Australia’s Identity Verification Services Act of 2023

The IVS Act provides that a request for an identity verification service can be made only by a party to a participation agreement, and only identification information made available by a party to a participation agreement can be used in an identity verification service;

The IVS Act requires all organizations to conduct extensive privacy impact assessments to ensure appropriate protective measures are in place to protect personal data;

Individuals are required to give their express consent for their identification information to be collected, used, and disclosed per the provisions of this Act;

Each party (except the Attorney General Department) must report relevant security breaches to the Department. The Department will then inform the Information Commissioner of serious breaches and notify impacted parties. Notified parties must take reasonable steps to inform affected individuals; 

Any identification information collected for identity verification must be strictly used for this purpose, prohibiting the use of such information in profiling or other marketing-related activities;

The Attorney General’s Office is responsible for administering the Act, along with the authority to introduce rules related to its implementation;

Any rules created by the Attorney General’s Office must be published with invitations for public consultation to ensure appropriate community involvement.