The government is set to make a number of privacy-focused amendments to its identity verification legislation after a whirlwind Senate inquiry process.
The Legal and Constitutional Affairs Legislation Committee, chaired by Labor Senator Nita Green, tabled its report into the Identity Verification Services (IVS) Bill 2023 and Identity Verification Services (Consequential Amendments) Bill 2023 last Thursday.
The two bills create a legislative framework to underpin the operation of the government’s identity verification services, which are used by government agencies and industry to compare or verify personal information on identity documents against existing government records such as passports or drivers licences.
It involves the Document Verification Services, which was used over 140 million times by about 2,700 government agencies and industry organisations in 2022, and the Face Verification Service, which was used 2.6 million times in 2022-23.
The Committee recommended a series of privacy-enhancing amendments to the bills and for an interim review into its effectiveness to be conducted after one year.
The Committee’s majority report recommended passing the bills if these amendments are made.
A dissenting report by Liberal Senator Paul Scarr labelled the process as “shambolic” and said he would not be supporting the bills in Parliament, while Greens Senator David Shoebridge said they should be delayed until the Privacy Act review is completed.
The recommendations
Most of the Committee’s recommendations centred on enhancing privacy protections around the scheme.
The existing bills outline that organisations requesting information from these services must be subject to the Australian Privacy Principles, that informed consent is required from the individual involved and places limitations on the “purpose for which information may be collected, used or disclosed”.
It also makes it an offence to “prevent unauthorised recording, disclosure or access to information by departmental officers”.
In its inquiry the Committee heard concerns that the government is rushing the legislation through as the identity checks are currently being conducted without any legislative foundation.
The Senate Committee recommended that amendments be introduced to provide a rule-making power to strengthen privacy safeguards, to include “identification information” in the definition of “personal information”, provide that a breach of an agreement under the scheme constitutes an interference with privacy under the Privacy Act and to ensure individuals are notified when there is a data breach that is likely to cause them serious harm.
The bills should also only include express consent rather than implied consent, and an interim review after 12 months should consider the development of a civil penalties framework within the scheme, the Committee said.
“The Committee acknowledges that there is a need to provide a legislative basis for the ongoing operation of the identity verification services which, as the Attorney-General’s Department highlighted, provide a critical capability to government and industry,” the report said.
“It is imperative that the IVS bill strikes an appropriate balance between the provision of identity verification services and the protection of individual privacy.”
No support from some quarters
A dissenting report, Senator Scarr criticised the “shambolic” legislative process and said he would not be supporting the bills, even with the recommended amendments.
“The Senate is now placed in the invidious position of having to balance the merits of introducing a legislative basis for identity verification services against the material concerns raised by expert stakeholders with respect to the adequacy of the proposed bills,” the dissenting report said.
“I cannot in good faith recommend the passage of the bills…I am not convinced that the recommendations provided by the majority report would be sufficient to address the material and significant concerns raised by a range of expert stakeholders. This is an entirely unsatisfactory situation.”
In additional comments, Senator Shoebridge said the “timing and content of the bill remains problematic”.
“The government is yet to provide a public rationale for why this bill must be rushed through Parliament,” he said.
“The most appropriate path forward is to defer this bill until the Parliament has seen the government’s legislative response to the Privacy Act review. This would allow the existing national verification services to be placed on a more solid and evaluated privacy basis where individual rights are appropriately respected.
“There is a very real concern that this bill is being so aggressively pursued by the government because it knows the existing regime is unlawful and subject to legal challenge.”
