The Bills Digest at a glance

Bills with similar purposes were introduced in 2018 and 2019 but lapsed with the dissolution of the House of Representatives in April 2019 and April 2022, respectively. The ‘Background’ section of the 2019 Digest provided an overview of issues around identity-matching, including aspects relevant to biometrics, facial recognition technologies, identity crime and national security.[1]

Key elements

The Identity Verification Services Bill 2023 (IVS Bill), as outlined in the Explanatory Memorandum, would:

authorise 1:1 matching of identity through the identity verification services, with consent of the relevant individual, by public and private sector entities. This will be enabled by:

• the Document Verification Service which provides 1:1 matching to verify biographic information (such as a name or date of birth), with consent, against government issued identification documents;
• the Face Verification Service which provides 1:1 matching to verify biometric information (in this case a photograph or facial image of an individual), with consent, against a Commonwealth, state or territory issued identification document (for example, passports and driver licences); and
• the National Driver Licence Facial Recognition Solution which enables the FVS to conduct 1:1 matching against State and Territory identification documents such as driver licences.

authorise 1:many matching services through the Face Identification Service [FIS] only for the purpose of protecting the identity of persons with a legally assumed identity, such as undercover officers and protected witnesses. The protection of legally assumed identities will also be supported by the use of the FVS. All other uses of 1:many matching through the identity verification services will not be authorised, and will therefore be prohibited.

authorise the responsible Commonwealth department – in this case the Attorney-General’s Department – to develop, operate and maintain the identity verification facilities (the DVS hub, the Face Matching Service Hub and the NDLFRS). These approved identity verification facilities will be used to provide the identity verification services. These facilities will relay electronic communications between persons and bodies for the purposes of requesting and providing identity verification services.[2] [emphasis added]

The Identity Verification Services (Consequential Amendments) Bill 2023 (Consequential Amendments Bill) comprises one Schedule of amendments to the Australian Passports Act 2005 (Passports Act) which would:

•    expand the circumstances in which the Minister may disclose personal information to include participation in the two identity verification services, or any future services that may be used to share or match information relating to the identity of a person and
•    provide for the use of computer programs in disclosing personal information to a person participating in the DVS or the FVS.

In this Bills Digest, the IVS Bill and the IVS (CA) Bill are referred to collectively as the IVS Bills.

Background

Societies are evolving from a world of physical transactions based on paper documents, credentials and identity, to one where transactions are primarily digital. At least since the late 2000s, policy makers have grappled with how to devise and implement the rules, procedures and technical components necessary for the establishment, use and exchange of digital identity information. The goal is a robust framework that facilitates access to public and private sector services and resources through digital identities that are securely managed and protected.[3]

Australian Government Digital Identity System

Under the auspices of the Council of Australian Governments (COAG), the 2012 National Identity Security Strategy established key principles to guide subsequent developments. Progress toward a Digital Identity (ID) system commenced in 2014 and is ongoing.[4] The IVS Bills and the Statutory Declarations Amendment Bill 2023 which is currently before the Senate are related to the Digital ID project, which is also referred to as the Australian Digital Identity System (AGDIS).

Identity matching/verification developments

In 2014, the Financial System Inquiry recommended a national identity strategy and improvements in the access to, use and protection of data.[5] In 2015 the Digital Identity project commenced with initial funding for a Trusted Digital Identity Framework (TDIF) released in 2016.[6]

In 2017, the Intergovernmental Agreement on Identity Matching Services (IGA) was released. The IGA ‘makes it easier for security and law enforcement agencies to identify people who are suspects or victims of terrorist or other criminal activity and prevent the use of fake or stolen identities’.[7] Implementing the IGA in legislation has been the purpose of Bills introduced in 2018 and 2019 (see next dot points) and of the current IVS Bills.

Previous Bills

In 2018 the Australian Passports Amendment (Identity-matching Services) Bill 2018 and the Identity-matching Services Bill 2018 (the 2018 Bills) were introduced into the House of Representatives.

