Second Reading: Identity Verification Services (Consequential Amendments) Bill 2023

I rise to speak on the Identification Verification Services Bill 2023 and the Identification Verification Services (Consequential Amendments) Bill 2023. These bills seek to place a statutory footing underneath existing services that have been in operation for a number of years—services that allow government agencies to undertake basic identification verification checks, such as confirming whether or not the name and biographical detail on a government-issued document match the original record. The opposition does not object to the principles underpinning the legislation. Identity verification is a fundamental step that government and business entities rely on when transacting with Australians for a range of purposes. These processes are important to the health and overall productivity of the Australian economy and the efficient functioning of government.

I do, however, want to signal at the outset that the opposition holds significant concerns about the way in which this legislation has come before this House, in a process led by the Attorney-General. We also have significant concerns about what these bills do not do. For the benefit of the House, I intend to: firstly, give an overview of what is meant by identity verification; secondly, to discuss the bills, what they do and what they don't do; and, thirdly, to put the bills into the broader context of identity policy by considering their interface with the digital economy and government services delivery.

To those who are not familiar with it, identity verification is a concept that is fundamentally straightforward but that can be obscured by some of the complex language which is used. The first type of identity verification that the bill deals with is document verification. An important way that this is done in Australia is through the document verification service—or the DVS—which until recently was hosted by the Department of Home Affairs and has been operating since 2009. A typical example of how this operates is where an entity such as a bank wants to verify a person's identity. For example, the bank may wish to meet its know-your-customer obligations under the Anti- Money Laundering and Counter-Terrorism Financing Act. The entity receives the information from the person and, by using the DVS, can confirm whether the information provided matches existing government records. The DVS gives a simple yes or no answer. The service is accessible to government and industry bodies who meet specified criteria.

It's also possible to verify a person's identity through face-matching. The face verification service, or FVS, is a service that compares your photo against the image used on your identity document to determine whether they match. For example, the image that you provide could be compared with your passport photo through the face verification service. If the two images match then you will gain access to the requested service. In short, the face verification service is a form of face-matching that allows Australians to access to a greater range of government services in a more secure and convenient way. There is another form of face-matching that's dealt with by the bill, the face identification service. It's important to be clear the face identification service is different to the face verification service. Face verification, as I've indicated, is essentially a process analogous to holding up a person's passport against the person's face to see if they match. You're checking one image against one document. By contrast, face identification is like taking an image of an individual and comparing it with every image in a book full of mugshots to find potential matches. You're checking one image against a whole database worth of images. It is one-to-many matching.

Having explained those three related but distinct services, I want to turn to what the bills before the House seek to do. The Identity Services Verification Bill will authorise the Attorney-General's Department to develop and operate three identity verification services. The first is the DVS hub. This is the electronic hub through which an entity trying to verify a document is able to confirm whether that document matches as original record. It is important to note that the DVS, the document verification service, as I've said, exists already. But the bill would put it on a statutory footing and authorise the Attorney-General's Department to operate the hub.

The second service which is a subject of this bill is the face-matching service hub. This is the hub that allows an image to be compared against photographs in a database. The face-matching service hub operates as a router by which requesting entities may request services via the Attorney-General's Department from the agencies holding the underlying data. The agency holding the underlying data responds to a request via a return through the face-matching service hub, and the bill would authorise the Attorney-General's Department to operate that hub. This facilitates both of the services I mentioned previously, the face-matching service and the face verification service.

A third facility which the bill authorises the department to operate is the National Driver Licence Facial Recognition Solution. This is a facility that adds photos held by the states and territories for the purposes of operating their respective drivers licence systems to the library of images that may be used for face-matching. This is an endeavour jointly between the Commonwealth and state and territory governments that the former coalition government began work on in partnership with state and territory governments. The intention of the legislation is that images of an individual can be compared not just against passport photos in a database held by the Commonwealth but also against state and territory drivers licence photos. That would be for the purposes both of face-matching and of face identification.

