Federal Register of Legislation - Australian Government

Primary content

A Bill for an Act about dealing with information for providing identity-matching services and for carrying on certain identity or community protection activities, and for related purposes
Administered by: Home Affairs
For authoritative information on the progress of bills and on amendments proposed to them, please see the House of Representatives Votes and Proceedings, and the Journals of the Senate as available on the Parliament House website.
Registered 07 Feb 2018
Introduced HR 07 Feb 2018

2016‑2017‑2018

 

The Parliament of the

Commonwealth of Australia

 

HOUSE OF REPRESENTATIVES

 

 

 

 

Presented and read a first time

 

 

 

 

Identity‑matching Services Bill 2018

 

No.      , 2018

 

(Home Affairs)

 

 

 

A Bill for an Act about dealing with information for providing identity‑matching services and for carrying on certain identity or community protection activities, and for related purposes

  

  

  


Contents

Part 1—Preliminary                                                                                                             1

Division 1—Preliminary                                                                                              1

1............ Short title............................................................................................. 1

2............ Commencement................................................................................... 2

3............ Simplified outline of this Act.............................................................. 2

Division 2—Definitions                                                                                                4

Subdivision A—General definitions                                                                      4

4............ Definitions.......................................................................................... 4

5............ Definition of identification information............................................... 6

6............ Definition of identity or community protection activity....................... 8

Subdivision B—Definitions relating to identity‑matching services             10

7............ Definition of identity‑matching service............................................. 10

8............ Definition of FIS............................................................................... 12

9............ Definition of FRAUS......................................................................... 14

10.......... Definition of FVS.............................................................................. 14

11.......... Definition of IDSS............................................................................ 15

12.......... Definition of OPOLS........................................................................ 16

Part 2—Developing and operating interoperability hub and NDLFRS  17

13.......... Simplified outline of this Part............................................................ 17

14.......... Interoperability hub........................................................................... 17

15.......... NDLFRS.......................................................................................... 17

Part 3—Authorising collection, use and disclosure of identification information              18

Division 1—Simplified outline                                                                                18

16.......... Simplified outline of this Part............................................................ 18

Division 2—Collection, use and disclosure of identification information by the Department    19

17.......... Collection of identification information by the Department............... 19

18.......... Use and disclosure of identification information by the Department. 20

Division 3—Disclosure of identification information by State and Territory authorities to the Department                                                                                            21

19.......... Disclosure of identification information for inclusion in database in NDLFRS       21

Part 4—Protection of information                                                                             22

Division 1—Simplified outline                                                                                22

20.......... Simplified outline of this Part............................................................ 22

Division 2—Limits on recording and disclosure                                          23

21.......... Limits on recording and disclosure by entrusted persons.................. 23

Division 3—Authorised recording and disclosure by entrusted persons               26

22.......... Exercising powers, or performing functions or duties, as an entrusted person         26

23.......... Disclosure to lessen or prevent threat to life or health....................... 26

24.......... Disclosure relating to corruption issue.............................................. 26

25.......... Disclosure with consent.................................................................... 27

Part 5—Miscellaneous                                                                                                       28

26.......... Simplified outline of this Part............................................................ 28

27.......... Delegation of Secretary’s powers and functions under this Act........ 28

28.......... Annual reporting............................................................................... 28

29.......... Review of operation of this Act and provision of identity‑matching services           30

30.......... Rules................................................................................................. 30

 


A Bill for an Act about dealing with information for providing identity‑matching services and for carrying on certain identity or community protection activities, and for related purposes

The Parliament of Australia enacts:

Part 1Preliminary

Division 1Preliminary

1  Short title

                   This Act is the Identity‑matching Services Act 2018.

2  Commencement

             (1)  Each provision of this Act specified in column 1 of the table commences, or is taken to have commenced, in accordance with column 2 of the table. Any other statement in column 2 has effect according to its terms.

 

Commencement information

Column 1

Column 2

Column 3

Provisions

Commencement

Date/Details

1.  The whole of this Act

The day after this Act receives the Royal Assent.

 

Note:          This table relates only to the provisions of this Act as originally enacted. It will not be amended to deal with any later amendments of this Act.

             (2)  Any information in column 3 of the table is not part of this Act. Information may be inserted in this column, or information in it may be edited, in any published version of this Act.

3  Simplified outline of this Act

The Secretary of the Department may develop and operate:

       (a)     the interoperability hub, which relays electronic communications between bodies and persons requesting and providing identity‑matching services; and

      (b)     the NDLFRS, which includes a database of identification information from State and Territory authorities and may be used to provide identity‑matching services.

The Department may collect identification information through the interoperability hub or NDLFRS for any of the following purposes:

       (a)     providing or developing identity‑matching services for identity or community protection activities;

      (b)     developing, operating or maintaining the NDLFRS;

       (c)     protecting the identities of persons who have legally assumed identities or are under witness protection.

