Australian Passports Amendment (2024 Measures No. 1) Determination 2024

EXPLANATORY STATEMENT

Issued by the Authority of the Minister for Foreign Affairs (the Minister)

Australian Passports Act 2005

Legislative Authority

Section 57 of the Australian Passports Act 2005 (the Passports Act) provides that the Minister may by legislative instrument, specify any of the matters that the Passports Act provides may be specified in a Minister’s determination. Further, section 46 of the Act provides that the Minister may disclose personal information, of a kind specified in a Minister’s determination, to a person specified in a Minister’s determination, for purposes including participating in the Document Verification Service, the Face Verification Service or any other service specified, or of a kind specified, in the Minister’s determination.

Purpose

The purpose of the Australian Passports Amendment (2024 Measures No. 1) Determination 2024 (the Amendment) is to amend the Australian Passports Determination 2015 (the Determination) to provide a clear legal basis for the Minister to disclose personal information for the purpose of participating in the Document Verification Service or the Face Verification Service.

To continue operating effectively, identity verification services depend on the ability to verify or match the biometric or biographic information on a person’s identity credential against Commonwealth, state and territory government records. An Australian Passport is one such identity credential that is relied upon by government and industry to verify their customer’s identity through the identity verification services.

Background

The Identity Verification Services Act 2023 (the IVS Act) provides a legislative framework to support the operation of the identity verification services. The IVS Act supports the efficient and secure operation of the services without compromising the privacy of the Australian community.

Among other objectives, the IVS Act authorises 1:1 matching of identity through the identity verification services, with the express consent of the relevant individual, by public and private sector entities. This is enabled by:

the Document Verification Service (DVS), which provides 1:1 matching to verify biographic information (such as a name or date of birth), with express consent, against government issued identification documents.
the Face Verification Service (FVS), which provides 1:1 matching to verify biometric information (a photograph or facial image of an individual), with express consent, against a Commonwealth, state or territory issued identification document.

The IVS Act is supported by the Identity Verification Services (Consequential Amendments) Act 2023 (Consequential Amendments Act) which amends the Passports Act to authorise the operation of the DVS and FVS in relation to Australian travel documents regulated by the Passports Act.

The amendments also allow for automated disclosures of personal information to a specified person via the DVS or the FVS.

Commencement of the Consequential Amendments Act

The Consequential Amendments Act, which provides for amendment to the Determination, commences on the later of the day after the Consequential Amendments Act receives Royal Assent, or commencement of section 24 of the IVS Act.

Section 24 of the IVS Act will commence on either the commencement of rules made under section 44 of the IVS Act, or six months after the day the IVS Act receives royal assent, whichever is first.

Other Matters

Details of the Amendment are set out at Attachment A.

The Amendment is a legislative instrument for the purposes of the Legislation Act 2003.

This Disallowable Legislative Instrument is compatible with the human rights and freedoms recognised or declared in the international instruments listed in section 3 of the Human Rights (Parliamentary Scrutiny) Act 2011. The Statement of Compatibility with Human Rights is at Attachment B.

The Office of Impact Analysis has confirmed that an Impact Analysis is not required (Reference Number OIA23-05862).

ATTACHMENT A

Details of the Australian Passports Amendment (2024 Measures No. 1) Determination 2024

Section 1 – Name

This section provides that the name of the instrument is the Australian Passports Amendment (2024 Measures No. 1) Determination 2024 (the Amendment).

Section 2 – Commencement

This section provides for the commencement of the Amendment, as set out in the table in subsection 2(1).

Column 2 of the Table in subsection 2(1) provides for the whole of the Amendment to commence on the later of the day after registration, or immediately after commencement of the Identity Verification Services (Consequential Amendments) Act 2023.

Subsection 2(2) provides that any information in column 3 of the table is not part of the Amendment. Information may be inserted in this column, or information in it may be edited, in any published version of the Amendment.

Section 3 – Authority

This section provides that the instrument is made under the Australian Passports Act 2005 (the Passports Act).

Section 4 – Schedules

This section provides for each instrument in the Schedule to be amended as set out in the Schedule to the Amendment. The instrument to be amended is:

 the Australian Passports Determination 2015 (the Determination).

Schedule 1 – Amendments

Schedule 1 to the Amendment provides for the amendments to the Determination.