In seeking to put these services on a statutory footing, the bill provides for arrangements called participation agreements, the so-called NDLFRS hosting arrangement, and access policies. These arrangements, as the opposition understands them, are intended to ensure that various privacy protections apply to the various services even if the Privacy Act or equivalent protections would not normally apply according to their own terms. Importantly, the bill authorises the face identification service, involving, as I mentioned, one-to-many matching, to be used only for limited purposes. It can only, under the terms of the bill, be used for the purposes of allowing a person to adopt a lawfully assumed identity as in the case, for example, of undercover police or a person entering witness protection. In these cases using the face identification service would allow an agency to check whether the person was vulnerable to being identified from existing databases so that their identity can be scrubbed to ensure their safety. The bill otherwise contains provisions authorising the collection, use and disclosure of information; offence provision to protect information; and miscellaneous provisions dealing with the reporting and publication of information.

The second piece of legislation before the House is the Identity Verification Services (Consequential Amendments) Bill. The bill amends the Australian Passports Act to provide a legal basis for the disclosure of personal information for the purposes of participating in the identity verification services. It enables automated disclosures of information via the DVS or the FVS.

The legislation that is before the chamber today has come in a process that is characteristic, unfortunately, of the arrogance and presumption that all too often typify the operation of the Albanese Labor government. There was little notice that it was coming. There's been no regulatory impact analysis. It appears that there was no consultation with industry. Indeed, one of the largest users of the Document Verification Service in Australia has told the opposition that they did not even know the legislation was in the parliament. This particular organisation conducts millions of searches of the DVS every year to meet the customer due diligence requirements designed to prevent terrorism financing and money laundering, and this organisation did not know the bill existed.

What operation impact would this bill have on their business? Will this bill disrupt the provision of ordinary financial services? These are all very good questions to which the answers, at this stage, are manifestly unclear. And there are more questions. What, if any, are the wider implications for the Australian economy? Do the participation agreements, the NDLFRS hosting agreement and access policy envisaged by the bill work in practice? Are they effective in protecting privacy? We do not know, and it seems the government chose not to ask.

Further, the views of the state and territory governments are unclear, even though they are the ones that provide the driver license photos that so significantly enhance the effectiveness of the face matching services. The Senate committee inquiring into the legislation has just begun its work. Already some of the written submissions are starting to ring alarm bells. For example, in a quite remarkable submission, the Office of the Australian Information Commissioner said that the assessment revisions at clause 40 are 'unusual' because they do not activate the OAIC's usual assessment regulatory powers. The OAIC went even so far as to state, 'The bill does not provide a clear framework for the OAIC to enforce these agreements.' As anybody who is a student of bureaucratic language would know, that is pretty strong criticism.

In spite of these unresolved issues, we know the Attorney-General intends to press ahead with a vote in the House even before the Senate committee holds its first hearing. Regrettably, Australians will not get a chance to properly understand or consider the laws that their parliamentarians in this place are being asked to pass even though it is the personal information of Australians that is affected. Surely this reckless approach can only undermine trust in the operation of Australia's identity verification services and identity policy more broadly.

Having explained what these bills are, it's important to recognise what they could have been. This is not the first time the parliament has been asked to deal with identity legislation. Like much of the legislation that we have seen from the Albanese Labor government, these bills draw on and are based on coalition legislation, at least in theory. In 2018, the coalition introduced the Identity-matching Services Bill and a related bill amending the Australian Passports Act. We referred them to the Parliamentary Joint Committee on Intelligence and Security. Together they lapsed at the 2019 election, and we reintroduced them. This government would have you believe that the bills currently before the House are successors to these original coalition bills, but scratch beneath the surface and much has changed—indeed, almost changed beyond recognition.

The coalition bills were not solely about identity matching. The coalition bills aimed to give effect to commitments made by the Commonwealth government in an intergovernmental agreement with all of the states and territories. That agreement is called the Intergovernmental Agreement on Identity Matching Services, and the very first page describes it as:

An Agreement to share and match identity information, with robust privacy safeguards, to prevent identity crime and promote law enforcement, national security, road safety, community safety and service delivery outcomes.

