The Australian Parliament has passed two significant pieces of legislation aimed at bolstering the security and privacy of identity verification services.

The Identity Verification Services Bill 2023 and the Identity Verification Services (Consequential Amendments), which were passed on 7 December 2023, are set to establish robust safeguards, oversight, compliance and transparency arrangements for services used by entities such as MyGovID, the Australian Tax Office, Centrelink, banks, and telecommunications providers.

The new laws mandate express consent for identity verification, annual reporting, and the publication of participation agreements. They also prohibit the Attorney-General's Department from using protected information for any purpose other than those outlined in the Bill.

Entities using the Face Verification Service are required to destroy facial images that are no longer needed, further enhancing privacy protections.

There are also additional compliance requirements against privacy standards. Non-compliance with these regulations can result in severe penalties, including suspension or termination of access to the services and civil penalties under the Privacy Act 1988 (Cth) and the Information Commissioner's regulatory function.

The legislation also underscores the importance of securing systems and databases. This includes the use of encryption and the requirement to report security breaches promptly.

Oversight of the operation of the services and the legislation will be maintained through an annual assessment by the Information Commissioner, two statutory reviews, data breach reporting, and authorised disclosures to Commonwealth integrity agencies.

In a statement, the Attorney-General, Hon Mark Dreyfus KC MP, stated the passage of these Bills ensures Australians can continue to benefit from the operation of the identity verification services while maintaining strong standards of privacy and security.