Schedule 1—Amendments

Australian Passports Determination 2015

Items 1 to 4

Items 1 to 4 update references, in subsection 23(2) of the Determination, to section 46 of the Act. The table items being amended authorise disclosure of information for the purposes of:
- Subsection 23(2) table item 2 - confirming or verifying information relating to an applicant for an Australian travel document or a person to whom an Australian travel document has been issued (updating previous section 46(a) to 46(1)(a)).
- Subsection 23(2) table item 3 - facilitating or otherwise assisting the international travel of a person to whom an Australian travel document has been issued (section 46(b) updated to 46(1)(b)).
- Subsection 23(2) table item 4 - law enforcement (section 46(c) updated to 46(1)(c)).
- Subsection 23(2) table item 5 - the operation of family law and related matters (section 46(d) updated to 46(1)(d)).

2. These amendments are editorial, reflecting numbering changes in the Act. No policy change is given effect by these amendments.

Item 5

3. Item 5 supports new paragraph 46(1)(da) of the Passports Act. Paragraph 46(1)(da) authorises disclosures by the Minister for the purpose of participating in

the Document Verification Service (DVS) or the Face Verification Service (FVS) established under the Identity Verification Services Act 2023 (the IVS Act) (new subparagraphs 46(1)(da)(i) to (ii)), or
any other service, specified or of a kind specified in the Minister's determination (new subparagraph 46(1)(da)(iii).

4. Specifically, new item 5A identifies to whom and in what circumstances the Minister may disclose information for the purposes of participating in the identity verification services to share or match information relating to the identity of a person, and what information may be disclosed. It permits the Minister to disclose the type of personal information specified in column 2 to a person identified in column 3.

5. The DVS and FVS are 1:1 matching services that are used to securely verify the identity of Australians when providing access to critical services and functions.

6. To continue operating effectively, identity verification services depend on the ability to verify or match the biometric or biographic information on a person’s identity credential against Commonwealth, state and territory government records. An Australian Passport is one such identity credential that is relied upon by government and industry to verify their customer’s identity through the identity verification service, and is the only government issued identity credential that can currently be used for biometric verification of identity via the FVS. Biometric verification is a highly secure way of verifying identity and is currently required to create a ‘strong’ myGovID which is needed to access certain Centrelink and Australian Taxation Office services.

7. Column 2 of new item 5A at subsection 23(2) of the Determination defines the type of personal information the Minister may share or match by way of participating in the DVS or FVS. It includes:

data page information, which means any information that is shown on the data page of a person’s Australian travel document. The types of information are defined at existing subsection 23(3) of the Determination, and include a person’s biometric and biographic information, and administrative information about the travel document such as the number and type, date and place of issue, date of expiry, and authority.
status information, which means the status of a person’s Australian travel document, including whether it is valid, lost, stolen, or restricted.
request information, which means information necessary to resolve an authorised request for disclosure of personal information made under section 46 of the Act.
authenticity information, which includes information that establishes the authenticity of an applicant for, or person holding, an Australian travel document.

8. Column 3 at new item 5A at subsection 23(2) of the Determination is intended to authorise the provision of information (outlined in column 2) to a person receiving it for a requesting party by or on whose behalf a service that meets the requirements to be a DVS under section 15 of the IVS Act, or an FVS under section 19 of the IVS Act is requested. This means the information will only be authorised to be provided to a person receiving it for a requesting party that is a party to a participation agreement, unless the service is a DVS that is requested during the period referred to in subsections 15(2) and 15(3) of the IVS Act.

9. Section 15 and 19 of the IVS Act defines a DVS and an FVS respectively. These provisions also lay out what the requirements are for a request for, or disclosure of, information to be classified as a DVS or an FVS.

10. For the purposes of this determination, and in the context of the identity verification services, the meaning of ‘requesting party’ is reflected at paragraph 15(1)(a) of the IVS Act. In practice, requesting parties will be a party to a participation agreement under the IVS Act, unless the service is a DVS that is requested during the period referred to in subsections 15(2) and 15(3) of the IVS Act.

11. Section 8 of the IVS Act defines a participation agreement as a written agreement, between the Department (representing the Commonwealth) and one or more other parties, that:

deals with the requesting and provision of identity verification services of one or more kinds using identification information made available by the parties; and
meets the requirements in sections 9, 10, 11 and 12 of the IVS Act.