The Department may use or disclose for any of those purposes information so collected (regardless of the purpose for which it was collected).

Generally, identity‑matching services involve requests for electronic comparison of identification information about an individual to identify the individual, verify the individual’s identity, check whether the individual has more than one State or Territory government identification document of a particular kind, or manage identification information about the individual in the NDLFRS.

Identity or community protection activities mostly relate to identity‑related fraud, law enforcement, proceeds of crime, security and safety.

Persons who work for the Department, and contractors whose duties relate to the interoperability hub or the NDLFRS, may commit an offence for unauthorised disclosure or recording of certain information held in, generated using or relating to the interoperability hub or the NDLFRS.

The Minister must report to Parliament annually on the use of most of the identity‑matching services.

Division 2Definitions

Subdivision AGeneral definitions

4  Definitions

                   In this Act:

Australian Border Force has the same meaning as in the Australian Border Force Act 2015.

electronic communication means a communication of information in the form of data, text or images by means of guided electromagnetic energy, unguided electromagnetic energy or both.

entrusted person has the meaning given by section 21.

facial image means a digital image of an individual’s face (whether or not including the shoulders).

FIS has the meaning given by section 8.

Note:          FIS is short for Face Identification Service, a term used in the intergovernmental agreement.

FRAUS has the meaning given by section 9.

Note:          FRAUS is short for Facial Recognition Analysis Utility Service, a term used in the intergovernmental agreement.

FVS has the meaning given by section 10.

Note:          FVS is short for Face Verification Service, a term used in the intergovernmental agreement.

government identification document means a document or other thing that:

                     (a)  contains identification information; and

                     (b)  can be used to identify an individual or to pass an individual off as someone else (whether living, dead, real or fictitious); and

                     (c)  is issued by or on behalf of an authority of the Commonwealth or an authority of a State or Territory.

identification information has the meaning given by section 5.

identity‑matching service has the meaning given by section 7.

identity or community protection activity has the meaning given by section 6.

IDSS has the meaning given by section 11.

Note:          IDSS is short for Identity Data Sharing Service, a term used in the intergovernmental agreement.

intergovernmental agreement means the Intergovernmental Agreement on Identity Matching Services made on 5 October 2017 by the Commonwealth, the States, the Australian Capital Territory and the Northern Territory.

Note:          The intergovernmental agreement could in 2018 be viewed on the Council of Australian Governments website (https://www.coag.gov.au).

interoperability hub has the meaning given by section 14.

NDLFRS has the meaning given by section 15.

Note:          NDLFRS is short for National Driver Licence Facial Recognition Solution, a term used in the intergovernmental agreement.

non‑government entity means a body, or person, other than:

                     (a)  the Commonwealth, a State or a Territory; and

                     (b)  an authority of the Commonwealth or of a State or Territory.

OPOLS has the meaning given by section 12.

Note:          OPOLS is short for One Person One Licence Service, a term used in the intergovernmental agreement.

personal information has the meaning given by section 6 of the Privacy Act 1988.

protected information has the meaning given by section 21.

rules means rules made under section 30.

5  Definition of identification information

             (1)  Identification information about an individual (whether living, dead, real or fictitious) is any of the following:

                     (a)  a name by which the individual is or has been known;

                     (b)  a current or former address of the individual;

                     (c)  the place or date the individual was born;

                     (d)  the age of the individual (whether expressed by reference to a range or not);

                     (e)  the current or former sex, gender identity or intersex status of the individual;

                      (f)  information about whether the individual is alive or dead;

                     (g)  any information that is:

                              (i)  contained in a driver’s licence (however described) issued by or on behalf of an authority of a State or Territory in a name of the individual; or

                             (ii)  otherwise associated with the licence by the authority;

                     (h)  any information that is:

                              (i)  contained in any other licence (however described), or any document issued to assist the individual to prove his or her age or identity, that contains a photograph purporting to be of the individual and is issued by or on behalf of an authority of a State or Territory in a name of the individual; or

                             (ii)  otherwise associated with such a licence or document by or on behalf of the authority;

                      (i)  any information that is:

                              (i)  contained in a document issued to the individual, as a person who is not a Australian citizen, by the Department administered by the Minister administering the Migration Act 1958 to assist the individual to prove his or her identity; or

                             (ii)  otherwise associated with such a document by that Department;

                      (j)  any information that is:

                              (i)  contained in an Australian travel document (within the meaning of the Australian Passports Act 2005), or a foreign travel document (within the meaning of the Foreign Passports (Law Enforcement and Security) Act 2005), issued in the name of the individual; or

                             (ii)  otherwise associated with the Australian travel document by the Minister administering the Australian Passports Act 2005 or the Department administered by that Minister; or

                            (iii)  otherwise associated with the Australian travel document or foreign travel document by an authority of the Commonwealth or of a State or Territory by which the travel document may be inspected or seized under a law of the Commonwealth or of a State or Territory;

                     (k)  the individual’s current or former citizenship;

                      (l)  information about a visa the individual holds or held;

                    (m)  a facial image of the individual, a biometric template derived from such an image or a result of biometric comparison involving such an image;

                     (n)  any information that is prescribed by the rules and relates to the individual.

