face-matching service information; or

DVS information.

Definition of face-matching service information

a name by which the individual is or has been known;

a current or former address of the individual;

the place or date the individual was born;

the age of the individual (whether expressed by reference to a range or not);

the current or former sex, gender identity or intersex status of the individual;

information about whether the individual is alive or dead;

any information that is:

contained in a driver’s licence (however described) issued by or on behalf of an authority of a State or Territory in a name of the individual; or

otherwise associated with such a licence by such an authority;

any information that is:

contained in any document (however described) that is issued by or on behalf of an authority of a State or Territory in a name of the individual, contains a photograph purporting to be of the individual and can be used to assist in proving the individual’s identity; or

otherwise associated with such a document by the authority;

any information that is:

(i) contained in a document issued to the individual, as a person who is not an Australian citizen, by the Department administered by the Minister administering the Migration Act 1958 to assist the individual to prove the individual’s identity; or

otherwise associated with such a document by that Department;

any information that is:

(i) contained in an Australian travel document (within the meaning of the Australian Passports Act 2005) issued in a name of the individual; or

(ii) otherwise associated with the Australian travel document by the Minister administering the Australian Passports Act 2005 or the Department administered by that Minister; or

otherwise associated with the Australian travel document by a government authority by which the travel document may be inspected or seized under a law of the Commonwealth or of a State or Territory;

any information that is:

(i) contained in a foreign travel document (within the meaning of the Foreign Passports (Law Enforcement and Security) Act 2005) issued in a name of the individual; or

otherwise associated with the foreign travel document by a government authority by which the travel document may be inspected or seized under a law of the Commonwealth or of a State or Territory;

the individual’s current or former citizenship;

any information that is:

contained in a current or past application for Australian citizenship for the individual; or

contained in a document issued by an authority of the Commonwealth to provide evidence that the individual is or was an Australian citizen; or

(iii) otherwise associated with an application or document described in subparagraph (i) or (ii) by the Department administered by the Minister administering the Australian Citizenship Act 2007;

(n) information about a visa, or an entry permit under the Migration Act 1958, that the individual holds or held;

any information that is:

(i) contained in a current or past application for a visa, or entry permit, for the individual under the Migration Act 1958; or

contained in a visa, or entry permit, for the individual granted under that Act; or

otherwise associated with an application, visa or entry permit described in subparagraph (i) or (ii) by the Department administered by the Minister administering that Act;

a facial image of the individual, a biometric template derived from such an image or a result of biometric comparison involving such an image;

information about the outcome of a comparison involved in an FVS requested in relation to the individual.

Definition of DVS information

information (but not a facial image or biometric information) that either:

(i) is contained in a document (the specimen document) that relates to the individual and purports to be a DVS document of a particular kind; or

is, or is reasonably expected to be, associated, with a DVS document of a particular kind relating to the individual, by a government authority that is responsible for the issue of DVS documents of that kind;

and helps indicate whether the specimen document is a DVS document of that kind;

information about the outcome of a comparison involved in a DVS relating to the individual.

What is not face-matching service information or DVS information

information or an opinion that relates to the individual’s:

racial or ethnic origin; or

political opinions; or

membership of a political association; or

religious beliefs or affiliations; or

philosophical beliefs; or

membership of a professional or trade association; or

membership of a trade union; or

sexual orientation or practices; or

criminal record;

(b) health information (within the meaning of the Privacy Act 1988) that relates to the individual;

genetic information that relates to the individual.

deals with the requesting and provision of identity verification services of one or more kinds using identification information made available by the parties; and

meets the requirements in sections 9, 10, 11 and 12.

Timing and nature of agreement

an agreement may be a participation agreement whether it was made before, on or after the commencement of this section; and

different participation agreements may be made between the Department and different other parties; and

paragraph (1)(b) and sections 9, 10, 11 and 12 do not limit the matters a participation agreement may deal with.

