way to do it. That's the proper process. But this government have been in power since May last year. The training wheels are off. The excuses should be over. They've been in long enough to stop blaming the coalition for everything, and they've been in long enough to ensure that important legislation such as this is given far more care and far more consideration and the opposition given far more due respect.

Aaron Violi (Casey, Liberal Party) Share this | Link to this | Hansard source

The Identity Verification Services Bill 2023 is a very important bill. There was something that the member for Riverina shared. I was sitting and listening to him and reflecting. It was a really important example of why this bill is so important and of the social licence and trust that we need to have when it comes to digital ID and to identification. He spoke about the Australia Card, and he gave a history of the challenges with that in the eighties. I sat and reflected while listening to him. I was very young when that debate was happening, so clearly I wasn't conscious of it at the time. But many years later, I'm aware of the Australia Card and the debacle that it was and the damage that it caused to digital and to identification and the challenges we have. That's why we have to be so careful in this space. It is challenging. It is complex. We need to balance efficiency—making sure we're talking to the right people—with, importantly, the need to protect people and make sure they don't get scammed.

As we continue to move into a digital world, there are great productivity gains and great opportunities that can be taken with digital, but there are increased risks. And it's not just the digital world that creates risk in terms of identification, which is why we need to get it right. The physical world creates risk as well. Just recently, I had an issue with some insurance and had to make a claim. I put the claim in and received a phone call from a number that I didn't know. They identified themselves as the insurance company, so everything seemed like it should be in order. Then they asked me for my name and my date of birth, and that's when I hesitated and took a second, and had a long conversation with them, saying, 'Hang on, if you're ringing me, why are you asking for my details?' I refused to give them and didn't get anywhere in the conversation. I still don't know whether that was a legitimate call from that organisation or whether it was a scam. In 2023, when people still don't know if it's a scam—and I agree with the member for Latrobe that it was most likely a scam. If it was, it was a good one, because the information had gone in and this was a couple of days later. The reason for the call was legitimate. That's the challenge we face. We need to find ways to make sure that digital identification is safe, accurate, efficient and can reduce those scams.

We can't lose the social licence. We can't lose the trust with the community. Unfortunately, we know that in the current environment more people than ever are concerned about their digital identity. They're aware more than ever about the data that's out in the world. Hacks like the Optus hack and the Medibank hack are making them more aware, more concerned. We need to acknowledge—and it's not a partisan issue; it's all governments—that there is a lack of trust in us as an institution, which we need to address. That's why this bill is really important. And it is disappointing and concerning that the government haven't engaged and consulted widely. It is complex. It has deep ramifications. While we definitely support the principle of what the government is trying to achieve, I urge them to let this continue into a committee stage, to look at this detail and understand the unintended consequences, because these are complex things.

The community needs to have faith in what we are doing, but industry needs to be brought to the table. When we're talking about technology and digital, it is complex. One of the biggest challenges we face with the digital economy—and this fits perfectly into the digital economy—is how we engage with an industry and a technology that are moving at a pace quicker than ever. It is not partisan; it is the system we work in, but it takes time to put through legislation and regulations. We need to get that balance right. But industry knows exactly what's happening. The digital economy will unlock significant productivity growth, which is so important for our country, particularly given the economic challenges that we face.

In 2019, the McKinsey Global Institute report Digital identification: a key to inclusive growth found that extending full digital identity coverage could unlock economic value equivalent to 3-13 per cent of GDP by 2030. A World Economic Forum analysis estimated that 70 per cent of new value created in the economy over the next decade is expected to be delivered by digitally enabled platforms. That's the opportunity that we have as a nation. and that the government has to work to unlock. We as an opposition have to support them where it's good legislation, and hold them to account to unlock that opportunity.

But, if we lose the social trust of the community, we won't be able to unlock that potential. That's some of the frustrations that I have with this bill—they're not consulting with the states and with industry. It's a continual trend and theme of this government not understanding the opportunities that we have in the digital and tech sector. Nothing shows that more than the government refusing to have a minister for the digital economy. There's not one minister in this government with sole responsibility for making sure that the digital economy and the opportunities—as this bill has—can be unlocked. This is another example—I think there are countless bills I've spoken on where I've used this example. It sits under many portfolios, as you'd expect, because, ultimately, everything in the modern world is digital. You need one minister leading the conversation and leading in this space. There is frustration in industry at the moment about the slow pace of rollouts of many things, including digital ID. I was speaking to a bunch of entrepreneurs and start-ups last week about AI, which links to this as well. There is significant—

Sitting suspended from 11 : 35 to 11 : 46

As I said, I was speaking to this group about AI, and there was a level of frustration about what they felt was a disconnect between the government and where policy was at. ChatGPT was the example. It's been in the spotlight. It's an issue they have been grappling with since November last year. They are still waiting for leadership and clarification on what they can do. So what they have to do in the meantime is work to the toughest standard around the globe, which is the European standard. That hurts innovation and productivity, but it's what they have to work with until they get certainty. They're investing hundreds of thousands of dollars, sometimes millions of dollars, in these technologies, particularly AI, without the certainty of where the regulation is going to be. They're caught in this really tricky place of needing to invest and wanting to invest but not knowing the legislative environment they're going to be investing in.

That's why we need to continue to close that gap between government, regulation and industry. It's one of the reasons I was proud to be a co-chair of the Parliamentary Friends of Tech and Innovation. We had our first event this morning, talking about AI. It was great to hear firsthand from industry about the opportunities, the challenges and some of the regulatory environments they're working in.