What is not identification information

             (2)  Despite subsection (1) but subject to subsection (3), the following is not identification information about an individual:

                     (a)  information or an opinion about the individual’s:

                              (i)  racial or ethnic origin; or

                             (ii)  political opinions; or

                            (iii)  membership of a political association; or

                            (iv)  religious beliefs or affiliations; or

                             (v)  philosophical beliefs; or

                            (vi)  membership of a professional or trade association; or

                           (vii)  membership of a trade union; or

                          (viii)  sexual orientation or practices; or

                            (ix)  criminal record;

                     (b)  health information (within the meaning of the Privacy Act 1988) about the individual;

                     (c)  genetic information about the individual.

             (3)  Subsection (2) does not prevent information described in any of paragraphs (1)(a) to (n) (inclusive) from being identification information if the information is not primarily of any of the kinds described in that subsection, even if information of any of those kinds can reasonably be inferred from the information.

Example 1: Even if an individual’s racial or ethnic origin can reasonably be inferred from his or her name or place of birth, this does not prevent his or her name or place of birth from being identification information.

Example 2: Even if an individual’s racial or ethnic origin or religious affiliations can reasonably be inferred from a facial image of the individual, this does not prevent the image from being identification information.

Prescribing extra kinds of identification information

             (4)  Before making rules prescribing information for the purposes of paragraph (1)(n), the Minister must:

                     (a)  be satisfied that the information:

                              (i)  can be used (alone or in conjunction with other information) to identify an individual; and

                             (ii)  is reasonably necessary to provide one or more identity‑matching services; and

                            (iii)  assists one or more identity or community protection activities; and

                     (b)  consult the Human Rights Commissioner and the Information Commissioner.

6  Definition of identity or community protection activity

Identity or community protection activity

             (1)  An identity or community protection activity is an activity covered by subsection (2), (3), (4), (5), (6), (7) or (8).

Note:          Annual reports on requests for an FIS need to identify the activity described in one of those subsections for which the service was requested (see section 28).

Preventing and detecting identity fraud

             (2)  This subsection covers preventing and detecting identity‑related fraud (including use of stolen or fraudulently obtained government identification documents or identification information from such documents).

Law enforcement activities

             (3)  This subsection covers the following activities:

                     (a)  preventing, detecting, investigating or prosecuting an offence against a law of the Commonwealth, a State or a Territory;

                     (b)  starting, conducting, or deciding whether to start or continue, proceedings under the Proceeds of Crime Act 2002 or a corresponding law within the meaning of that Act.

National security activities

             (4)  This subsection covers conducting an investigation, or gathering intelligence, relevant to Australia’s national security (within the meaning of the National Security Information (Criminal and Civil Proceedings) Act 2004).

Protective security activities

             (5)  This subsection covers promoting the security of an asset, facility, or person, associated with government, including by:

                     (a)  checking the security or criminal background of a person with access to such an asset or facility; or

                     (b)  protecting a person described in paragraph 17(2)(d) or (e) (about persons with legally assumed identities or under witness protection) or someone else associated with such a person.

Community safety activities

             (6)  This subsection covers promoting community safety, including by identifying:

                     (a)  an individual who has suffered, or is reasonably believed to be at risk of suffering, physical harm, including an individual who:

                              (i)  has been reported as missing; or

                             (ii)  has died or is reasonably believed to have died; or

                            (iii)  is affected, or is reasonably believed to have been affected, by disaster; or

                     (b)  an individual who is reasonably believed to be involved with a significant risk to public health or safety.

Road safety activities

             (7)  This subsection covers promoting road safety, including by promoting the integrity of driver licensing systems.

Verifying identity

             (8)  This subsection covers verifying the identity of an individual.

Subdivision BDefinitions relating to identity‑matching services

7  Definition of identity‑matching service

             (1)  An identity‑matching service is any of the following:

                     (a)  an FIS (see section 8);

                     (b)  an FRAUS (see section 9);

                     (c)  an FVS (see section 10);

                     (d)  an IDSS (see section 11);

                     (e)  an OPOLS (see section 12);

                      (f)  a service prescribed by the rules that:

                              (i)  involves the collection, use and disclosure of identification information; and

                             (ii)  involves the interoperability hub or the NDLFRS.

