Hundreds of millions of australian identity checks may have been illegally conducted

Hundreds of millions of identity checks under the federal government’s ID verification service may have been illegally conducted, with the Albanese government rushing through legislation to underpin the service.

Identity verification services are used by government departments and businesses – such as credit card providers and power companies – to combat fraud and identity theft.

Legislation to allow the identity verification service was abandoned by the former Morrison government in 2019 after the parliamentary joint committee on intelligence and security recommended it be redrafted over concerns there were insufficient privacy safeguards for the proposal.

However, the service began operating and, four years on, the Albanese government has pushed through new legislation in the House of Representatives. It is now under review in the Senate.

Part of the rush, according to witnesses at the Senate inquiry on Monday, was that verification services linking up the state and territory ID systems to businesses carrying out ID checks appeared to have been operating without a legislative framework. This would make them illegal.

The Greens senator David Shoebridge asked the Digital Rights Watch chair, Lizzie O’Shea, if the speed at which the legislation was being pushed through parliament was to shield the government from unlawful practice of the service.

“I think there’s a real question about the legality of the scheme, and the haste is about protecting the government from liability,” O’Shea said.

In 2022 alone, the Document Verification Service was used more than 140m times by 2,700 public and private sector organisations. In the last financial year there were about 2.6m transactions of the Facial Verification Service by government agencies.

The Human Rights Law Centre senior lawyers Kieran Pender and David Mejia-Canales said in a submission to the inquiry that there was no evident federal legislative basis for either system.

“It is extraordinary that the Australian government is, it seems, presently using identity-verification services on a mass scale without a lawful basis. And it is all the more extraordinary that the Australian government would seek to rush through such important legislation, with minimal opportunity for parliamentary scrutiny, in these circumstances.”

When Shoebridge asked the attorney general’s department first assistant secretary, Tara Inverarity, whether the system had been operating to date unlawfully, she said she could not comment on legal advice, but said it was “highly desirable” for a legislative framework to be in place.

“We think there are extremely good reasons why the services that are being provided now should have appropriate legislative authority that provides parameters within which the services can be used that have been set by the parliament.”

Shoebridge said the legislation appeared to be rushed, not to protect privacy and data, but to protect the government from litigation.