The Senate Standing Committee for the Scrutiny of Bills (Scrutiny of Bills Committee) considered the 2018 Bills. Key areas of concern were the privacy implications of the Identity-matching Services Bill 2018, and the fact that a number of safeguards identified in the explanatory materials (and in the IGA) were not included in the Bill itself.[8] The Committee also took the view that ‘significant matters, such as authorising the disclosure of personal information, should be included in primary legislation rather than delegated legislation, unless a sound justification for the use of delegated legislation is provided’.[9]

The 2018 Bills did not proceed and lapsed with the dissolution of the 45th Parliament in April 2019.

Later that year, the Australian Passports Amendment (Identity-matching Services) Bill 2019 and Identity-matching Services Bill 2019 (the 2019 Bills) were introduced into the House of Representatives. The report on the 2019 Bills by the Scrutiny of Bills Committee reiterated comments by the Committee of the previous Parliament about the 2018 Bills.[10]

In October 2019 the Parliamentary Joint Committee on Intelligence and Security (PJCIS) published its Advisory report on the Identity-matching Services Bill 2019 and the Australian Passports Amendment (Identity-matching Services) Bill 2019. The report’s recommendation 1 was that the IMS Bill 2019 should be re-drafted to take into account the following principles:

the regime should be built around privacy, transparency and subject to robust safeguards,

the regime should be subject to Parliamentary oversight and reasonable, proportionate and transparent functionality,

the regime should be one that requires annual reporting on the use of the identity-matching services, and

the primary legislation should specifically require that there is a Participation Agreement that sets out the obligations of all parties participating in the identity-matching services in detail.[11]

The reasons for the PCJCIS’ criticism of the IMS Bill 2019 reportedly included disproportionate surveillance power given to the Department for Home Affairs, lack of detail, and concerns around the FIS due to lack of sufficient ‘safeguards to ensure appropriate governance, accountability and protection of the individual’s right to privacy’.[12]

Again, the 2019 Bills did not proceed and lapsed with the dissolution of the 46th Parliament in April 2022.

Further measures

In addition to the measures outlined above, the myGovID application, developed by the Australian Tax Office (ATO), and the Digital Transformation Agency was released on Android and iOS mobile platforms as a Digital Identity solution ‘to prove who you are online’ and ‘access participating government online services’.[13]

Released in January 2023 the report of the Critical national infrastructure: myGov user audit recommended that the Government ‘urgently legislate the digital identity framework and the safe use of one-to-one facial biometric matching’ and ‘pave the way for Australians to use driver licences to set up a ‘strong’ digital identity’.[14] The IVS Bills would partly address this recommendation by providing for the development of a National Drivers Licence Facial Recognition Solution (NDLFRS), which allows for the use of licenses alongside passports for biometric identity verification.

Consultation

In 2021 the exposure draft of the Trusted Digital Identity Bill was released for consultation. In addition, myGovID started a trial of face verification technology to allow users to achieve a ‘strong identity’ (IP3), through a live face-scan through the myGovID app, which compares the appearance of the user with their official passport photograph, in a one-to-one matching process.

Also published in September 2023 was the exposure draft of the Digital ID Bill 2023, which seeks to provide for a digital ID system for transactions with government and businesses. The AGDIS currently consists of Commonwealth entities, with the draft Bill providing that it would be extended to include state and territory governments (Phase 2) and private sector services (Phase 3), and eventually integrate private Digital ID solutions to access selected Commonwealth services (Phase 4).[15] By providing for support for approved identity verification facilities, the IVS Bills will form a part of the Digital ID ‘ecosystem’.

Making temporary measures permanent

In September 2023, the Government introduced the Statutory Declarations Amendment Bill 2023, which amends the Statutory Declarations Act 1959 to broaden the ways in which statutory declarations can be executed under Commonwealth Law, for example through electronic signatures and remote witnessing of documents. [16] In doing so, the Bill makes permanent in legislation a temporary measure that was introduced in the Coronavirus Economic Response Package (Modifications – Statutory Declarations and Notices of Intention to Marry) Determination 2021. The Statutory Declarations Amendment Bill 2023 would also introduces the option of digital execution of statutory declarations without witnessing, by using digital identity verification systems, such as MyGovID. As noted in the Explanatory Memorandum:

New section 9A provides that a statutory declaration will be valid where it is completed and signed through an approved online platform and where the identity of the declarant has been verified using an approved identity service.[17]

Among its provisions, the Statutory Declarations Amendment Bill 2023 also prescribes that the approved digital identity service be ‘an accredited entity under Trusted Digital Identity Framework (TDIF) and that both the online platform and identity provider operate within the Australian Government Digital ID System (AGDIS)’.[18] The IVS Bills relate to this initiative in that they will support approved identity verification facilities.