             (2)  The Minister may only make rules for the purposes of paragraph (1)(f) prescribing a service that involves a request, from a local government authority or non‑government entity, relating to an individual if:

                     (a)  the purpose of the service is to verify the individual’s identity; and

                     (b)  the conditions in subsection (3) are met in relation to the local government authority or non‑government entity.

Conditions on local government authority or non‑government entity requesting identity‑matching service

             (3)  The conditions are that:

                     (a)  verification of the individual’s identity is reasonably necessary for one or more of the functions or activities of the local government authority or non‑government entity; and

                     (b)  the individual has given consent for the local government authority or non‑government entity to use and disclose, for the purpose of verifying the individual’s identity, the identification information about the individual that is included in the request; and

                     (c)  the local government authority or non‑government entity either:

                              (i)  carries on activities in Australia from premises in Australia; or

                             (ii)  resides in Australia; and

                     (d)  either:

                              (i)  the Privacy Act 1988 applies (with or without modifications prescribed by regulations under that Act) to the local government authority or non‑government entity as an organisation (within the meaning of that Act); or

                             (ii)  the local government authority is bound by a law of a State or Territory, or has entered into a written agreement with the Department, that meets the requirements of subsection (4).

             (4)  For the purposes of subparagraph (3)(d)(ii), the law or agreement must provide for the following:

                     (a)  protection of personal information comparable to that provided by the Australian Privacy Principles;

                     (b)  monitoring of compliance with the law or agreement;

                     (c)  a means for an individual to seek recourse if his or her personal information is dealt with in a way contrary to the law or agreement.

Consulting before prescribing extra services

             (5)  Before making rules for the purposes of paragraph (1)(f), the Minister must consult the Human Rights Commissioner and the Information Commissioner about the proposed rules.

8  Definition of FIS

             (1)  A service is an FIS if:

                     (a)  the service involves electronically comparing:

                              (i)  a facial image of an individual, and other identification information (if any) about the individual, that is included in a request for the provision of the service made by an authority described in subsection (2); and

                             (ii)  identification information about one or more individuals that is contained in one or more government identification documents of one or more kinds specified in the request; and

                     (b)  the comparison is for the purpose of identifying the individual, or determining whether the individual has multiple identities, in the course of an identity or community protection activity covered by any of subsections 6(2) to (6) (inclusive); and

                     (c)  the request and the outcome of the comparison are communicated by electronic communications relayed through the interoperability hub.

Note:          FIS is short for Face Identification Service, a term used in the intergovernmental agreement.

             (2)  For the purposes of subparagraph (1)(a)(i), any of the following may request the provision of the service:

                     (a)  the Australian Border Force, so far as it is investigating, or involved in prosecuting, an offence against:

                              (i)  Part XIII of the Customs Act 1901; or

                             (ii)  the Crimes Act 1914; or

                            (iii)  the Criminal Code; or

                            (iv)  the Environment Protection and Biodiversity Conservation Act 1999;

                     (b)  the Australian Commission for Law Enforcement Integrity;

                     (c)  the Australian Crime Commission;

                     (d)  the Australian Federal Police;

                     (e)  the Australian Security Intelligence Organisation;

                      (f)  a Department administered by a Minister administering any of the following Acts:

                              (i)  the Australian Citizenship Act 2007;

                             (ii)  the Australian Passports Act 2005;

                            (iii)  the Foreign Passports (Law Enforcement and Security) Act 2005;

                            (iv)  the Migration Act 1958;

                            so far as that Department is investigating, or involved in prosecuting, an offence against any of those Acts;

                     (g)  a police force of a State or Territory;

                     (h)  the Independent Commission Against Corruption established by the Independent Commission Against Corruption Act 1988 (NSW);

                      (i)  the Law Enforcement Conduct Commission established by the Law Enforcement Conduct Commission Act 2016 (NSW);

                      (j)  the New South Wales Crime Commission established by the Crime Commission Act 2012 (NSW);

                     (k)  the Independent Broad‑based Anti‑corruption Commission established by the Independent Broad‑based Anti‑corruption Commission Act 2011 (Vic.);

                      (l)  the Crime and Corruption Commission established by the Crime and Corruption Act 2001 (Qld);

                    (m)  the Corruption and Crime Commission established by the Corruption, Crime and Misconduct Act 2003 (WA);

                     (n)  the Independent Commissioner Against Corruption appointed under the Independent Commissioner Against Corruption Act 2012 (SA) or a member of the staff of that Commissioner;

                     (o)  the Integrity Commission established by the Integrity Commission Act 2009 (Tas.);

                     (p)  the Independent Commissioner Against Corruption appointed under the Independent Commissioner Against Corruption Act 2017 (NT) or a member of the staff of that Commissioner;

                     (q)  an authority prescribed by the rules.