(a) be subject to the Privacy Act 1988; or

be subject to a privacy law that:

is a law of a State or Territory; and

is prescribed by the rules for the purposes of this subparagraph; or

agree in the agreement to comply with the Australian Privacy Principles, with any modifications of subclauses 7.8 and 12.2 of those principles (about laws of the Commonwealth) specified in the agreement, as if the party were an APP entity; or

be a government authority prescribed by the rules for the purposes of this paragraph; or

(e) if the agreement deals only with the requesting of DVSs by, and provision of DVSs to, an authority of New Zealand or a person or body operating in New Zealand—be an authority, person or body subject to the Privacy Act 2020 of New Zealand.

privacy impact assessments of requesting identity verification services; and

the obtaining of an individual’s express consent to the collection, use and disclosure, for the purposes of requesting identity verification services, of identification information that relates to the individual included in such a request, unless:

the request is made by or on behalf of a government authority; and

(ii) collection, use and disclosure of that information for the purposes of protecting a shielded person, or someone else associated with a shielded person, are implicit in functions conferred by law on the authority; and

the provision, to an individual from whom such express consent is being sought, of information about matters described in subsection (3); and

each party to have arrangements for dealing with complaints by individuals whose identification information is held by the party; and

each party to the agreement (except the Department) to report to the Department on breaches of security that relate to the party and are relevant to a matter dealt with in the agreement; and

the Department to inform the Information Commissioner of a breach of security that:

is reported to the Department under a provision of the agreement covered by paragraph (e); and

is a data breach that is reasonably likely to result in serious harm to an individual whose identification information is involved in the breach; and

the Department to notify each party to the agreement that is relevant to, or impacted by, a data breach of which the Information Commissioner is informed under paragraph (f); and

each party notified under paragraph (g) of a data breach, that is impacted by that breach, to take reasonable steps to notify each individual to whom the identification information relates.

how the party seeking express consent uses identity verification services;

how any facial images of the individual collected by the party from the individual for requesting an identity verification service or from a response to a request for an identity verification service will be used and disposed of;

whether any such facial images will be retained or used for purposes other than those for which the identity verification service is to be requested;

what legal obligations the party seeking to collect the identification information has in relation to that collection;

what rights the individual has in relation to the collection of the identification information;

the consequences of the individual declining to consent;

where the individual can get information about making complaints relating to the collection, use and disclosure of the identification information for the purposes of requesting and provision of identity verification services;

where the individual can get information about the operation and management of the approved identity verification facilities by the Department in connection with the requesting and provision of identity verification services.

engaging in activities that would allow the party to create a data profile of the person whose identity is being verified (including where it would allow the person’s behaviour to be tracked (whether or not online));

offering to supply goods or services;

advertising or promoting goods or services;

enabling another person or entity to offer to supply goods or services;

enabling another person or entity to advertise or promote goods or services;

market research.

either:

to request a DVS or FVS for the purposes of verifying the identity of an individual; or

to request an FVS or FIS for the purposes of protecting a shielded person or someone else associated with such a person; and

to comply with the access policy for each service the party requests; and

not to use the outcome of an identity verification service the party requested in relation to an individual as the only evidence of the individual’s identity in criminal or civil proceedings to which the individual is a party.

not to disclose identification information received by the party as a result of an identity verification service the party requested, except:

as required by law; or

as permitted by law in circumstances specified in, or identified in accordance with, the agreement; and

if the identity verification service is an FVS—to take reasonable steps to destroy each facial image of an individual that is created, for the purposes of the request, by the party requesting the service, as soon as reasonably practicable after the image is no longer required for the purposes of the request, unless the image is:

(i) a Commonwealth record (within the meaning of the Archives Act 1983); or

required by a law of the Commonwealth, a State or a Territory, or by an order of a court or tribunal, to be retained; and

if the party is a government authority—not to permit an individual who is an officer, member of staff, employee or contractor of the party to:

make on behalf of the authority a request for an identity verification service that may result in a facial image being provided in response; or

deal with a facial image provided in response to such a request;

unless the individual has been trained in facial recognition and image comparison.

