48Restrictions on collecting, using and disclosing biometric information

48 Restrictions on collecting, using and disclosing biometric information

(1) An accredited entity may collect, use or disclose biometric information of an individual only if: (a) the collection, use or disclosure is authorised under section 49 or 50; and (b) unless the collection, use or disclosure is authorised under paragraph 49(3)(a) or subsection 49(5), (6) or (8)—the individual to whom the information relates has expressly consented to the collection, use or disclosure of the biometric information.

Civil penalty: 1,500 penalty units.

(2) An accredited entity may retain biometric information of an individual only if the retention is authorised under section 49 or 50.

Note: Section 51 contains rules about destruction of biometric information that has been retained under section 49.

Civil penalty: 1,500 penalty units.

(3) To avoid doubt, and without limiting subsection (1), an accredited entity must not: (a) collect, use or disclose biometric information of an individual for the purpose of one‑to‑many matching of the individual; or (b) collect, use or disclose biometric information of an individual to determine whether the individual has multiple digital IDs. (4) One‑to‑many matching means the process of comparing a kind of biometric information of an individual against that kind of biometric information of individuals generally to identify the particular individual.