Intergovernmental Agreement on Identity Matching Services

As noted in the Explanatory Memorandum for the IVS Bills, the Intergovernmental Agreement on Identity Matching Services (IGA) implemented in 2017 is:

an agreement to promote the secure, automated, and accountable exchange of identity information, with robust privacy safeguards, for purposes including (but not limited to) preventing identity crime, protective security, and identity verification. The DVS, the FVS and the FIS are covered by the intergovernmental agreement.[19]

As explained in the Parliamentary Library’s Identity-matching Services Bill 2019 and Australian Passports Amendment (Identity-matching Services) Bill 2019 (the 2019 Digest), the IGA:

provides that each jurisdiction will preserve or introduce legislation as necessary, to support the collection, use and disclosure of facial images and related identity information between the parties.[20]

It appears that, to date, all six states have passed or created relevant legislation or regulations, and that the ACT and the NT are yet to do so (although the NT Government’s plans for Digital Government include an action item relevant to the use of facial recognition services in the licensing of drivers). As noted above, implementing the IGA in Commonwealth legislation was the stated purpose of the 2018 Bills and the 2019 Bills. It is also the purpose of the current IVS Bills.

Services proposed in the 2019 Bills but not in the IVS Bills

Several proposed services anticipated by the 2017 IGA[21] were included in the 2018 and 2019 identity-matching Bills,[22] but have been omitted from the IVS Bills. As indicated below, the PJCIS inquiry into the 2019 Bills noted strong criticism from the Australian Human Rights Commission (AHRC) in relation to two of the proposed services.

Facial Recognition Analysis Utility Service (FRAUS)

The Facial Recognition Analysis Utility Service (FRAUS) would have compared the facial image of an individual with identity documents supplied by a state/territory authority.[23] Rather than ascertaining (as in the FIS) or verifying (as in the FVS) the identity of a person, the purpose of this service was to assess the accuracy of personal identity information held by the relevant authority. The submission by the AHRC to the PJCIS inquiry into the 2019 Bills raised the concern that:

[the Bill] does not make clear precisely how the [FRAUS] would operate. In particular, it is not clear what information would be supplied in a response to a [FRAUS] request, and whether it might include information about more than one person. Those matters are not addressed in the secondary materials. The Commission submits that those matters should be clarified in the text of the Bill so that a full assessment of any privacy impacts can be made.[24]

One Person One Licence Service (OPOLS)

In the One Person One Licence service (OPOLS) a person’s facial image and other identification information would have been compared with information included in a NDLFRS database, for the purpose of determining whether the person holds multiple government identification documents.

Identity Data Sharing Service (IDSS)

An Identity Data Sharing Service (IDSS) would have a been a service (other than the FVS, FIS, FRAUS or OPOLS) which involved a disclosure between Commonwealth, state or territory authorities of a person’s identification information through the interoperability hub. The report of the PJCIS inquiry noted that:

The AHRC acknowledged the need for government to share personal information but stated that the Identity Data Sharing Service regime should not be passed in its current form. The AHRC noted that Identity Data Sharing Service ‘regime as drafted does not specify the circumstances in which disclosures may be made, nor the extent or types of information that may be disclosed’.[25]

Committee consideration

Senate Legal and Constitutional Affairs Legislation Committee

The Bill has been referred to the Senate Legal and Constitutional Affairs Legislation Committee for inquiry and the Committee will report by 9 November 2023. Details of the inquiry are at Identity Verification Services Bill 2023 and the Identity Verification Services (Consequential Amendments) Bill 2023. At the time of writing this Bills Digest the Committee had received 13 submissions.