(a) a party to a participation agreement is subject to the Privacy Act 1988; and

an act or practice of the party, relating to personal information about an individual, does not comply with a requirement of:

the agreement in relation to a matter covered by section 9 or 10 (other than paragraph 10(1)(b)) of this Act; or

rules prescribed for the purposes of subsection 44(1A) of this Act.

an interference with the privacy of the individual; and

covered by sections 13, 13G and 13H of that Act.

is between the Department (representing the Commonwealth) and each authority that:

is an authority of a State or Territory; and

meets the requirement in subsection (2); and

supplies or proposes to supply identification information to the Department for inclusion in a database in the NDLFRS; and

deals with the NDLFRS and the collection, use and disclosure of identification information in a database in the NDLFRS; and

meets the requirements in subsections (3), (4) and (5).

State and Territory parties must be subject to privacy obligations

be subject to a privacy law that:

is a law of the State or Territory; and

is prescribed by the rules for the purposes of this subparagraph; or

(b) be one of the following to which the Privacy Act 1988 applies (with or without modifications) as if it were an organisation:

a State or Territory authority (as defined in that Act);

an instrumentality of a State or Territory; or

agree in the agreement to comply with the Australian Privacy Principles, with any modifications of subclauses 7.8 and 12.2 of those principles (about laws of the Commonwealth) specified in the agreement, as if the party were an APP entity.

Requirements on each State or Territory party

to take reasonable steps to inform each individual whose identification information is, or is to be, included in a database in the NDLFRS of that inclusion; and

to provide each individual whose identification information is included in a database in the NDLFRS with means of:

finding out what that information is; and

having any errors in that information corrected in the database; and

to inform each such individual and the Department of any data breaches that:

involve identification information that relates to the individual and the NDLFRS; and

are reasonably likely to result in serious harm to the individual; and

to provide means for dealing with complaints by individuals relating to the NDLFRS and identification information that relates to them that is included in a database in the NDLFRS; and

to report annually to the Department on the party’s compliance with the agreement.

Requirements on the Department

to maintain the security of identification information included in a database in the NDLFRS, including by encrypting the information; and

to inform the other parties to the agreement of any data breaches involving that information and the NDLFRS; and

to inform the Information Commissioner of any data breaches that:

involve that information and the NDLFRS; and

are reasonably likely to result in serious harm to an individual to whom that information relates.

Requirement relating to compliance

an agreement may be the NDLFRS hosting agreement whether it was made before, on or after the commencement of this section; and

paragraph (1)(c) and subsections (3), (4) and (5) do not limit the matters the agreement may deal with.

(a) it is, or is sought to be, provided on a request made by or on behalf of an authority, person or body (each the requesting party); and

the requesting party is a party to a participation agreement; and

the request includes DVS information, that relates to an individual (other than information described in paragraph 6(3)(b)), and to a specimen document purporting to be a DVS document that: is of a kind specified in the request; and is issued by a government authority that is or was responsible for the issue of DVS documents of that kind; and the service involves, or is to involve, an electronic comparison of the DVS information described in paragraph (c) and information that: (i) is contained in DVS documents of the kind specified in the request, or is associated with such documents by the government authority (the issuing authority) that is responsible for issuing them and is a party to a participation agreement; and is made available for the comparison by the issuing authority; and the comparison is carried out in accordance with any limitations, provided for under that participation agreement, subject to which the issuing authority made the information available for the comparison; and the purpose of the comparison is to help determine whether the specimen document is a DVS document of the kind identified in the request; and the response to the requesting party about the outcome of the comparison is limited to either: a statement that the information compared matched; or a statement that the information compared did not match, with or without reasons why the information did not match; and the request and the response to the request are communicated by electronic communications relayed through the DVS hub or the Face Matching Service Hub.

