Facial recognition technology – Australia's regulatory framework
Commitments were made by Commonwealth, State and Territory governments to share and match identity information under the 2017 Council of Australian Governments (COAG) agreement on identity matching services.
One of the initial ways in which the COAG agreement is being implemented is through the development of a proposed national driver's licence facial recognition solution. This would allow for comparison of facial images against a collection of driver's license images in that database. We take a look at the current status of that proposal and the steps that need to be taken for its implementation.
What is happening at a State and Territory level?
A number of State and Territory governments have passed legislation to enable implementation of the national driver's licence facial recognition solution. NSW, Victoria, Queensland, South Australia and Tasmania have all passed laws permitting the sharing of driver's licence information. Western Australia, the Northern Territory and the Australian Capital Territory are all in the process of amending their laws to enable them to share their data as well.
Victoria, Tasmania and South Australia were the first states to upload their data into a database which will eventually interface with the national driver's licence facial recognition solution. The remaining States and Territories will follow over the next two years, assuming that the federal legislation necessary to implement the scheme is also passed.
The future of the Identity-matching Services Bill 2019
At a federal level the Identity-matching Services Bill 2019 (IMS Bill) is the proposed statutory vehicle for implementing the identity matching services envisaged by the COAG agreement.
The IMS Bill provides for the identity matching services to be provided via an "interoperability hub" operated by the Federal Department of Home Affairs. The hub would work on a question and response model. Users would not be able to browse the database, but would only have their identity verification questions answered (e.g. "Is this person who she says she is?"). In addition to allowing use by State and Territory governments, the IMS Bill proposes that some private entities, such as banks and telecommunications companies, would also be able to use the services.
The IMS Bill has provoked significant controversy. It has not yet been passed by the Federal Parliament and it is likely that it will require amendment to incorporate greater protections for individuals.
Balancing benefits with privacy
The COAG agreement has many beneficial aims. For example, the national driver's licence facial recognition solution should, once in place, make it harder to use driver's licences for identity theft, improve road safety and provide an easy and secure way to verify someone's identity. This has significant benefits at both a State or Territory level and a Federal level in providing protections for Australians. Other benefits include supporting law enforcement, upholding national security, enhancing community safety and improving service delivery. These benefits however need to be weighed against the important consideration of protecting the privacy of individuals.
The IMS Bill was reviewed by the Parliamentary Joint Committee on Intelligence and Security (Joint Committee) in 2019. Numerous stakeholders raised concerns about the impact on privacy for individuals in their submissions. A common concern was the potential for the services to be used for mass surveillance and tracking. Non-privacy related concerns included the risks of unauthorised access to, and compromise of, the collected identity data.
The Joint Committee, while it supported the aims of the Bill, had serious concerns about the lack of detail and the limited safeguards in relation to the use of highly sensitive information contained in the IMS Bill. It recommended the IMS Bill be redrafted – the first time it has made such a recommendation in a significant period. The Joint Committee's October 2019 report recommends the redraft take into account the following principles:
- the regime should be built around privacy, transparency and subject to robust safeguards
- the regime should be subject to parliamentary oversight and reasonable, proportionate and transparent functionality
- the regime should be one that requires annual reporting on the use of the identity-matching services
- the legislation should specifically require a participation agreement that sets out the obligations of all parties participating in the identity-matching services regime in detail.
These are all sensible recommendations to provide appropriate transparency and safeguards the potential misuse of the services.
Australia's Home Affairs Minister Peter Dutton, who has responsibility for the IMS Bill, has committed to working with the Joint Committee to ensure that the IMS Bill becomes law. The Joint Committee's report will be a very helpful guide in ensuring that the Federal government is able to incorporate in a revised bill appropriate protections while at the same time ensuring that the aims of the legislation are able to be achieved.
When the proposed national driver's licence facial recognition solution is implemented, State and Territory governments will still need to take care to ensure they balance the benefits of use of the solution with ensuring the protection of the privacy of Australians.
This publication does not deal with every important topic or change in law and is not intended to be relied upon as a substitute for legal or other advice that may be relevant to the reader's specific circumstances. If you have found this publication of interest and would like to know more or wish to obtain legal advice relevant to your circumstances please contact one of the named individuals listed.