IDENTITY vERIFICATION sERVICES AMENDMENT (Participation agreements) RULES 2025

EXPLANATORY STATEMENT
 

Issued by authority of the Attorney-General

under section 44 of the Identity Verification Services Act 2023

Purpose and operation of the Instrument

The identity verification services are a series of automated national services offered by the Commonwealth to allow government agencies and industry to efficiently compare or verify personal information on identity documents against existing government records, such as passports, driver licences and birth certificates. The Identity Verification Services Act 2023 (the Act) provides a legislative framework to support the secure and efficient operation of the identity verification services, subject to strong privacy safeguards and oversight arrangements.

Subsection 44(1) of the Act provides that the Minister may, by legislative instrument, make rules prescribing matters required or permitted by the Act to be prescribed by the rules, or necessary or convenient to be prescribed for carrying out or giving effect to the Act.

The Identity Verification Services Rules 2024 (IVS Rules) prescribe matters which are needed to support the operation of the identity verification services and are required or permitted to be made under the Act. The Identity Verification Amendment (Participation Agreements) Rules 2025 (Amendment Rules) will, for the purposes of paragraph 15(3)(b) of the Act, amend the IVS Rules to prescribe a longer transition period of 18 months for the finalisation of participation agreements between Document Verification Service (DVS) users and the Attorney-General’s Department. This amendment has the effect to extend the transition period from 12 months to 18 months.

As provided by subsection 44(1) of the Act, the Rules and any amendments, would be a legislative instrument for the purposes of the Legislation Act 2003 (Cth) (Legislation Act).

Subsection 44(3) of the Act means that the Amendment Rules will be subject to parliamentary oversight and scrutiny through the disallowance process provided in the Legislation Act.

Subsection 44(4) of the Act clarifies that the IVS Rules, including any amendments, will also be subject to sunsetting after 10 years. Sunsetting is an important scrutiny and transparency measure that will ensure the IVS Rules are reviewed for currency and ongoing need.

Details of the Rules are set out in Attachment A.

Consultation

Before making the Amendment Rules, and as required by subsection 44(1B) of the Act, the Attorney‑General published a draft of the Amendment Rules on the department’s website and invited public submissions. The consultation opened on 5 May 2025 and closed on 2 June 2025. The department received 14 submissions from key private sector and government DVS users, as well as organisations that represent a multitude of DVS users or facilitate their access to the DVS.  

13 of the 14 submissions were strongly supportive of amending the IVS Rules to extend the transition period to sign participation agreements. One submission was neutral on the extension.

IMPACT ANALYSIS

The Office of Impact Analysis advised that an Impact Analysis is not required as the Amendment Rules are unlikely to have a more than minor impact [OIA25-09399].

Statement of Compatibility with Human Rights

Prepared in accordance with Part 3 of the Human Rights (Parliamentary Scrutiny) Act 2011

The Identity Verification Services Amendment (Participation Agreements) Rules 2025 (Amendment Rules) are compatible with the human rights and freedoms recognised or declared in the international instruments listed in section 3 of the Human Rights (Parliamentary Scrutiny) Act 2011.

Overview of the legislative instrument

The purpose of the Amendment Rules is to provide an effective 6-month extension on the current statutory deadline by which DVS users need to enter participation agreements with the Commonwealth.

The Amendment Rules reflect the outcome of public consultations with key DVS users, including government and private sector users.

The Rules are consistent with subsection 44(2) of the Act which places important limitations on the scope of the rule-making power to ensure that any rules the Minister makes cannot:

•          create an offence or civil penalty

•          provide powers of arrest, detention, entry, search or seizure

•          impose a tax

•          set an amount to be appropriated from the Consolidated Revenue Fund under an appropriation in this Act, or

•          directly amend the text of the Act.

The identity verification services are a series of automated national services offered by the Commonwealth to allow government agencies and industry to efficiently compare or verify personal information on identity documents against existing government records, such as passports, driver licences and birth certificates. Within the identity verification services, the DVS is a service used to verify the biographic details – names, dates of birth, Medicare numbers and the like – of identity documents.

The operation of the identity verification services is subject to strong privacy safeguards, security measures and oversight measures outlined in the Act. This ensures that the community can benefit from secure and fast identity verification, without compromising their personal information. It also supports more Australians to establish a Digital ID in order to access critical services, and will support broader efforts to reduce identity crime.

Human rights implications

The measure introduced in Item 1, extending the deadline to finalise participation agreements, engages the prohibition on interference with privacy under article 17 of the International Covenant on Civil and Political Rights (ICCPR).

The prohibition on interference with privacy contained in article 17 of the ICCPR

Article 17 of the ICCPR prohibits unlawful or arbitrary interference with a person’s privacy, family, home and correspondence, and prohibits unlawful attacks on a person’s reputation. The United Nations Human Rights Committee has interpreted the right to privacy as comprising freedom from unwarranted and unreasonable intrusions into activities that society recognises as falling within the sphere of individual autonomy.