Financial implications

The Explanatory Memorandum states that ‘the financial impact of the Bill is low’. The Bill provides for the charging of fees for requests for identity verification services.[26]

Statement of Compatibility with Human Rights

As required under Part 3 of the Human Rights (Parliamentary Scrutiny) Act 2011, the Government has assessed the Bill’s compatibility with the human rights and freedoms recognised or declared in the international instruments listed in section 3 of that Act. The Government considers that the Bill is compatible.[27]

Identity Verification Services Bill 2023

Clauses 4, 7, 23, 26, 29 and 36 provide informative simplified outlines of key parts of the IVS Bill. This section discusses the following aspects of the IVS Bills:

•    1:1 matching through identity verification services
•    1:many matching through the Face Identification Service (FIS)
•    Identity verification facilities (hubs)

1:1 matching through identity verification services

Document Verification Service (DVS) and the Face Verification Service (FVS) are 1:1 verification services.

Verification is the process of confirming a claimed identity. It answers the question: Are you who you claim you are? This process is called 1:1 match as the person already has his/her identity details (unlike identification process) and it needs to be verified by comparing with authenticate [sic] records. Unlocking your phone with registered fingerprints is a good example of identity verification or 1:1 match. The phone has to match the presented fingerprint just with the stored one, if it matches, identity gets verified.[28]

Document Verification Service (DVS)

Predating the IGA, the DVS has been operational in the public sector since 2009, with private sector access to the DVS since May 2014.[29] As explained on the www.idmatch.gov.au website:

The Document Verification Service (DVS) checks whether the biographic information on your identity document matches the original record. The result will simply be ‘yes’ or ‘no’. The DVS does not check facial images.[30]

As explained by the Explanatory Memorandum for the IVS Bill:

113. DVS is defined in clause 15 of the Bill. The DVS, also known as the Document Verification Service, is a 1:1 matching service that performs biographic verification (such as verifying a date of birth) of identification information contained in an identity credential against a particular government record. The DVS is one of the identity verification services that operates via the DVS hub, which is one of the approved identity verification facilities supported by the Bill.[31] [emphasis added]

DVS document[32] and DVS information[33] are defined in the Bill. As the DVS already exists and is operational, one intended purpose of the IVS Bill is to facilitate the DVS by authorising the Attorney-General’s Department to develop, operate and maintain the DVS hub as one of three approved identity verification facilities, the other two being the Face Matching Service Hub and the National Driver Licence Facial Recognition Solution (NDLFRS). All three are discussed below.

Face Verification Service (FVS)

As explained by the Explanatory Memorandum for the IVS Bill:

[T]he Face Verification Service (FVS) … provides 1:1 matching to verify of [sic] biometric information (in this case a photograph of an individual), with consent, against a Commonwealth, state or territory issued identity credential (for example, passports and driver licences) …[34]

The www.idmatch.gov.au website notes that the FVS can check information on passports, citizenship certificates and visas, and states that ‘the FVS can currently only be used by government agencies [and] in future, some local government and private sector organisations will be able use the FVS, but only with your consent.[35]

1:many matching through the Face Identification Service

The www.idmatch.gov.au website notes that the Face Identification Service (FIS) can currently check information on citizenship certificates and visas, and ‘compares a person’s photo with other photos held in government records to identify them’. There are limitations, which the website outlines as follows. The FIS:

can only be used by national security, law enforcement and anti-corruption agencies under limited circumstances.

can't be used to investigate offences or conduct live facial recognition of people in public places (or what some people call mass surveillance).

Local government and private sector organisations will not have access to the FIS.

All FIS responses will be reviewed by a person specifically trained in facial recognition and image comparison, to help protect against the possibility of false matches—an identity decision will never be made by the technology alone.[36]

The Explanatory Memorandum for the Bill states that FIS requests will be limited to protect privacy:

The FIS is a 1:many matching service. The Bill will only authorise the use of the FIS by officers from a limited group of Commonwealth, State and Territory agencies for the purpose of protecting the identity of shielded persons and their associates. Shielded persons are defined in clause 5 and, generally speaking, include those persons who have been authorised to acquire or use an assumed identity (for example, an undercover police officer) under law, including the Crimes Act1914 (Cth) and Witness Protection Act1994 (Cth). The Bill does not authorise the FIS to be used for any other purposes, which limits any impact on the right to privacy.[37] [emphasis added]

This statement is supported by various provisions, including paragraph 17(1)(b). Who constitutes an associate of a shielded person is not further defined.