12. Subsection 19(a) of the IVS Act means that, in all circumstances, a requesting party for an FVS will be a party to a participation agreement. Similarly, requesting parties for a DVS are required to be a party to a participation agreement because of paragraphs 15(1)(b) of the IVS Act.

13. However, subsection 15(2) of the IVS Act provides that the requirements for a participation agreement to be in place to use and provide a DVS do not apply in relation to a service requested within 12 months after the commencement of section 15 of the IVS Act. The Minister responsible for administering the IVS Act is empowered to make rules to further delay the requirement for participation agreements to be in place for a DVS for another 6 months.

14. The Passports Act does not authorise the Minister to participate in the Face Identification Service as defined by section 16 of the IVS Act.

15. As reflected in the note at the end of the current section 46 of the Act, information disclosed under new paragraph 46(1)(da), including the type of information and to whom it is disclosed at new item 5A (of subsection 23(2)) of the Determination, must be dealt with in accordance with the Australian Privacy Principles.

Item 6

16. Item 6 updates reference, in subsection 23(2) of the Determination, to section 46 of the Act. The table item amended authorises disclosure of information for the purposes of:

Subsection 23(2) table item 6 – for the purpose of a law of the Commonwealth specified in the Minister’s Determination (paragraph 46(e) updated to paragraph 46(1)(e)).

17. This amendment is editorial, reflecting numbering changes in the Act. No policy change is given effect by this amendment.

ATTACHMENT B

Statement of Compatibility with Human Rights

Prepared in accordance with Part 3 of the Human Rights (Parliamentary Scrutiny) Act 2011

Australian Passports Amendment (2024 Measures No. 1) Determination 2024 (the Amendment)

Overview of the Disallowable Legislative Instrument

The Australian Passports Amendment (2024 Measures No. 1) Determination 2024 is a disallowable legislative instrument that amends the Australian Passports Determination 2015 (the Determination) to provide a clear legal basis for the Minister to disclose personal information for the purpose of participating in the Document Verification Service (DVS) or the Face Verification Service (FVS).

The principal object of the Australian Passports Act 2005 (the Passports Act) is to provide for the issue and administration of Australian passports. The Determination remains a critical instrument for the implementation of the Passports Act.

The Determination covers:

the issue of travel-related documents;
special circumstances for the issue of a passport to a child;
competent authorities for making a passport refusal/cancellation request for matters relating to law enforcement, international law enforcement or potential for harmful conduct;
offences for the purpose of making a passport refusal/cancellation request.
validity periods for different travel documents;
concurrent, diplomatic, and official passports;
when travel documents are not valid;
disclosure of personal information for limited purposes;
exceptions for a name that may appear on a person’s travel document;
waivers and refunds of fees;
delegations and reviewability of decisions.

The Amendment provides for the following:

the automated disclosures of personal information to a specified person, in line with authority provided at new paragraph 46(1)(da) of the Passports Act.
supports the operation of the DVS and FVS in relation to Australian travel documents regulated by the Passports Act.

Background

The Identity Verification Services Act 2023 (the IVS Act) establishes new primary legislation that provides a legislative framework to support the operation of the identity verification services. The IVS Act supports the efficient and secure operation of the services without compromising the privacy of the Australian community.

Among other objectives, the IVS Act authorises 1:1 matching of identity through the identity verification services, with express consent of the relevant individual, by public and private sector entities. This is enabled by:

the Document Verification Service, which provides 1:1 matching to verify biographic information (such as a name or date of birth), with consent, against government issued identification documents.
the Face Verification Service, which provides 1:1 matching to verify biometric information (a photograph or facial image of an individual), with consent, against a Commonwealth, state or territory issued identification document.

The IVS Act is supported by the Identity Verification Services (Consequential Amendments) Act 2023 (the Consequential Amendments Act) which amends the Australian Passports Act 2005 (Passports Act) to authorise the operation of the DVS and FVS in relation to Australian travel documents regulated by the Passports Act.

The amendments allows for automated disclosures of personal information to a specified person via the DVS or the FVS.

Human rights implications

This Disallowable Legislative Instrument engages the following human rights:

Protection against arbitrary or unlawful interference with privacy contained in Article 17 of The International Covenant on Civil and Political Rights (ICCPR)
The right to social security contained in Article 9 of The International Covenant on Economic, Social and Cultural Rights (ICESCR)
The right to equality and non-discrimination contained in Article 2
The right to freedom of expression contained in Article 19.

