Note: Where available, the PDF/Word icon below is provided to view the complete and fully formatted document
Part 1—Preliminary

Part 1 Preliminary

Division 1 Preliminary

1   Short title

                   This Act is the Identity-matching Services Act 2019.

2   Commencement

             (1)  Each provision of this Act specified in column 1 of the table commences, or is taken to have commenced, in accordance with column 2 of the table. Any other statement in column 2 has effect according to its terms.

 

Commencement information

Column 1

Column 2

Column 3

Provisions

Commencement

Date/Details

1.  The whole of this Act

The day after this Act receives the Royal Assent.

 

Note:          This table relates only to the provisions of this Act as originally enacted. It will not be amended to deal with any later amendments of this Act.

             (2)  Any information in column 3 of the table is not part of this Act. Information may be inserted in this column, or information in it may be edited, in any published version of this Act.

3   Simplified outline of this Act

The Secretary of the Department may develop and operate:

       (a)     the interoperability hub, which relays electronic communications between bodies and persons requesting and providing identity-matching services; and

      (b)     the NDLFRS, which includes a database of identification information from State and Territory authorities and may be used to provide identity-matching services.

The Department may collect identification information through the interoperability hub or NDLFRS for any of the following purposes:

       (a)     providing or developing identity-matching services for identity or community protection activities;

      (b)     developing, operating or maintaining the NDLFRS;

       (c)     protecting the identities of persons who have legally assumed identities or are under witness protection.

The Department may use or disclose for any of those purposes information so collected (regardless of the purpose for which it was collected).

Generally, identity-matching services involve requests for electronic comparison of identification information about an individual to identify the individual, verify the individual’s identity, check whether the individual has more than one State or Territory government identification document of a particular kind, or manage identification information about the individual in the NDLFRS.

Identity or community protection activities mostly relate to identity-related fraud, law enforcement, proceeds of crime, security and safety.

Persons who work for the Department, and contractors whose duties relate to the interoperability hub or the NDLFRS, may commit an offence for unauthorised disclosure or recording of certain information held in, generated using or relating to the interoperability hub or the NDLFRS.

The Minister must report to Parliament annually on the use of most of the identity-matching services.

Division 2 Definitions

Subdivision A General definitions

4   Definitions

                   In this Act:

Australian Border Force has the same meaning as in the Australian Border Force Act 2015 .

electronic communication means a communication of information in the form of data, text or images by means of guided electromagnetic energy, unguided electromagnetic energy or both.

entrusted person has the meaning given by section 21.

facial image means a digital image of an individual’s face (whether or not including the shoulders).

FIS has the meaning given by section 8.

Note:          FIS is short for Face Identification Service, a term used in the intergovernmental agreement.

FRAUS has the meaning given by section 9.

Note:          FRAUS is short for Facial Recognition Analysis Utility Service, a term used in the intergovernmental agreement.

FVS has the meaning given by section 10.

Note:          FVS is short for Face Verification Service, a term used in the intergovernmental agreement.

government identification document means a document or other thing that:

                     (a)  contains identification information; and

                     (b)  can be used to identify an individual or to pass an individual off as someone else (whether living, dead, real or fictitious); and

                     (c)  is issued by or on behalf of an authority of the Commonwealth or an authority of a State or Territory.

identification information has the meaning given by section 5.

identity-matching service has the meaning given by section 7.

identity or community protection activity has the meaning given by section 6.

IDSS has the meaning given by section 11.

Note:          IDSS is short for Identity Data Sharing Service, a term used in the intergovernmental agreement.

intergovernmental agreement means the Intergovernmental Agreement on Identity Matching Services made on 5 October 2017 by the Commonwealth, the States, the Australian Capital Territory and the Northern Territory.

Note:          The intergovernmental agreement could in 2019 be viewed on the Council of Australian Governments website (https://www.coag.gov.au).

interoperability hub has the meaning given by section 14.

