The controversial identity verification services legislation has been approved by Parliament after the government made “very significant concessions” to the Opposition in the form of nearly 40 privacy-enhancing amendments.

The Identity Verification Services Bill 2023 was passed by the Senate on Wednesday night in the last sitting week of the year, after both the Opposition and Greens offered support following a number of changes.

The bill and the accompanying Consequential Amendments Bill were passed back down to the House of Representatives on Thursday and waived through.

The 38 approved government amendments are largely in line with recommendations made by the Legal and Constitutional Affairs Legislation Committee following its inquiry into the bill, and relate to improving privacy protections in the scheme. 

The passing of the bill means there will now be a legislative framework underpinning the operation of the Commonwealth’s identity verification services, which are already used by government agencies and industry to compare or verify personal information on identity documents against government records.

Despite having no clear legislative basis, these services are used widely, with the Document Verification Service used over 140 million times by about 2,700 government agencies and industry organisations in 2022, and the Face Verification Service used 2.6 million times in 2022-23.

The supported amendments include a requirement for “express consent” rather than merely “consent” for the use of an individual’s identity documents; alignment with the existing data breach scheme; a ban on the use of information captured in the scheme for data profiling, online tracking or marketing; for a review to be conducted into the laws after one year and to delay the start of its operative provisions for up to six months.

Shadow Attorney-General Michaelia Cash criticised the bill being “rushed into this place without warning” but welcomed the “very significant concessions” made by the government, and confirmed the Opposition would be supporting the bill in its new form. 

Greens Senator David Shoebridge said the changes made the legislation “passable” but said it was “far from perfect”.

The Senate inquiry heard major concerns that the government has been conducting these identity checks for several years without any legislative foundation.

“The conclusion that pretty much every stakeholder has drawn is that the current identity verification services procedure is unlawful and, in the absence of any statutory underpinning, is open to legal challenge,” Shoebridge said in the Senate.

He warned that the government was facing “potentially significant civil damages” that could be “aggravated by the fact that they continue to operate a service knowing full well that it is unlawful, and in breach of the privacy laws”. 

The Greens moved an amendment that would have prevented the collection of protected information for the purpose of identity verification, but this was voted down in the Senate, despite the government committing that this sort of data would not be collected.

“There should be clear legal constraints preventing critical information, which we’ve outlined in our amendments, ever being collected under this system, held by the government and distributed under this system,” Shoebridge said.

The bill is another go at the previous Coalition government’s facial recognition bill, which was rejected by the powerful national security committee and lapsed after the 2019 election.

The Labor government has significantly restricted the use of controversial one-to-many facial recognition matches, limiting their use to law enforcement attempting to identify undercover officers and protected witnesses. 

The federal government also recently introduced legislation to provide a legislative foundation and to expand its digital identity scheme, with a number of similar privacy concerns and protections.

Shoebridge said the digital ID scheme includes stronger privacy protections, and the two should be better aligned.

“One of the most extraordinary things about this little legislative venture from the Attorney-General was that, whilst the Identity Verification Services Bill 2023 was working through one track with very inadequate privacy protections in it—no doubt they would have been cutting-edge in 1983 but they don't cut the mustard in 2023—the draft Digital ID Bill

2023, which had substantially higher privacy protections, was going through under another minister,” he said.