49Authorised collection, use and disclosure of biometric information of individuals—general rules

49 Authorised collection, use and disclosure of biometric information of individuals—general rules

(1) An accredited entity is authorised to collect, use or disclose biometric information of an individual if: (a) the accredited entity’s conditions on accreditation authorise the collection, use, or disclosure of the biometric information; and (b) the biometric information of the individual is collected, used or disclosed for the purposes of the accredited entity doing either or both of the following: (i) verifying the identity of the individual; (ii) authenticating the individual to their digital ID. (2) An accredited entity is authorised to collect, use or disclose biometric information of an individual if: (a) the biometric information is contained in a verifiable credential that is in the individual’s control; and (b) the Accreditation Rules prescribe requirements relating to the collection, use or disclosure of the biometric information; and (c) the collection, use or disclosure complies with those requirements. (3) An accredited entity is authorised to disclose biometric information of an individual to a law enforcement agency only if: (a) the disclosure of the information is required or authorised by or under a warrant issued under a law of the Commonwealth, a State or a Territory; or (b) the information is disclosed with the express consent of the individual to whom the biometric information relates, or purports to relate, and the disclosure is for the purpose of: (i) verifying the identity of the individual; or (ii) investigating or prosecuting an offence against a law of the Commonwealth, a State or a Territory. (4) Subsection (3) applies despite: (a) any law of the Commonwealth, a State or a Territory (whether enacted or made before or after this subsection); or (b) a warrant (other than a warrant of a kind mentioned in paragraph (3)(a)), authorisation or order issued under such a law. (5) An accredited entity is authorised to disclose biometric information of an individual if the disclosure is to the individual to whom the biometric information relates. (6) An accredited entity is authorised to retain, use or disclose biometric information of an individual if: (a) the accredited entity collected the information in accordance with subsection (1); and (b) the information is retained, used or disclosed for the purposes of undertaking testing in relation to the information; and (c) the entity complies with any requirements prescribed by the Accreditation Rules. (6A) Without limiting paragraph (6)(c), Accreditation Rules made for the purposes of that paragraph must prescribe requirements that relate to the management by accredited entities of the potential for biometric systems to selectively disadvantage or discriminate against groups of individuals. (7) Without limiting paragraph (6)(c), Accreditation Rules made for the purposes of that paragraph may prescribe requirements in relation to the following matters: (a) the purposes for which testing may be undertaken; (b) the kinds of testing that may be undertaken using biometric information; (c) the circumstances in which testing of the biometric information may be undertaken; (d) the manner in which the biometric information that has been retained for testing must be destroyed; (e) the preparation, content, approval and implementation of ethics plans relating to the testing of the biometric information; (f) obtaining express consent of individuals to whom the biometric information relates; (g) reporting of testing results to the Digital ID Regulator. (8) An accredited entity is authorised to retain, use or disclose biometric information of an individual if: (a) the entity collected the information in accordance with subsection (1); and (b) the information is retained, used or disclosed for the purposes of preventing or investigating a digital ID fraud incident; and (c) the entity complies with any requirements prescribed by the Accreditation Rules. (9) Without limiting paragraph (8)(c), Accreditation Rules made for the purposes of that paragraph may prescribe requirements in relation to the following matters: (a) the manner in which biometric information that has been retained for preventing or investigating digital ID fraud incidents must be destroyed; (b) the reporting of fraud prevention or investigation activities to the Digital ID Regulator.