NDLFRS has the meaning given by section 15.

Note:          NDLFRS is short for National Driver Licence Facial Recognition Solution, a term used in the intergovernmental agreement.

non-government entity means a body, or person, other than:

                     (a)  the Commonwealth, a State or a Territory; and

                     (b)  an authority of the Commonwealth or of a State or Territory.

OPOLS has the meaning given by section 12.

Note:          OPOLS is short for One Person One Licence Service, a term used in the intergovernmental agreement.

personal information has the meaning given by section 6 of the Privacy Act 1988 .

protected information has the meaning given by section 21.

rules means rules made under section 30.

5   Definition of identification information

             (1)  Identification information about an individual (whether living, dead, real or fictitious) is any of the following:

                     (a)  a name by which the individual is or has been known;

                     (b)  a current or former address of the individual;

                     (c)  the place or date the individual was born;

                     (d)  the age of the individual (whether expressed by reference to a range or not);

                     (e)  the current or former sex, gender identity or intersex status of the individual;

                      (f)  information about whether the individual is alive or dead;

                     (g)  any information that is:

                              (i)  contained in a driver’s licence (however described) issued by or on behalf of an authority of a State or Territory in a name of the individual; or

                             (ii)  otherwise associated with the licence by the authority;

                     (h)  any information that is:

                              (i)  contained in any other licence (however described), or any document issued to assist the individual to prove his or her age or identity, that contains a photograph purporting to be of the individual and is issued by or on behalf of an authority of a State or Territory in a name of the individual; or

                             (ii)  otherwise associated with such a licence or document by or on behalf of the authority;

                      (i)  any information that is:

                              (i)  contained in a document issued to the individual, as a person who is not an Australian citizen, by the Department administered by the Minister administering the Migration Act 1958 to assist the individual to prove his or her identity; or

                             (ii)  otherwise associated with such a document by that Department;

                      (j)  any information that is:

                              (i)  contained in an Australian travel document (within the meaning of the Australian Passports Act 2005 ), or a foreign travel document (within the meaning of the Foreign Passports (Law Enforcement and Security) Act 2005 ), issued in the name of the individual; or

                             (ii)  otherwise associated with the Australian travel document by the Minister administering the Australian Passports Act 2005 or the Department administered by that Minister; or

                            (iii)  otherwise associated with the Australian travel document or foreign travel document by an authority of the Commonwealth or of a State or Territory by which the travel document may be inspected or seized under a law of the Commonwealth or of a State or Territory;

                     (k)  the individual’s current or former citizenship;

                      (l)  information about a visa the individual holds or held;

                    (m)  a facial image of the individual, a biometric template derived from such an image or a result of biometric comparison involving such an image;

                     (n)  any information that is prescribed by the rules and relates to the individual.

What is not identification information

             (2)  Despite subsection (1) but subject to subsection (3), the following is not identification information about an individual:

                     (a)  information or an opinion about the individual’s:

                              (i)  racial or ethnic origin; or

                             (ii)  political opinions; or

                            (iii)  membership of a political association; or

                            (iv)  religious beliefs or affiliations; or

                             (v)  philosophical beliefs; or

                            (vi)  membership of a professional or trade association; or

                           (vii)  membership of a trade union; or

                          (viii)  sexual orientation or practices; or

                            (ix)  criminal record;

                     (b)  health information (within the meaning of the Privacy Act 1988 ) about the individual;

                     (c)  genetic information about the individual.

             (3)  Subsection (2) does not prevent information described in any of paragraphs (1)(a) to (n) (inclusive) from being identification information if the information is not primarily of any of the kinds described in that subsection, even if information of any of those kinds can reasonably be inferred from the information.

Example 1: Even if an individual’s racial or ethnic origin can reasonably be inferred from his or her name or place of birth, this does not prevent his or her name or place of birth from being identification information.