             (3)  Before the Minister makes rules prescribing an authority for the purposes of paragraph (2)(q) the Minister must be satisfied that the authority has one or more of the functions that used to be functions of an authority described in any of paragraphs (2)(g) to (p) (inclusive).

9  Definition of FRAUS

                   A service is an FRAUS if:

                     (a)  the service involves electronically comparing:

                              (i)  a facial image of an individual that is included in a request for the provision of the service made by an authority of a State or Territory that has supplied identification information (directly or through an agent) to a database in the NDLFRS; and

                             (ii)  identification information about the individual that is included in a database in the NDLFRS and was supplied by the authority (directly or through an agent); and

                     (b)  the comparison is for the purpose of assessing the accuracy or quality of identification information held by the authority; and

                     (c)  the request and the outcome of the comparison are communicated by electronic communications made directly to and from the NDLFRS or relayed through the interoperability hub.

Note:          FRAUS is short for Facial Recognition Analysis Utility Service, a term used in the intergovernmental agreement.

10  Definition of FVS

             (1)  A service is an FVS if:

                     (a)  the service involves electronically comparing:

                              (i)  identification information about an individual that is included in a request for the provision of the service made by a body or person described in subsection (2); and

                             (ii)  identification information about the individual that is contained in a government identification document of a kind specified in the request; and

                     (b)  a facial image of the individual is included in the request or in a response to the request (or both), unless the response is that the identity of the individual cannot be verified from the identification information included in the request; and

                     (c)  the comparison is for the purpose of verifying the identity of the individual; and

                     (d)  the request and the outcome of the comparison are communicated by electronic communications relayed through the interoperability hub.

Note:          FVS is short for Face Verification Service, a term used in the intergovernmental agreement.

             (2)  For the purposes of subparagraph (1)(a)(i), the request for the provision of the service may be made by any of the following that may legally collect, use and disclose identification information that either is included in the request or might reasonably be expected to be disclosed in response to the request:

                     (a)  an authority of the Commonwealth;

                     (b)  an authority of a State or Territory other than a local government authority;

                     (c)  a local government authority that meets the conditions in subsection 7(3);

                     (d)  a non‑government entity that meets the conditions in subsection 7(3).

11  Definition of IDSS

             (1)  An IDSS is a service (except one mentioned in subsection (2)) that involves a disclosure that:

                     (a)  is of identification information about an individual; and

                     (b)  is for the purpose of an identity or community protection activity; and

                     (c)  is by one authority of the Commonwealth or of a State or a Territory to another authority of the Commonwealth or of a State or a Territory; and

                     (d)  is by means of electronic communication relayed through the interoperability hub.

Note:          IDSS is short for Identity Data Sharing Service, a term used in the intergovernmental agreement.

             (2)  None of the following services is an IDSS:

                     (a)  an FIS;

                     (b)  an FRAUS;

                     (c)  an FVS;

                     (d)  an OPOLS.

12  Definition of OPOLS

                   A service is an OPOLS if:

                     (a)  the service involves electronically comparing:

                              (i)  a facial image of an individual, and any other identification information about the individual, that is included in a request for the provision of the service made by an authority of a State or Territory; and

                             (ii)  identification information in a database in the NDLFRS; and

                     (b)  the authority issues government identification documents of a particular kind and has supplied identification information (directly or through one or more agents) to a database in the NDLFRS; and

                     (c)  the comparison is for the purpose of determining whether the individual holds multiple government identification documents that are of that kind and have been issued by or on behalf of one or more authorities of one or more States or Territories; and

                     (d)  the request and the outcome of the comparison are communicated by electronic communications made directly to and from the NDLFRS or relayed through the interoperability hub.

Note:          OPOLS is short for One Person One Licence Service, a term used in the intergovernmental agreement.

Part 2Developing and operating interoperability hub and NDLFRS

  

13  Simplified outline of this Part

The Secretary of the Department may develop, operate and maintain the interoperability hub and the NDLFRS.

14  Interoperability hub

                   The Secretary of the Department may develop, operate and maintain a facility (the interoperability hub) for relaying electronic communications between bodies and persons for the purposes of requesting and providing identity‑matching services.

15  NDLFRS

                   The Secretary of the Department may develop, operate and maintain a system (the NDLFRS) consisting of:

                     (a)  a database of identification information that:

                              (i)  is also contained in government identification documents issued by or on behalf of an authority of a State or Territory; and

                             (ii)  is supplied by the authority or its agent to the Department by electronic communication for inclusion in the database; and

                     (b)  a system for biometric comparison of facial images with facial images that are in the database described in paragraph (a).