I've also called repeatedly for a technological assessment office, similar to the Parliamentary Budget Office, to give all MPs and all staff independent advice on technology and what's happening. This bill is an example of how that office could give some technical understanding to us of all of the consequences and the implications. We are never going to be experts. We can't be because it's moving so quickly. It's so dynamic. But, if we don't understand the challenges and the opportunities, the risk is we'll regulate too much and stop innovation and growth.

In conclusion, it may be that, once the committee has completed its review, we will support this. As I said, we do support the principle of this bill. At their heart, they are good ideas. It is important that we get this right. But it is, as I said, a missed opportunity, a failure to follow through and, ultimately, a botched process. Until these bills are scrutinised and we have that clarity about their scope and impact, it's not the sort of legislation that we can just wave through.

Jason Wood (La Trobe, Liberal Party, Shadow Minister for Community Safety, Migrant Services and Multicultural Affairs) Share this | Link to this | Hansard source

I will just be brief on the Identity Verification Services Bill 2023. I'll be speaking in my role as shadow minister for multicultural affairs and also for elderly people when it comes to the modern age of dealing with banks and insurance companies, as we've heard about before. I'd just go back to my days in the Victorian police force, where it was all about bouncing cheques in other people's names. It then moved to the next level, which was phone calls made to people's homes. I was on an inquiry a number of years ago, the serious and organised crime inquiry, and we went to many countries around the world. I think it was in Sweden where the big scam at the time was ringing up elderly people and getting their banking details over the phone. So I say to people, whether it be from the multicultural community or seniors, if anyone rings you up on the phone or you get an SMS don't assume it's the bank. Banks and insurance companies don't tell you to log on via an SMS and insert your banking details. It doesn't happen. Always go into your local bank or insurance company and speak to them, or hang up and ring their listed phone numbers.

I've heard of some very clever and outrageous scams where the person has actually gone to make the phone call, they have actually rung the phone number of the legitimate company, but somehow those involved in the organised crime had arranged it to be diverted to them. That makes life even tougher. But the clear message is: take precautions and always double-check.

I do acknowledge the government is bringing this bill forward for all the right reasons, and I thank the communications minister for that. The only concern on our side is that has been the process and doubling down in looking at that to make sure all those changes which could be made to protect Australians are made.

Michelle Rowland (Greenway, Australian Labor Party, Minister for Communications) Share this | Link to this | Hansard source

I thank my parliamentary colleagues for their contributions to the debate on the Identity Verification Services Bill 2023 and the Identity Verification Services (Consequential Amendments) Bill 2023. These bills are a priority for the Albanese government as they will enable Australians to conveniently and securely engage with the digital economy and access critical services while minimising risk of identity fraud and theft. The bills provide clear legislative authority for identity verification services with strong privacy safeguards and oversight and transparency arrangements. This supports industry, governments and Australians to benefit from the strong identity verification available through these services.

The bills will authorise consent based identity verification through two services: first, the Document Verification Service, where biographic information is verified; and second, the Face Verification Service, where biometric information such as a photograph is verified. Both the Document Verification Service and the Face Verification Service match a document or facial image to one record, known as one-to-one matching.

Participating public and private sector entities can request biographic or biometric verification of the details provided by their customers against records held by a document-issuing agency, such as the Department of Foreign Affairs and Trade as the issuer of passports.

As the credential most commonly used by Australians to verify their identity, drivers licences from all states and territories can be checked through the Document Verification Service. The Identity Verification Services Bill will expand the government's existing Face Verification Service to include images used in state and territory drivers licences, through the National Driver Licence Facial Recognition Solution. The Identity Verification Services Bill authorises limited government agencies to use one-to-one matching through the face identification service for the purpose of protecting the identity of persons with a legally assumed identity, such as undercover officers and protected witnesses. There is a substantial public interest in allowing one-to-one matching to be undertaken in these circumstances.

The other uses of one-to-one matching through the identity verification services will not be authorised and will therefore be prohibited. Importantly, the Identity Verification Services Bill contains strong privacy protections, safeguards and oversight measures. This includes the application of privacy laws and the Australian privacy principles, consent requirements, requirements to report data breaches and appropriate complaint-handling processes. The Identity Verification Services Bill authorises the collection, use and disclosure of identification information for limited purposes and includes offences to prevent unauthorised access to, recording of or disclosure of protected information.

The Identity Verification Services (Consequential Amendments) Bill 2023 will amend the Australian Passports Act 2005 to allow for automated disclosures of personal information to a specified person via the Document Verification Service or the Face Verification Service. This will enable the continued verification of identity using passports.

Throughout this debate, we have heard differing views on some aspects of the legislation. The government looks forward to receiving the report of the Senate Legal and Constitutional Affairs Legislation Committee on the bills and will consider any recommendations it may make, as well as issues raised by members in this debate. Australians need strong and secure identity verification services. The limits and safeguards in the bills strike the right balance between achieving fast and convenient identity verification without compromising on privacy. These bills demonstrate the government's commitment to the continued delivery of critical services and the protection of Australians from the threat of identity fraud and theft. I commend the bill to the House.

Karen Andrews (McPherson, Liberal Party) Share this | Link to this | Hansard source

The original question was that this bill be now read a second time. To this the honourable member for Griffith has moved an amendment that all words after 'That' be omitted with a view to substituting other words. The immediate question is that the amendment be agreed to.

Question unresolved.

As it is necessary to resolve this question to enable further questions to be considered in relation to this bill, in accordance with standing order 195 the bill will be returned to the House for further consideration.