Example 2: Even if an individual’s racial or ethnic origin or religious affiliations can reasonably be inferred from a facial image of the individual, this does not prevent the image from being identification information.

Prescribing extra kinds of identification information

             (4)  Before making rules prescribing information for the purposes of paragraph (1)(n), the Minister must:

                     (a)  be satisfied that the information:

                              (i)  can be used (alone or in conjunction with other information) to identify an individual; and

                             (ii)  is reasonably necessary to provide one or more identity-matching services; and

                            (iii)  assists one or more identity or community protection activities; and

                     (b)  consult the Human Rights Commissioner and the Information Commissioner.

6   Definition of identity or community protection activity

Identity or community protection activity

             (1)  An identity or community protection activity is an activity covered by subsection (2), (3), (4), (5), (6), (7) or (8).

Note:          Annual reports on requests for an FIS need to identify the activity described in one of those subsections for which the service was requested (see section 28).

Preventing and detecting identity fraud

             (2)  This subsection covers preventing and detecting identity-related fraud (including use of stolen or fraudulently obtained government identification documents or identification information from such documents).

Law enforcement activities

             (3)  This subsection covers the following activities:

                     (a)  preventing, detecting, investigating or prosecuting an offence against a law of the Commonwealth, a State or a Territory;

                     (b)  starting, conducting, or deciding whether to start or continue, proceedings under the Proceeds of Crime Act 2002 or a corresponding law within the meaning of that Act.

National security activities

             (4)  This subsection covers conducting an investigation, or gathering intelligence, relevant to Australia’s national security (within the meaning of the National Security Information (Criminal and Civil Proceedings) Act 2004 ).

Protective security activities

             (5)  This subsection covers promoting the security of an asset, facility, or person, associated with government, including by:

                     (a)  checking the security or criminal background of a person with access to such an asset or facility; or

                     (b)  protecting a person described in paragraph 17(2)(d) or (e) (about persons with legally assumed identities or under witness protection) or someone else associated with such a person.

Community safety activities

             (6)  This subsection covers promoting community safety, including by identifying:

                     (a)  an individual who has suffered, or is reasonably believed to be at risk of suffering, physical harm, including an individual who:

                              (i)  has been reported as missing; or

                             (ii)  has died or is reasonably believed to have died; or

                            (iii)  is affected, or is reasonably believed to have been affected, by disaster; or

                     (b)  an individual who is reasonably believed to be involved with a significant risk to public health or safety.

Road safety activities

             (7)  This subsection covers promoting road safety, including by promoting the integrity of driver licensing systems.

Verifying identity

             (8)  This subsection covers verifying the identity of an individual.

Subdivision B Definitions relating to identity-matching services

7   Definition of identity-matching service

             (1)  An identity-matching service is any of the following:

                     (a)  an FIS (see section 8);

                     (b)  an FRAUS (see section 9);

                     (c)  an FVS (see section 10);

                     (d)  an IDSS (see section 11);

                     (e)  an OPOLS (see section 12);

                      (f)  a service prescribed by the rules that:

                              (i)  involves the collection, use and disclosure of identification information; and

                             (ii)  involves the interoperability hub or the NDLFRS.

             (2)  The Minister may only make rules for the purposes of paragraph (1)(f) prescribing a service that involves a request, from a local government authority or non-government entity, relating to an individual if:

                     (a)  the purpose of the service is to verify the individual’s identity; and

                     (b)  the conditions in subsection (3) are met in relation to the local government authority or non-government entity.

Conditions on local government authority or non-government entity requesting identity-matching service

             (3)  The conditions are that:

                     (a)  verification of the individual’s identity is reasonably necessary for one or more of the functions or activities of the local government authority or non-government entity; and

                     (b)  the individual has given consent for the local government authority or non-government entity to use and disclose, for the purpose of verifying the individual’s identity, the identification information about the individual that is included in the request; and

                     (c)  the local government authority or non-government entity either:

                              (i)  carries on activities in Australia from premises in Australia; or

                             (ii)  resides in Australia; and

                     (d)  either:

                              (i)  the Privacy Act 1988 applies (with or without modifications prescribed by regulations under that Act) to the local government authority or non-government entity as an organisation (within the meaning of that Act); or

                             (ii)  the local government authority is bound by a law of a State or Territory, or has entered into a written agreement with the Department, that meets the requirements of subsection (4).