Note:          NDLFRS is short for National Driver Licence Facial Recognition Solution, a term used in the intergovernmental agreement.

Part 3Authorising collection, use and disclosure of identification information

Division 1Simplified outline

16  Simplified outline of this Part

The Department may collect identification information by means of the interoperability hub or NDLFRS for any of the following purposes:

       (a)     providing or developing identity‑matching services for identity and community protection activities;

      (b)     developing, operating or maintaining the NDLFRS;

       (c)     protecting the identities of persons who have legally assumed identities or are under witness protection.

The Department may use or disclose for any of those purposes:

       (a)     information so collected (regardless of the purpose for which it was collected); and

      (b)     identification information generated by the NDLFRS.

For the purposes of State and Territory laws that limit disclosure of identification information by an authority of a State or Territory but have an exception for disclosure authorised by a Commonwealth law, this Part authorises such disclosure to the Department for inclusion of the information in the NDLFRS.

Division 2Collection, use and disclosure of identification information by the Department

17  Collection of identification information by the Department

             (1)  The Department may collect identification information (whether or not it is sensitive information as defined in the Privacy Act 1988) about an individual from someone other than the individual, if the collection:

                     (a)  is by means of an electronic communication to the interoperability hub or the NDLFRS; and

                     (b)  is for a purpose described in subsection (2).

Note:          One effect of this section is that such collection of identification information is authorised for the purposes of provisions of Australian Privacy Principle 3 such as paragraph 3.4(a) (about sensitive information) and subparagraph 3.6(a)(ii) (about personal information).

             (2)  The purposes for which identification information may be collected under subsection (1) (or used or disclosed under section 18) are as follows:

                     (a)  providing an identity‑matching service for the purpose of an identity or community protection activity;

                     (b)  developing identity‑matching services, or facilities for providing those services, for the purpose of an identity or community protection activity;

                     (c)  developing, operating or maintaining the NDLFRS;

                     (d)  protecting:

                              (i)  an assumed identity acquired under Part IAC of the Crimes Act 1914 or a corresponding assumed identity law within the meaning of that Part; or

                             (ii)  the real identity of a person who has acquired an assumed identity as described in subparagraph (i);

                     (e)  protecting an identity (whether real or not) of a person to whom any of the following subparagraphs applies:

                              (i)  a witness identity protection certificate has been given for the person under Part IACA of the Crimes Act 1914;

                             (ii)  a corresponding witness identity protection certificate has been given for the person under a corresponding witness identity protection law within the meaning of that Part;

                            (iii)  the person is a participant as defined in the Witness Protection Act 1994;

                            (iv)  the person is or was on a witness protection program conducted by a State or Territory in which a complementary witness protection law (as defined in the Witness Protection Act 1994) is in force;

                             (v)  the person is involved in administering such a program under such a law and the person has acquired an identity under that law.

18  Use and disclosure of identification information by the Department

                   The Department may, for any purpose described in subsection 17(2), use or disclose identification information:

                     (a)  collected by means of an electronic communication to the interoperability hub or the NDLFRS; or

                     (b)  held in, or generated using, the NDLFRS.

Note 1:       One effect of this section is that such use or disclosure of identification information is authorised for the purposes of provisions of Australian Privacy Principle 6 such as paragraph 6.2(b) (use or disclosure of personal information authorised by law).

Note 2:       Although this section authorises the Department to disclose identification information, it does not authorise the recipient of the disclosure to collect the identification information disclosed. That collection must comply with all applicable laws.

Division 3Disclosure of identification information by State and Territory authorities to the Department

19  Disclosure of identification information for inclusion in database in NDLFRS

             (1)  This section applies if a law of a State or Territory:

                     (a)  limits disclosure of some or all identification information by an authority of a State or Territory or by a body or person acting on behalf of such an authority; and

                     (b)  exempts from the limitation a disclosure authorised by a law of the Commonwealth.

             (2)  For the purposes of the exemption, the authority, body or person may disclose to the Department by electronic communication identification information about an individual for inclusion in the database mentioned in paragraph 15(a) (about the NDLFRS).

Part 4Protection of information

Division 1Simplified outline

20  Simplified outline of this Part

Current and former entrusted persons may commit an offence if they disclose or record certain information connected with the interoperability hub or the NDLFRS.

Basically, entrusted persons are the following:

       (a)     persons who work for the Department;

      (b)     contractors (and their officers and employees) engaged to provide services to the Department in connection with the interoperability hub or the NDLFRS.

There are exceptions for disclosure or recording authorised by a law of the Commonwealth or of a State or Territory. The exceptions include disclosure or recording:

       (a)     for the purpose of this Act; or

      (b)     in exercising powers, or performing duties, relating to the interoperability hub or NDLFRS; or

       (c)     for lessening or preventing a serious and imminent threat to human life or health; or

      (d)     relating to a corruption issue; or

       (e)     with the consent of the person to whom the information disclosed or recorded relates.