is of a kind specified in the request; and

is issued by a government authority that is or was responsible for the issue of DVS documents of that kind; and

the service involves, or is to involve, an electronic comparison of the DVS information described in paragraph (c) and information that:

(i) is contained in DVS documents of the kind specified in the request, or is associated with such documents by the government authority (the issuing authority) that is responsible for issuing them and is a party to a participation agreement; and

is made available for the comparison by the issuing authority; and

the comparison is carried out in accordance with any limitations, provided for under that participation agreement, subject to which the issuing authority made the information available for the comparison; and

the purpose of the comparison is to help determine whether the specimen document is a DVS document of the kind identified in the request; and

the response to the requesting party about the outcome of the comparison is limited to either:

a statement that the information compared matched; or

a statement that the information compared did not match, with or without reasons why the information did not match; and

the request and the response to the request are communicated by electronic communications relayed through the DVS hub or the Face Matching Service Hub.

paragraph (1)(b);

subparagraph (1)(d)(i), so far as it relates to the issuing authority being a party to a participation agreement;

paragraph (1)(e).

12 months; or

if the rules prescribe a longer period of up to 18 months for the purposes of this paragraph—that longer period.

Subdivision D—Definition of FIS

by any of the following officers of a Commonwealth, State or Territory government authority that is a party to a participation agreement:

(i) a law enforcement officer or intelligence officer (Crimes Act 1914);within the meaning of section 15K of the

(ii) an officer (however described) of an agency authorised under a corresponding assumed identity law (Crimes Act 1914);within the meaning of section 15K of the

(iii) an officer (however described) of an approved authority (within the meaning of the Witness Protection Act 1994) that is permitted to participate in the National Witness Protection Program under that Act, or a complementary witness protection law declared under section 3AA of that Act; and

if the officer is required to make the request for the purpose of protecting the identity of a shielded person or someone else associated with a shielded person.

Person making request

the head (however described) of the authority; or

a person who:

is the holder of a management office or position in the authority; and

is authorised, by notice in writing given to the Department, by that head to approve persons to make requests for FISs on behalf of the authority; and

is senior to the person making the request.

Request stating relevant activity

include a single facial image of an individual (whether or not other face-matching service information that relates to the individual is included); and

specify the kinds of government identification documents against which the face-matching service information in the request is to be compared, partly by reference to whether the authority by or on behalf of which the documents are issued is:

an authority of the Commonwealth; or

an authority of a specified State; or

an authority of a specified Territory.

Endorsement of request

endorsed by the head (however described) of the authority, or a person who:

is the holder of a management office or position in the authority; and

is authorised, by notice in writing given to the Department, by that head to endorse requests for FISs made on behalf of the authority; and

is senior to the person making the request; and

made by electronic communication to the Face Matching Service Hub.

protecting the shielded person, or associate, stated in the request; and

the performance of the authority’s functions.

a single facial image of an individual, and other face-matching service information (if any) that relates to the individual, that is included in the request for the service; and

face-matching service information that:

relates to one or more individuals; and

is contained in, or associated with, one or more government identification documents of one or more kinds specified in the request; and

(iii) is made available for the comparison by a government authority (the supplying authority) that is a party to a participation agreement.

face-matching service information that relates to the individual that is included in the request for the service; and

face-matching service information that:

is contained in, or associated with, a government identification document of a kind specified in the request that was issued to the individual; and

(ii) is made available for the comparison by a government authority (the supplying authority) that is a party to a participation agreement.

verifying the identity of the individual; or

protecting an individual who is a shielded person, or someone else associated with a shielded person.

is for a purpose described in subsection (2); and

is covered by subsection (3), (4) or (5).

Purpose of collection

providing a DVS and FVS for the purpose of verifying the identity of a person;

providing an FVS or FIS for the purpose of protecting a shielded person or someone else associated with such a person;

developing identity verification services, or facilities for providing those services, for the purpose mentioned in paragraph (a) or (b) (as applicable);

developing, operating or maintaining the NDLFRS.