FIS Reporting

The agencies eligible to use the FIS – as requesting authorities which are parties to participation agreements – are those which require assumed identities for operational work or witness protection under the auspice of the Crimes Act 1914 or Witness Protection Act 1994.[38] This includes state and federal law enforcement agencies as well as intelligence agencies such as ASIO and ASIS.

The Explanatory Memorandum outlines that use of the FIS will be monitored via an annual report to the Minister under clause 41. This report ‘must include information on the number of times the FIS was used each financial year and whether the requests were endorsed as required by subclause 17(5)’.[39] The annual report provided for in the IVS Bill appears to be separate to existing mechanisms for annual reporting on and oversight of the use of assumed identities and any compliance issues. Under subclause 41(5), the Minister can also make deletions to the report in circumstances where the Minister considers it ‘necessary to avoid prejudicing an investigation or compromising the operational activities of a Commonwealth, State or Territory government authority’ prior to tabling the report in parliament.[40]

Currently, ASIO and ASIS report their use of assumed identities to the Inspector General of Intelligence and Security (IGIS), as provided for in section 15LE of the Crimes Act. For federal law enforcement agencies using assumed identities, the Crimes Act provides for annual reporting to the Minister administering the National Anti-Corruption Commission Act 2022. It is not clear if there will be any reporting to IGIS or the National Anti-Corruption Commission (NACC) Minister in relation to the use of the FIS, either in terms of numbers or potential breaches. While IGIS does have own motion powers, the IVS Bill does not appear to provide for centralised oversight of both the use of assumed identities and the use of the FIS to protect such shielded persons and their associates in either intelligence or law enforcement agencies. Existing reporting and oversight mechanisms may also be subject to change if the Intelligence Services Legislation Amendment Bill 2023 which was introduced into the House of Representatives on 22 June 2023, is passed.

Identity verification facilities (hubs)

One of the objects of the IVS Bill is to authorise the Department to develop, operate and maintain three approved identity verification facilities: the DVS hub; the Face Matching Service Hub; and the National Driver Licence Facial Recognition Solution (NDLFRS) (paragraph 3(a)). The Explanatory Memorandum states:

… These [identity verification] facilities are technical components that enable the operation of the identity verification services. They support the secure communication of requests and the outcome of those requests between those organisations making a request and data holding agencies.

In developing, operating and maintaining the facilities, the Department will be required to maintain the security of electronic communications to and from the facilities, including by encrypting the information and protecting the information from unauthorized interference or access.[41]

The Explanatory Memorandum further states that, under clause 24:

the technological solution for the DVS hub and Face Matching Services [sic] Hub could be combined but they could still be maintained as separate identity verification facilities for the purposes of this Bill.[42]

DVS hub

The www.idmatch.gov.au website notes that:

The DVS hub transmits matching requests containing biographic information on your identity documents from organisations that use the DVS.

The DVS accesses driver licence information from the National Exchange of Vehicle and Driver Information System (NEVDIS). This is a separate system operated by Austroads Limited on behalf of all states and territories.[43]

Face Matching Service Hub

The Face Matching Service Hub (FMS hub)[44] does not currently exist but would be created by the IVS Bill (clause 24). As outlined by the Explanatory Memorandum:

The FMS hub operates as a router by which requesting entities may request services, via the Department, from agencies holding data. The agencies holding the data respond to requests via a return through the FMS hub.[45]

It appears the FMS hub would be more expansive than the current interoperability hub. According to the www.idmatch.gov.au website:

A separate interoperability hub transmits matching requests containing your facial image and biographic information from agencies that use the FVS and FIS.[46]

However, in contrast to the current interoperability hub, in addition to the FVS (paragraph 19(e)) and the FIS (paragraph 16(d)), the FMS hub would also support the DVS (paragraph 15(1)(h)) and would supply information to the NDLFRS (subclause 27(4)). According to the Explanatory Memorandum:

Face-matching service information is defined in subclause 6(2) of the Bill. The definition is exhaustive and explicitly defined in this subclause to provide certainty and avoid the need to refer to definitions contained in other Acts. The definition includes information about an individual such as name, current or former address, place of birth, date of birth, age, sex, gender identity and whether a person is alive or dead. The definition also includes information contained in certain identity documents, such as a driver’s licence, passport or visa. It also includes a facial image or biometric template derived from such an image.[47]

National Driver Licence Facial Recognition Solution (NDLFRS)

The www.idmatch.gov.au website states:

To support the FVS and FIS, state and territory road agencies will gradually come on board to provide us with copies of your driver licence photos and related identity information. These are stored in the National Driver Licence Facial Recognition Solution (NDLFRS).

The Department of Home Affairs manages this system on behalf of all states and territories. The NDFLRS centrally stores biometric templates created from facial images provided by states and territories. Each road agency retains complete control over the facial images and other identity information associated with their driver licences. … In the initial phases of building the NDLFRS, only the state or territory that uploaded the data will have access to it. This means that driver licence images are not yet available through the FVS or FIS.[48]

Discussing the definition of NDLFRS in clause 5, the Explanatory Memorandum states:

The NDLFRS means a system that is developed, operated and maintained by the Secretary under Part 2 of the Bill and consists of two elements:

a database of identification information that is contained in, or associated with, government identification documents issued by (or on behalf of) an authority of a state or territory and is supplied by (or on behalf of) the authority to the Department by electronic communication for inclusion in in the database, and

and [sic] a system for biometric comparison of facial images with facial images that are in that database.

The primary purpose of the NDLFRS is to create an electronic centralised repository of State and Territory driver’s licence information (including the individual’s photo, date of birth and address) and information associated with driver’s licences (for example, whether a licence has been reported as lost or stolen). The NDLFRS can access facial images in the repository, subject to the approval of the government authority responsible for the identity credential, to create biometric templates that are used for biometric comparison. A biometric template is a mathematical representation of a facial image that cannot be used to recreate the facial image. A biometric template is a type of face matching service information that is used by the FVS and the FIS.[49]

The Explanatory Memorandum outlines how the IVS Bill would expand the utility of the NDLFRS:

… 1:1 matching of identity through the identity verification services, with consent of the relevant individual, for transactions with public and private sector entities … will be enabled by … the National Driver Licence Facial Recognition Solution (NDLFRS) which enables the FVS to conduct matching against State and Territory credentials such as driver licences.[50]

Without the NDLFRS, only persons with an Australian Passport, which accounts for approximately 50 per cent of the population, would be able to create a ‘strong’ MyGovID and access critical services.[51]

Clause 13 provides that all states and territories that upload, or intend to upload, driver licence data to the NDLFRS are required to be a party to the NDLFRS hosting agreement.

Consequential Amendments Bill

The Identity Verification Services (Consequential Amendments) Bill 2023 (Consequential Amendments Bill) amends the Australian Passports Act 2005 (Passports Act).

Identity-matching capability

Currently, section 46 of the Passports Act provides that the Minister for Foreign Affairs may disclose personal information for specified purposes including law enforcement, confirming or verifying information about a passport applicant or facilitating a person’s international travel.[52]

Disclosure is limited to the types of information and persons specified by the Minister under the Australian Passports Determination 2015, and this is dependent on the particular purpose of disclosure.[53] There are currently three classes of information which may be disclosed (though not in all circumstances):

•    data page information, which means information contained on the data page of an Australian travel document, such as the document number, expiry date, and the name, date of birth, photograph and signature of the document holder
•    status information, which means information about whether the document is currently valid, including whether it has been lost or stolen or has restrictions on its use and
•    authenticity information, which is information necessary to establish the authenticity of a person applying for or holding an Australian travel document.[54]