Also, entrusted persons cannot be required to disclose certain information connected with the interoperability hub or the NDLFRS to a court or tribunal, except for the purposes of this Act or the Law Enforcement Integrity Commissioner Act 2006.

Division 2Limits on recording and disclosure

21  Limits on recording and disclosure by entrusted persons

Offence

             (1)  A person commits an offence if:

                     (a)  the person is, or has been, an entrusted person; and

                     (b)  the person has obtained protected information in his or her capacity as an entrusted person; and

                     (c)  the person:

                              (i)  makes a record of the information; or

                             (ii)  discloses the information to another person.

Note:          The fault element for the physical elements in paragraphs (a) and (b) is recklessness: see section 5.6 of the Criminal Code.

Penalty:  Imprisonment for 2 years.

Exceptions

             (2)  Each of the following is an exception to the prohibition in subsection (1):

                     (a)  the conduct is authorised by a law of the Commonwealth or of a State or Territory;

                     (b)  the conduct is in compliance with a requirement under a law of the Commonwealth or of a State or Territory.

Note:          A defendant bears an evidential burden in relation to the matter in subsection (2): see subsection 13.3(3) of the Criminal Code.

Restriction on capacity of courts etc. to require disclosure of protected information or production of documents

             (3)  Except where it is necessary to do so for the purposes of giving effect to this Act or the Law Enforcement Integrity Commissioner Act 2006, or a legislative instrument under this Act or that Act, an entrusted person is not to be required to disclose protected information, or produce a document containing protected information, to:

                     (a)  a court; or

                     (b)  a tribunal, authority or person that has the power to require the answering of questions or the production of documents.

Definitions of entrusted person and protected information

             (4)  In this Act:

entrusted person means:

                     (a)  the Secretary of the Department; or

                     (b)  an APS employee in the Department; or

                     (c)  a person who is:

                              (i)  an employee of an Agency (within the meaning of the Public Service Act 1999); or

                             (ii)  an officer or employee of a State or Territory; or

                            (iii)  an officer or employee of an authority of the Commonwealth or of an authority of a State or Territory; or

                            (iv)  an officer or employee of the government of a foreign country, an officer or employee of an authority of a foreign country or an officer or employee of a public international organisation (within the meaning of section 70.1 of the Criminal Code);

                            and whose services are made available to the Department; or

                     (d)  a contractor engaged to provide services to the Department in connection with the interoperability hub or the NDLFRS (whether the contractor is engaged directly by the Commonwealth or as a subcontractor); or

                     (e)  an officer or employee of such a contractor whose duties relate wholly or partly to the interoperability hub or the NDLFRS.

protected information means any of the following:

                     (a)  identification information that was obtained by a person, in the person’s capacity as an entrusted person, from:

                              (i)  an electronic communication to or from either the interoperability hub or the NDLFRS; or

                             (ii)  the NDLFRS;

                     (b)  information about either of the following:

                              (i)  the making, content or addressing of an electronic communication made to or from either the interoperability hub or the NDLFRS;

                             (ii)  identification information relating to a particular individual held in, or generated using, the NDLFRS;

                            that was obtained by a person, in the person’s capacity as an entrusted person;

                     (c)  information that enables access to the interoperability hub or the NDLFRS and was obtained by a person, in the person’s capacity as an entrusted person.

Division 3Authorised recording and disclosure by entrusted persons

22  Exercising powers, or performing functions or duties, as an entrusted person

                   An entrusted person may make a record of or disclose protected information if the record is made, or the information is disclosed:

                     (a)  for the purposes of this Act; or

                     (b)  in the course of exercising powers, or performing functions or duties, relating wholly or partly to the interoperability hub or the NDLFRS.

23  Disclosure to lessen or prevent threat to life or health

             (1)  An entrusted person may disclose protected information if:

                     (a)  the entrusted person reasonably believes that the disclosure is necessary to lessen or prevent a serious and imminent threat to the life or health of an individual; and

                     (b)  the disclosure is for the purpose of lessening or preventing that threat.

             (2)  An entrusted person may make a record of protected information for the purpose of disclosing the protected information under subsection (1).

24  Disclosure relating to corruption issue

             (1)  An entrusted person may disclose protected information to the Integrity Commissioner:

                     (a)  for the purpose of referring an allegation, or information, that raises a corruption issue (within the meaning of the Law Enforcement Integrity Commissioner Act 2006); or

                     (b)  for the purpose of notifying a corruption issue under that Act; or

                     (c)  for the purpose of an investigation of a corruption issue under that Act.

             (2)  An entrusted person may make a record of protected information for the purpose of disclosing the protected information under subsection (1).