Protection against arbitrary or unlawful interference with privacy contained in Article 17 of the ICCPR

Article 17 of the ICCPR prohibits arbitrary or unlawful interference with a person’s privacy, family, home or correspondence and unlawful attacks on a person’s honour or reputation. It also provides that everyone has the right to the protection of the law against such interference or attacks.

The right to privacy articulated in Article 17 may be subject to permissible limitations that are authorised by law, are not arbitrary, pursue a legitimate objective, are necessary to achieve that objective, and are a proportionate means of achieving it. For an interference with the right to privacy not to be arbitrary, the interference must be for a reason consistent with the provisions, aims and objectives of the ICCPR and be reasonable in the particular circumstances. The United Nations Human Rights Committee has interpreted ‘reasonableness’ in this context to mean that ‘any interference with privacy must be proportional to the end sought and be necessary in the circumstances of any given case’[1].

The Amendment engages Article 17 by amending subsection 23(2) of the Determination to authorise the Minister to disclose prescribed personal information contained in Australian travel documents to particular persons for the purpose of participating in the DVS or FVS. This will allow personal information contained on Australian travel documents to be used to share or match information relating to the identity of a person.

The amendments to the Determination may limit the privacy rights of individuals whose personal information is contained on an Australian travel document and disclosed for the purpose of DVS or FVS. This is because the information being authorised to be disclosed through the Amendment is personal in nature and includes a person’s facial image, name, date of birth and other biographical information.

The purpose of the limitation is to enable Australian travel documents to be used in the provision of identity verification services. Secure and efficient identity verification is critical to minimising the risk of identity fraud and theft, and protecting the privacy of Australians when seeking to access government and industry services and engage with the digital economy. The limitation on the right through the disclosure of personal information on Australian travel document is considered proportionate and directly related to the policy intent being sought to guard against identity fraud and protect Australians when seeking access to digital services.

The IVS Act, Australian Passports Act and the Privacy Act provide safeguards and limitations to protect privacy in relation to the proposed amendments. Furthermore, the overall benefits to the Australian community from these amendments ensures that any limitation on the right to privacy resulting from these amendments is reasonable, necessary, and proportionate.

Passport Act Privacy protections and safeguards

As reflected in the note at the end of the current section 46 of the Australian Passports Act, information disclosed under new paragraph 46(1)(da) must be dealt with in accordance with the Australian Privacy Principles. This means that, for example, Australian Privacy Principle 6 would apply, which will place limitations on the use or disclosure of personal information that was collected as a result of new paragraph 46(1)(da).

The Amendment also includes a range of safeguards and limitations to ensure that the disclosure of personal information as a result of new paragraph 46(1)(da) for the purposes of the DVS and FVS is reasonable and proportionate.

IVS Act privacy protections and safeguards

The IVS Act includes a range of safeguards and limitations to ensure that the disclosure of personal information as a result of the Amendments to subsection 23(2) of the Determination are reasonable and proportionate. Many of these privacy safeguards will be reflected in a participation agreement.

All entities accessing identity verification services will be required to be a party to a participation agreement in respect of the relevant service, including both government and non-government entities. In order to be a party to a participation agreement, the party must either be subject to the Privacy Act, subject to a privacy law of a state or territory, have agreed to comply with the Australian Privacy Principles, or are a prescribed government authority.

The agreement outlines the respective roles, rights and obligations to each party when participating in, and accessing and using, the identity verification services. The IVS Act requires participation agreements to include minimum security standards, privacy obligations and reporting requirements for each party. These include obligations to:

obtain an individual’s express and informed consent to the collection, use and disclosure, for the purposes of requesting identity verification services, of identification information that relates to the individual included in such a request;
undertake privacy impact assessments of requesting identity verification services.
establish and maintain arrangements for dealing with complaints by individuals whose identification information is held by the party;
notify the Department of any breaches of security in relation to the identity verification services;
not disclose identification information received as a result of identification verification services requested by the party unless required by law;
to take reasonable steps to destroy a facial image that was collected to request the use of the FVS if it is no longer required for that purpose, unless the image is a Commonwealth record, or is required by law or a court or a tribunal.