Item 2 and 3 would amend section 46 to insert proposed paragraph 46(1)(da) to:

allow the Minister to disclose personal information for the purpose of participating in one of the following services to share or match information relating to the identity of a person:

the [DVS] or the [FVS] (new paragraphs 46(da)(i) to (ii)), or

any other service, specified or of a kind specified in the Minister’s determination (new paragraph 46(da)(iii)). … New paragraph 46(da)(iii) is intended to provide flexibility for the Minister to specify new services or kinds of services that may be used to share or match information relating the identity of a person in a determination. … Consistent with section 57 of the Australian Passports Act, such a determination will be a legislative instrument.[55]

On the Australian Privacy Principles the Explanatory Memorandum observes that:

As reflected in the note at the end of the current section 46 of the Australian Passports Act, information disclosed under new paragraph 46(1)(da) must be dealt with in accordance with the Australian Privacy Principles.[56]

Proposed paragraph 46(1)(da) does not appear to significantly expand the Minister’s power to disclose personal information—section 46 of the Passports Act already permits the disclosure of photographs to a wide range of federal, state and territory government agencies as well as Interpol and foreign border authorities. Proposed paragraph 46(1)(da), in providing a broad authority for disclosures expressly in relation to identity-matching services, will cover any existing gaps which might limit DFAT’s capacity to participate in identity-matching services.

Use of computer programs in disclosing personal information

In 2019 the Australian Passports Amendment (Identity-matching Services) Bill 2019 (the 2019 Bill) sought, and the Consequential Amendments Bill now seeks, to address the problem that ‘current section 46 of the Australian Passports Act does not clearly contemplate disclosures being made through an entirely automated decision-making process’.[57]

Item 3 of the 2019 Bill proposed the ‘use of computer programs to make decisions’ (proposed section 56A), with the Explanatory Memorandum for the 2019 Bill noting that this would ‘allow the Minister to arrange automated disclosures of personal information’. The proposed amendment was also intended to ‘give scope for the Minister to arrange the automation of other decisions under the Passports Act’.[58]

In contrast to the broad use of decision-making computer programs proposed in the 2019 Bill, item 6 of the Consequential Amendments Bill (proposed section 46A) would permit the use of computer programs only in disclosing personal information under paragraph 46(1)(da) to a person participating in the DVS or the FVS. The provision ‘does not allow for automated disclosures for any other purposes under the Australian Passports Act’.[59]

Use of computer programs with future services

With proposed section 46A specifying only the DVS or the FVS, the interaction between proposed section 46A and proposed paragraph 46(1)(da) appears to preclude the use of computer programs in disclosing personal information to a person participating in the proposed third category of identity verification services. Specifically, that is, ‘any future services that may be used to share or match information relating the identity of a person’ (proposed paragraph 46(1)(da)(iii)).

2019 Bill: Use of computer programs to automate decision-making

Observations made in the Parliamentary Library’s Bills Digest for the 2019 Bill[60] are relevant to item 6 of the Consequential Amendments Bill (proposed section 46A).

Proposed section 56A is in similar terms to computerised decision-making provisions in a broad range of other Acts. The use of computer programs to automate government decision-making has been occurring in various forms for some time, with benefits including the ability for such programs to instantaneously apply complex rules and policies and reduce inaccuracy, inconsistency and bias in decision-making. However, there are also risks associated with automated decision-making, with the potential for seemingly minor programming errors to lead to large numbers of incorrect decisions.

Submissions to the PJCIS inquiry raised concerns with this provision. Australian Lawyers for Human Rights argued that proposed section 56A is overly broad and does not distinguish between programs being used to assist in decision-making and to actually make the decision. The Australian councils for civil liberties suggested that if the provision is to be enacted, the decisions which are made by computers and the data used to generate the decisions are made publicly available, and that ‘strong procedural fairness criteria’ be included.

The report of the Parliamentary Joint Committee on Intelligence and Security (PJCIS) on the 2019 Bill also addressed computerised decision-making:

The Committee recommends that the Australian Passports Amendment (Identity-matching Services) Bill 2019 be amended to ensure that automated decision making can only be used for decisions that produce favourable or neutral outcomes for the subject, and that such decisions would not negatively affect a person’s legal rights or obligations, and would not generate a reason to seek review.[61]

In the 2019 Bill, proposed subsection 56A(3) would have enabled the Minister to change a decision made by a computer program, where satisfied that the computer program’s decision is incorrect. There is no such provision in the Consequential Amendments Bill, and this highlights a key difference in how the 2019 Bill and the Consequential Amendments Bill have been framed and drafted.