The right to privacy may be limited where the limitation is lawful and not arbitrary. The use of the term ‘arbitrary’ means that any interference with privacy must be in accordance with the provisions, aims and objectives of the ICCPR and should be reasonable in the particular circumstances. The United Nations Human Rights Committee has interpreted ‘reasonableness’ to imply that any limitation must be proportionate and necessary to achieve a legitimate objective.

Extension of deadline for DVS participation agreements

The Act includes important safeguards and protections to ensure that access to, and operation of, the identity verification services does not compromise the privacy of Australians and the security of information. A number of these privacy safeguards and protections are set out in participation agreements, which are agreements between relevant entities and the department, representing the Commonwealth. All entities seeking to make a request for identity verification services must be a party to a participation agreement and meet the privacy obligations and requirements set out in the Act.

The Amendment Rules extend the period of time during which entities can continue to access the DVS without an executed participation agreement created under the requirements of the Act. This limits the right to privacy by delaying the full effects of the privacy protections in the Act by a further 6 months. However, this limitation is proportionate and reasonably necessary to enable the functions of the Act, as the delay is only as long as is required to complete drafting and execution of participation agreements with entities.

The identity verification services, including the DVS, operated prior to the Act’s commencement in 2023. The Act was passed to ensure the services operated with appropriate legislative authority and scrutiny, given their systemic importance to national security, service provision and the digital economy, as well as their ability to infringe on the right to privacy.

The Act constituted a significant transition for current users of the DVS, as it meant that they needed to transition from the access arrangements they had with the Commonwealth prior to the Act to new participation agreements made under the Act. It was critical to maintain access to the DVS in the interim for these users. Disrupting access to the DVS could leave government agencies and private businesses unable to verify the identities of employees, benefit recipients and customers. A disruption could have significant impacts and limit Australians’ access to government services and the digital economy.

To provide a reasonable transition period, subsection 15(2) of the Act provides an exemption for DVS users accessing the service without a participation agreement for a period specified in subsection 15(3). The Act prescribes an initial period of 12 months from the commencement of the provision (15(3)(a)) on 14 June 2024, but authorises the IVS Rules to prescribe a period of up to 18 months (15(3)(b)). The Amendment Rules prescribe this longer period of 18 months, as was within the original contemplation of the Act in the event that a 12-month period was insufficient.

During this period, business users and government agencies accessing the DVS continue to be subject to the existing Terms and Conditions. These Terms and Conditions are available to the public on the IDMatch website, and ensure that DVS users comply with all relevant privacy laws, receive express consent and handle personal information appropriately. This transition period will enable DVS users to make necessary arrangements to implement obligations in participation agreements that further protect privacy by imposing specific requirements for organisations’ privacy policies and information handling.

Conclusion

The Amendment Rules are compatible with human rights and freedoms recognised or declared in the international instruments listed in the definition of human rights in section 3 of the Human Rights (Parliamentary Scrutiny) Act 2011. To the extent that measures in the Amendment Rules limit those rights and freedoms, such limitations are reasonable, necessary and proportionate to a legitimate objective.

Attachment A

NOTES ON SECTIONS

Clause 1 – Name

This section provides that the title of the Amendment Rules is the Identity Verification Amendment (Participation Agreements) Rules 2025.

Clause 2 – Commencement

This section provides for the Amendment Rules to commence the day after the instrument is registered.

Clause 3 – Authority

This section provides that the Amendment Rules are made and given authority under the Identity Verification Services Act 2023.

Clause 4 – Schedules

This section clarifies the interaction of amendments to instruments within the Schedule to the Rules. Where an instrument is amended in a Schedule in this instrument, that amendment (including any repeal) have effect as is contained in the Schedule. Any other item in a Schedule has effect according to its terms.

SCHEDULE 1 – Amendments

Identity Verification Services Rules 2024

Item 1 - Section 6A

Inserts a new section in Part 5 of the IVS Rules as section 6A, which prescribes a period of 18 months for the purposes of section 15(2) of the Identity Verification Services Act 2023 (the Act). Section 15 of the Act defines which services are considered a document verification service (DVS). For a service to be considered a DVS under the Act, a participation agreement must be in place and both requesting users and document issuers must be parties to it. Subsection 15(2) provides a transitional measure for a period after commencement of the Act defined in subsection 15(3) as either 12 months, or a longer period of up to 18 months where prescribed by the Rules.

The purpose of this period is to allow participation agreements to be finalised and ongoing access to crucial services. That period is set to elapse on 14 June 2025, with many participation agreements not yet finalised. DVS users and other stakeholders have indicated to the department that they needed more time to be in a position to sign a participation agreement and expressly requested extensions that exceeded the previously prescribed statutory period. If the period elapses with outstanding participation agreements, existing users would be prevented from using the DVS, which could have serious ramifications for affected private sector DVS users, and would reduce the capacity for Australians to securely prove their identity for the purpose of accessing services. In addition, any disruption to the DVS will undermine the ability for individuals to establish a ‘standard’ myID, and for industry and governments to satisfy legislative requirements. The amendment in Item 3 inserts section 11 into the IVS Rules to prescribe a period of 18 months, setting the deadline for participation agreements to be finalised by 14 December 2025.

This section ensures sufficient time for outstanding participation agreements to be finalised and maintain continuity of access to identity verification services for current users.