             (3)  This section does not limit the effect of subsection 21(2) or (3) in connection with the Law Enforcement Integrity Commissioner Act 2006.

25  Disclosure with consent

                   An entrusted person may make a record of or disclose protected information that relates to the affairs of a person if:

                     (a)  the person has consented to the recording or disclosure; and

                     (b)  the recording or disclosure is in accordance with that consent.

Part 5Miscellaneous

  

26  Simplified outline of this Part

The Secretary of the Department may delegate his or her powers and functions under this Act.

Annual reports must be prepared and tabled in Parliament about things done in connection with certain identity‑matching services.

A review of the operation of this Act and the provision of identity‑matching services must be started within 5 years. A report of the review must be tabled in Parliament.

The Minister may make rules for the purposes of this Act.

27  Delegation of Secretary’s powers and functions under this Act

             (1)  The Secretary of the Department may, in writing, delegate all or any of his or her functions or powers under this Act to an SES employee or acting SES employee in the Department.

Note 1:       SES employee and acting SES employee are defined in section 2B of the Acts Interpretation Act 1901.

Note 2:       Sections 34AA to 34A of the Acts Interpretation Act 1901 contain provisions relating to delegations.

             (2)  In performing a delegated function or exercising a delegated power, the delegate must comply with any written directions of the Secretary of the Department.

28  Annual reporting

             (1)  The Secretary of the Department must give the Minister a report including the following information for each financial year:

                     (a)  statistics relating to all requests in the financial year, from authorities of the Commonwealth (except the Australian Security Intelligence Organisation) or of a State or Territory, for an FIS, FVS or OPOLS, broken down by:

                              (i)  requesting authority (identified by name); and

                             (ii)  service requested; and

                            (iii)  requests in response to which information contained in a government identification document, or confirmation of an individual’s identity, was provided; and

                            (iv)  requests in response to which neither information contained in a government identification document nor confirmation of an individual’s identity was provided; and

                             (v)  in the case of requests for an FIS—the kind of identity or community protection activity (identified by reference to a specific subsection of section 6) for whose purpose the service was requested;

                     (b)  statistics relating to all requests in the financial year from non‑government entities for an FVS, including:

                              (i)  the total number of those requests; and

                             (ii)  the total number of non‑government entities that made those requests; and

                            (iii)  the number of those requests in response to which information contained in a government identification document, or confirmation of an individual’s identity, was provided; and

                            (iv)  the number of those requests in response to which neither information contained in a government identification document nor confirmation of an individual’s identity was provided;

                     (c)  the following material relating to each authority of the Commonwealth (except the Australian Security Intelligence Organisation), and each authority of a State or Territory (including a local government authority), that used an IDSS to disclose or collect identification information in the financial year:

                              (i)  the name of the authority;

                             (ii)  a brief description of the nature of the information;

                            (iii)  an indication whether the authority collected or disclosed the information;

                     (d)  any other information that:

                              (i)  relates to the financial year and either an identity‑matching service or the administration of this Act; and

                             (ii)  is required by the Minister.

             (2)  The report must not unreasonably disclose personal information about an individual.

Timing of annual report

             (3)  The Secretary of the Department must give the Minister the report as soon as practicable after the end of the financial year and in any case within 6 months after the end of the financial year.

Tabling of annual report

             (4)  The Minister must cause a copy of the report to be tabled in each House of the Parliament within 15 sitting days of that House after the Minister receives the report.

29  Review of operation of this Act and provision of identity‑matching services

             (1)  The Minister must cause a review of the operation of this Act and the provision of identity‑matching services to be started within 5 years of the commencement of this section.

             (2)  The Minister must cause a report of the review to be prepared and given to the Minister.

             (3)  The Minister must cause a copy of the report to be tabled in each House of the Parliament within 15 sitting days of that House after the Minister receives the report.

30  Rules

             (1)  The Minister may, by legislative instrument, make rules prescribing matters:

                     (a)  required or permitted by this Act to be prescribed by the rules; or

                     (b)  necessary or convenient to be prescribed for carrying out or giving effect to this Act.

             (2)  To avoid doubt, the rules may not do the following:

                     (a)  create an offence or civil penalty;

                     (b)  provide powers of:

                              (i)  arrest or detention; or

                             (ii)  entry, search or seizure;

                     (c)  impose a tax;

                     (d)  set an amount to be appropriated from the Consolidated Revenue Fund under an appropriation in this Act;

                     (e)  directly amend the text of this Act.

             (3)  Despite subsection 44(1) of the Legislation Act 2003, section 42 (disallowance) of that Act applies to the rules.

             (4)  Despite subsection 54(1) of the Legislation Act 2003, Part 4 of Chapter 3 (sunsetting) of that Act applies to the rules.