Consequential Amendments Bill: Use of computer programs in disclosing personal information

Proposed subsection 56A(1) of the 2019 Bill would have enabled the use of computer programs to automate decision-making, including in relation to the disclosure of personal information under the Passports Act.

In contrast, proposed subsection 46A(1) of the Consequential Amendments (Bill) would provide for the use of computer programs in disclosing personal information. The Consequential Amendments Bill would seem to present this as a computer program performing automated decision-making where the relevant decision is ‘deciding whether to disclose’, and in which ‘human intervention infeasible’:

Requests will need to be received and responded to in a timeframe that precludes the exercise of human discretion in deciding whether to disclose the information in each case. The current scale of the Document Verification Service and the future uses of the Face Verification Service will make human intervention infeasible.[62] [emphasis added]

The intention would seem to be that the decision to disclose personal should be distinguished from the decision as to the identity of the person, which would presumably be the responsibility of the requesting agency that uses the information received through an automated DVS or FVS request.

Alternatively, the Consequential Amendments Bill may be based on the view that the automated disclosure does not constitute a decision.

Either interpretation could explain why the current Bill does not include a provision for the Minister to change a decision made by a computer program (as would have been provided for by the 2019 Bill’s proposed subsection 56A(3)).

As such, it may be worth considering the extent to which decisions by the requesting agency about a person’s identity are subject to appropriate scrutiny and review by a human.

Automated decision-making: Recommendations of the Royal Commission into the Robodebt Scheme

The report of the Royal Commission into the Robodebt Scheme observed that ‘the automation used in the [Robodebt] Scheme at its outset, removing the human element, was a key factor in the harm it did … and one way to preserve accountability is to ensure a human is responsible for independently justifying the decision produced by an automated system’.[63] Two of the Royal Commission’s recommendations related to automated decision-making in government:

•    the Commonwealth should consider legislative reform to introduce a consistent legal framework in which automation in government services can operate (recommendation 17.1) and
•    the Commonwealth should consider establishing a body, or expanding an existing body, with the power to monitor and audit automated decision-making processes with regard to their technical aspects and their impact in respect of fairness, the avoiding of bias, and client usability (recommendation 17.2).[64]

To date, the Government has not formally responded. However, the Government’s recent response to the review of the Privacy Act in 2022[65] addressed automated decision-making:

The Government agrees that privacy policies should set out the types of personal information that will be used in substantially automated decisions which have a legal, or similarly significant effect on an individual’s rights and that high-level indicators of the types of decisions with a legal or similarly significant effect on an individual’s rights should be included in the Privacy Act and supplemented by OAIC guidance (proposals 19.1 and 19.2). This could include decisions on denial of consequential services or support, such as financial and lending services, housing, insurance, education enrolment, criminal justice, employment opportunities and health care services, or access to basic necessities such as food and water. Further consideration will be given to ensure that the parameters of ‘substantially automated’ are appropriately calibrated.

The Government also agrees that individuals should have a right to request meaningful information about how automated decisions with legal or similarly significant effect are made (proposal 19.3). The information provided to individuals should be jargon-free and comprehensible and should not reveal commercially sensitive information.

In relation to the proposals relating to ADM, the Government acknowledges the recommendations of the Royal Commission into the Robodebt Scheme in relation to the use of ADM by Commonwealth agencies. Consideration of how to best implement these reforms will occur as part of the Government’s response to the Royal Commission, and work on Supporting Responsible AI in Australia being led by the Department of Industry, Science and Resources. Implementation should also consider the work being progressed by the Department of Home Affairs and the Department of Infrastructure, Transport, Regional Development, Communications and the Arts in response to recommendations in the House of Representatives Select Committee on Social Media and Online Safety report to understand the operation of algorithms on digital platforms. The work being conducted by the Digital Platform Regulators Forum on these issues should also be considered.[66]