The coalition's bills dealt with services to share and match identity information with robust privacy safeguards for the purposes of preventing identity crime and promoting law enforcement, national security, road safety, community safety and service delivery outcomes. None of these purposes are addressed by the bill which is now before the House. The only point at which national security is mentioned in a substantive way in either the main bill or the explanatory memorandum is in relation to a clause which allows the secretary to redact participation agreements. This is despite the states and territories having agreed to share photos and data for the express purposes of identity protection and community safety. This raises many questions. What gaps have been left by the Attorney-General's failure to follow through on the purposes of the intergovernmental agreement? Has he weakened our national security? Is he asking police to fight crime with their hands tied? Is he opening the door to fraudsters and identity thieves? Will our roads be more dangerous? We should know these things before we vote.

The intergovernmental agreement dealt with a range of services, including the One Person One Licence Service and the Facial Recognition Analysis Utility Service. These services would have made it possible to detect unlicensed and disqualified drivers, as well as persons with multiple licences obtained fraudulently. These services were dealt with in the coalition bill; they are not even mentioned in Labor's legislation. In fact, the previous legislation is not mentioned in the bill or the explanatory memorandum at all. What is also not mentioned is the fact that the coalition bills were previously considered by the Parliamentary Joint Committee on Intelligence and Security. Why is that not mentioned? Perhaps it is because it shines a very unflattering light on the conduct of the Attorney-General.

The Attorney-General sat on the PJCIS when in opposition and scrutinised these coalition bills. A review of the public hearing transcripts suggests he was very keen to avoid following through on the national security obligations. As the Attorney-General knows, the PJCIS recommended the bills be redrafted and then come back to the PJCIS. Instead, the Attorney-General has redrafted the bills and, in doing so, ensured that they do not include the safety and security functions that our state and territory partners might expect. He's graciously taken the view that, because of the way he redrafted them, it was not necessary for him to refer them back to the PJCIS, even though he, himself, sitting on that committee, contributed to the request that the bills come back to the PJCIS.

This bill has serious implications for the delivery of government services and payments in Australia's digital economy. Identity verification services such as the DVS and FVS are well-established and well-understood mechanisms to support Australians who, for various reasons, need to prove who they are. The usage statistics bear this out. In 2022 the Document Verification Service was used over 140 million times by approximately 2,700 government agencies and industry organisations. In 2022-23, there were approximately 2.6 million Face Verification Service transactions. Both the DVS and the FVS are, in fact, the only national capability that can be used by both government and industry alike. The operation of these services, then, is of particular importance to the daily lives of millions of Australians.

This is particularly the case for Australians who opt to use a myGovID, the government backed digital identity that is used by Australians every day to access over 130 federal, state and territory services. The myGovID is operated by the Australian Taxation Office with technical support provided by Services Australia. It's a proud coalition legacy. It was created by the coalition government and was a key component of our Digital economy strategy. It anchored the trusted digital identity framework we established to allow for whole-of-government and whole-of-economy participation in a safe and voluntary digital identity system.

Australians are continuing to put their trust in myGovID. In late 2021 there were six million myGovID accounts; there are now 11.3 million myGovID accounts. Setting up the myGovID relies on the operation of the DVS and FVS. The myGovID has a three-tiered strength rating: basic, standard and strong. The government service Australians choose to access determines the minimum identity strength one needs. In order to increase the strength of a myGovID, a user must verify their identity against existing government records. For example, a user wanting to apply online for a tax file number would need to obtain a strong myGovID. This is achieved by verifying the validity of an Australian passport and other routine identity documents, such as a Medicare card, and undergoing a face verification check. The check is completed via the FVS and provides one-to-one matching to identify biometric information, with consent, against a Commonwealth credential, the Australian passport. Having established a strong myGovID, an Australian could choose, for example, to access Centrelink services online or apply entirely online for a tax file number. Very clearly then, the DVS and FVS undergird the entire operation of myGovID. It is appropriate, therefore, that this bill establishes a legislative basis for the continued operation of these vital services, with new and enhanced protections for users baked in and establishing new government and oversight mechanisms. This is a policy rationale the government has taken up and one that the former coalition government also supported.