             (4)  For the purposes of subparagraph (3)(d)(ii), the law or agreement must provide for the following:

                     (a)  protection of personal information comparable to that provided by the Australian Privacy Principles;

                     (b)  monitoring of compliance with the law or agreement;

                     (c)  a means for an individual to seek recourse if his or her personal information is dealt with in a way contrary to the law or agreement.

Consulting before prescribing extra services

             (5)  Before making rules for the purposes of paragraph (1)(f), the Minister must consult the Human Rights Commissioner and the Information Commissioner about the proposed rules.

8   Definition of FIS

             (1)  A service is an FIS if:

                     (a)  the service involves electronically comparing:

                              (i)  a facial image of an individual, and other identification information (if any) about the individual, that is included in a request for the provision of the service made by an authority described in subsection (2); and

                             (ii)  identification information about one or more individuals that is contained in one or more government identification documents of one or more kinds specified in the request; and

                     (b)  the comparison is for the purpose of identifying the individual, or determining whether the individual has multiple identities, in the course of an identity or community protection activity covered by any of subsections 6(2) to (6) (inclusive); and

                     (c)  the request and the outcome of the comparison are communicated by electronic communications relayed through the interoperability hub.

Note:          FIS is short for Face Identification Service, a term used in the intergovernmental agreement.

             (2)  For the purposes of subparagraph (1)(a)(i), any of the following may request the provision of the service:

                     (a)  the Australian Border Force, so far as it is investigating, or involved in prosecuting, an offence against:

                              (i)  Part XIII of the Customs Act 1901 ; or

                             (ii)  the Crimes Act 1914 ; or

                            (iii)  the Criminal Code ; or

                            (iv)  the Environment Protection and Biodiversity Conservation Act 1999 ;

                     (b)  the Australian Commission for Law Enforcement Integrity;

                     (c)  the Australian Crime Commission;

                     (d)  the Australian Federal Police;

                     (e)  the Australian Security Intelligence Organisation;

                      (f)  a Department administered by a Minister administering any of the following Acts:

                              (i)  the Australian Citizenship Act 2007 ;

                             (ii)  the Australian Passports Act 2005 ;

                            (iii)  the Foreign Passports (Law Enforcement and Security) Act 2005 ;

                            (iv)  the Migration Act 1958 ;

                            so far as that Department is investigating, or involved in prosecuting, an offence against any of those Acts;

                     (g)  a police force of a State or Territory;

                     (h)  the Independent Commission Against Corruption established by the Independent Commission Against Corruption Act 1988 (NSW);

                      (i)  the Law Enforcement Conduct Commission established by the Law Enforcement Conduct Commission Act 2016 (NSW);

                      (j)  the New South Wales Crime Commission established by the Crime Commission Act 2012 (NSW);

                     (k)  the Independent Broad-based Anti-corruption Commission established by the Independent Broad-based Anti-corruption Commission Act 2011 (Vic.);

                      (l)  the Crime and Corruption Commission established by the Crime and Corruption Act 2001 (Qld);

                    (m)  the Corruption and Crime Commission established by the Corruption, Crime and Misconduct Act 2003 (WA);

                     (n)  the Independent Commissioner Against Corruption appointed under the Independent Commissioner Against Corruption Act 2012 (SA) or a member of the staff of that Commissioner;

                     (o)  the Integrity Commission established by the Integrity Commission Act 2009 (Tas.);

                     (p)  the Independent Commissioner Against Corruption appointed under the Independent Commissioner Against Corruption Act 2017 (NT) or a member of the staff of that Commissioner;

                     (q)  an authority prescribed by the rules.