The Minister is further empowered to make rules to prescribe additional privacy obligations that must be met by parties to participation agreements.

Non-compliance with a participation agreement may cause parties to the agreement to have their use and access to the identity verification services suspended or terminated. Moreover, for parties to a participation agreement subject to the Privacy Act, non-compliance with a participation agreement constitutes an ‘interference with the privacy of an individual’ for the purposes of section 13 of the Privacy Act.

Other IVS Act safeguards

The IVS Act features a number of other privacy and transparency safeguards relating to personal information disclosed as a result of the amendments to subsection 23(2) of the Determination, including:

a DVS request will only relate to DVS information which is information on a government identification document except for a photograph;
a private sector organisation is limited to receiving either a ‘match’ or ‘no match’ response in relation to an FVS request. This means that the requesting agency will not receive additional information about the individual;
the Information Commissioner will undertake annual assessments of the approved identity verification facilities;
the security of electronic communications to and from the approved identity verification facilities will be protected, including by encrypting the information;
identification information, obtained for the purpose of requesting or providing identity verification services, is prohibited from being used for data profiling, online tracking or marketing;
criminal penalties for Departmental officials and other entrusted persons who record, disclose or access protected information obtained through the provision of identity verification services, unless authorised to do so.

Benefits to the Australian community

Any limitations on the right to privacy from the proposed amendments to the Determination are reasonable and proportionate given the benefits they will provide to the Australian community.

New paragraph 46(1)(da) and new section 46(A) will enable government agencies and industry organisations to verify their customer’s identity through an Australian Passport, which is currently the only government issued identity credential that enables biometric verification.

Biometric verification is a highly secure way of verifying identity and is currently required to create a ‘strong’ myGovID which is needed to access certain Centrelink and Australian Taxation Office services.

Automated disclosures of personal information will also support the continued operation of the identity verification services which is critical to support access to industry and government services without exposing individuals to identity theft and fraud.

2. The right to social security contained in Article 9 of ICESCR

The provision of welfare payments and other benefits are contingent on identity verification to ensure welfare is provided to the correct people and to prevent fraud and misuse of government funds.

The Determination will promote the right to social security by enabling the biometric verification of identity which is currently needed to access certain Centrelink services.

3. The right to equality and non-discrimination contained in Article 2 of the ICCPR

Article 2 of the ICCPR requires states to ensure that individuals are not subject to discrimination based on race, colour, sex, language, religion, political or other opinion, national or social origin, property, birth, or other status. Where not provided states must undertake necessary steps to ensure equality.

The Amendment ensures certain types of information are excluded and cannot be sought or requested through the identity verification services. This information is:

information or an opinion about an individual’s racial or ethnic origin, political opinions, membership of a political association, religious beliefs or affiliations, philosophical beliefs, membership of a trade union, sexual orientation or practices, or criminal record,
health information about an individual (as defined in section 6FA of the Privacy Act) and
genetic information about an individual

4. The right to freedom of expression contained in Article 19 of the ICCPR

Article 19 of the ICCPR provides that everyone shall have the right to freedom of expression, including the freedom to seek, receive and impart information and ideas of all kinds.

Article 19(3) of the ICCPR provides that this right may be limited on grounds including respect for the rights of others, or the protection of national security or public order. Any limitations must be prescribed by legislation and be reasonable, necessary, and proportionate to achieve the desired purpose.

The Amendment includes the right to freedom of expression by making it an offence for an entrusted person to make a record of, disclose, or access protected information.

This limitation is reasonable given the sensitive nature of the information to which entrusted persons will have access, and implications for an individual if their identification information is unnecessarily disclosed. The limitation is proportionate to protect the privacy of individuals and is one of the key privacy safeguards.

Conclusion

The Disallowable Legislative Instrument engages human rights, and to the extent that it may limit human rights, those limitations are reasonable, necessary, and proportionate. in achieving a legitimate objective - to issue passports and travel-related documents.

[1] UNHRC, The right to privacy in the digital age, UN Doc A/HRC/27/37, 30 June 2014, paragraph 21, quoting United Nations Human Rights Committee, Toonen v. Australia, Communication No. 488/1992, paragraph 8.3.

Administered by Department of Foreign Affairs and Trade

Interactions

Legislation content

Interactions

Authorises

All Versions