Collection of DVS information via DVS hub

requests provision of an identity verification service; or

responds to a request for provision of an identity verification service; or

supplies the information to a database in the NDLFRS.

Collection of identification information via NDLFRS

requests provision of an identity verification service; or

supplies the information to a database in the NDLFRS.

This section does not authorise disclosure to the Department

authorise the disclosure of identification information to the Department; or

affect whether another provision of a law of the Commonwealth or of a State or Territory providing for collection of information authorises (by implication) disclosure of that information to the person or body authorised by that provision to collect it.

collected by means of an electronic communication to an approved identity verification facility; or

held in, or generated using, the NDLFRS.

authorise a person or body to collect identification information disclosed by the Department under subsection (1); or

affect whether another provision of a law of the Commonwealth or of a State or Territory providing for disclosure of information authorises (by implication) collection of that information by a person or body to which the information is disclosed under that provision.

the person is, or has been, an entrusted person; and

the person has obtained protected information in the person’s capacity as an entrusted person; and

the person:

makes a record of the information; or

discloses the information to another person.

Offence for accessing information

the person is an entrusted person; and

the person accesses protected information.

Exceptions

the conduct is authorised by a law of the Commonwealth or of a State or Territory;

the conduct is in compliance with a requirement under a law of the Commonwealth or of a State or Territory.

Definitions of entrusted person and protected information

the Secretary; or

an APS employee in the Department; or

a person who is:

(i) an employee of an Agency (within the meaning of the Public Service Act 1999); or

an officer or employee of a State or Territory; or

an officer or employee of a government authority; or

an officer or employee of the government of a foreign country; or

an officer or employee of an authority of a foreign country; or

(vi) an officer or employee of a public international organisation (Criminal Code);within the meaning of section 70.1 of the

and whose services are made available to the Department; or

a contractor engaged to provide services to the Department in connection with an approved identity verification facility (whether the contractor is engaged directly by the Commonwealth or as a subcontractor); or

an officer or employee of such a contractor whose duties relate wholly or partly to an approved identity verification facility.

protected information means any of the following:

identification information that was obtained by a person, in the person’s capacity as an entrusted person, from:

an electronic communication to or from an approved identity verification facility; or

the NDLFRS;

information about either of the following:

the making, content or addressing of an electronic communication made to or from an approved identity verification facility;

identification information relating to a particular individual held in, or generated using, the NDLFRS;

that was obtained by a person, in the person’s capacity as an entrusted person;

information that enables access to an approved identity verification facility and was obtained by a person, in the person’s capacity as an entrusted person.

the entrusted person reasonably believes that the disclosure is necessary to lessen or prevent a serious and imminent threat to the life or health of an individual; and

the disclosure is for the purpose of lessening or preventing that threat.

the disclosure is to any of the following persons:

(i) the Inspector-General of Intelligence and Security, or a person covered by subsection 32(1) of the Inspector-General of Intelligence and Security Act 1986;

(ii) the Commonwealth Ombudsman, or another officer (Ombudsman Act 1976);within the meaning of subsection 35(1) of the

(iii) the Information Commissioner, a member of the staff of the Office of the Information Commissioner, or a consultant engaged under the Australian Information Commissioner Act 2010;

(iv) the National Anti-Corruption Commissioner, or another staff member of the NACC (within the meaning of the National Anti-Corruption Commission Act 2022);

(v) the Inspector of the National Anti-Corruption Commission, or a person assisting the Inspector (within the meaning of the National Anti-Corruption Commission Act 2022); and

the disclosure is for the purpose of that person exercising a power, or performing a function or duty.

(a) the person has expressly consented to the recording, disclosure or access; and

the recording, disclosure or access is in accordance with that consent.

Consent of jurisdiction responsible for NDLFRS protected information

held in, or generated using, NDLFRS; and

supplied by an authority of a State or Territory;

if the authority expressly consents to the recording, disclosure or access.