The economic case for digital identity is strong and persuasive. A 2019 research inquiry from the McKinsey Global Institute found that extending full digital identity coverage could unlock economic value equivalent to three to 13 per cent of GDP by 2030. This research was cited in the coalition's regulation impact statement, which accompanied our exposure draft of the trusted digital identity bill. The same statement cited World Economic Forum analysis, which estimated that 70 per cent of new value created in the economy over the next decade is expected to be delivered by digitally enabled platforms. The assumption in both of these reports is that digital identity systems extend across the economy and that they have been constructed by government and business to be interoperable or at least complementary to each other. Only by allowing for digital identity to be truly whole-of-economy in this way will we see the full range of benefits flow. This must be mission-critical for the government—to support the voluntary take-up of digital identity by businesses and consumers, not just by government.

There is other research that has quantified the advantages of extending digital identity coverage. Australia Post's 2016 paper A frictionless future for identity management quoted a figure of $11 billion per annum in benefits. In recent months, the capacity of digital identity to address fraud and identity crime has attracted significant attention. The cyber breaches at Optus, Medibank and Latitude Financial amongst many others have highlighted some of the risks attached to today's common practice that businesses hold large amounts of customers' personally identifiable information. There is a challenge for businesses given the tension between the requirements that presently exist under, for example, the anti-money laundering arrangements and 'know your customer' legislation and the growing and well-based anxiety amongst Australians about companies holding large amounts of their personal data. Digital identity is a practical tool that can help de-risk businesses by reducing the volume of data that they hold and can also help customers to stay in control of their data.

Given the importance of digital identity to Australia's economic prosperity, you would think that the Albanese Labor government would have shown great focus on setting up Australia for success in this vital area. Regrettably, the opposite has been the case. Digital identity policy has been treated as an afterthought by the Albanese Labor government. In the government services space, this government has shown enormous enthusiasm for the old-school paper based, union led, over-the-counter modes of work that characterised previous centuries and do not respond well to the clear preferences of Australians to engage with government digitally. You'd have to search very hard to find any reference at all being made to digital identity by those opposite when they were in opposition. You can, however, find many references to the centrality of the union movement, and we know they are no friends at all of digital transformation and of serving customers better. Regrettably, that lack of interest in the digital economy and in the efficiencies that digital identity can provide has carried over from opposition to government. There's no digital economy minister. There's no digital economy strategy under this government. The previous government had both.

It's true that there's $24 million in the budget to progress the take-up and maturity of digital identity, but that pales in comparison to a commitment by the previous coalition government of over $600 million. It has taken the present government 18 months to even give the Australian people a glimpse of an exposure draft of digital ID legislation. The reason for this delay has been completely unexplained, given that there was exposure draft legislation released by the previous government. The current government was certainly not starting from nothing. But they've shown a lack of commitment, and responsibility for digital identity has been passed around between ministers and departments. In July, we learned that digital identity policy had been stripped away from the Digital Transformation Agency and handed over to the Attorney-General's Department. The Digital Transformation Agency has been completely nobbled by this government, and that is bad news for anybody who wants to see a meaningful plan for whole-of-government digital and data uplift.

I conclude by making the point that there are too many unknowns for the opposition to support these bills as they stand. We will consider our position carefully, including through the committee process. Once the committee has completed its review and it has been possible to properly consider these questions and the answers that have been provided, it may be that the opposition will be in a position to support these bills at that time. I simply cannot make a commitment on that now.

At their heart, these bills involve a good idea and follow a policy direction that was set down by the former government; but they also represent a missed opportunity, a failure to follow through on commitments and a botched process. These bills need proper scrutiny, and this opposition will not be waiving anything through until that proper scrutiny has occurred. I thank the House.