             (3)  Before the Minister makes rules prescribing an authority for the purposes of paragraph (2)(q) the Minister must be satisfied that the authority has one or more of the functions that used to be functions of an authority described in any of paragraphs (2)(g) to (p) (inclusive).

9   Definition of FRAUS

                   A service is an FRAUS if:

                     (a)  the service involves electronically comparing:

                              (i)  a facial image of an individual that is included in a request for the provision of the service made by an authority of a State or Territory that has supplied identification information (directly or through an agent) to a database in the NDLFRS; and

                             (ii)  identification information about the individual that is included in a database in the NDLFRS and was supplied by the authority (directly or through an agent); and

                     (b)  the comparison is for the purpose of assessing the accuracy or quality of identification information held by the authority; and

                     (c)  the request and the outcome of the comparison are communicated by electronic communications made directly to and from the NDLFRS or relayed through the interoperability hub.

Note:          FRAUS is short for Facial Recognition Analysis Utility Service, a term used in the intergovernmental agreement.

10   Definition of FVS

             (1)  A service is an FVS if:

                     (a)  the service involves electronically comparing:

                              (i)  identification information about an individual that is included in a request for the provision of the service made by a body or person described in subsection (2); and

                             (ii)  identification information about the individual that is contained in a government identification document of a kind specified in the request; and

                     (b)  a facial image of the individual is included in the request or in a response to the request (or both), unless the response is that the identity of the individual cannot be verified from the identification information included in the request; and

                     (c)  the comparison is for the purpose of verifying the identity of the individual; and

                     (d)  the request and the outcome of the comparison are communicated by electronic communications relayed through the interoperability hub.

Note:          FVS is short for Face Verification Service, a term used in the intergovernmental agreement.

             (2)  For the purposes of subparagraph (1)(a)(i), the request for the provision of the service may be made by any of the following that may legally collect, use and disclose identification information that either is included in the request or might reasonably be expected to be disclosed in response to the request:

                     (a)  an authority of the Commonwealth;

                     (b)  an authority of a State or Territory other than a local government authority;

                     (c)  a local government authority that meets the conditions in subsection 7(3);

                     (d)  a non-government entity that meets the conditions in subsection 7(3).

11   Definition of IDSS

             (1)  An IDSS is a service (except one mentioned in subsection (2)) that involves a disclosure that:

                     (a)  is of identification information about an individual; and

                     (b)  is for the purpose of an identity or community protection activity; and

                     (c)  is by one authority of the Commonwealth or of a State or a Territory to another authority of the Commonwealth or of a State or a Territory; and

                     (d)  is by means of electronic communication relayed through the interoperability hub.

Note:          IDSS is short for Identity Data Sharing Service, a term used in the intergovernmental agreement.

             (2)  None of the following services is an IDSS:

                     (a)  an FIS;

                     (b)  an FRAUS;

                     (c)  an FVS;

                     (d)  an OPOLS.

12   Definition of OPOLS

                   A service is an OPOLS if:

                     (a)  the service involves electronically comparing:

                              (i)  a facial image of an individual, and any other identification information about the individual, that is included in a request for the provision of the service made by an authority of a State or Territory; and

                             (ii)  identification information in a database in the NDLFRS; and

                     (b)  the authority issues government identification documents of a particular kind and has supplied identification information (directly or through one or more agents) to a database in the NDLFRS; and

                     (c)  the comparison is for the purpose of determining whether the individual holds multiple government identification documents that are of that kind and have been issued by or on behalf of one or more authorities of one or more States or Territories; and

                     (d)  the request and the outcome of the comparison are communicated by electronic communications made directly to and from the NDLFRS or relayed through the interoperability hub.

Note:          OPOLS is short for One Person One Licence Service, a term used in the intergovernmental agreement.