50Accredited entities may collect etc. biometric information for purposes of government identity documents

50 Accredited entities may collect etc. biometric information for purposes of government identity documents

(1) This section applies if: (a) an accredited entity collects biometric information of an individual under subparagraph 49(1)(b)(i) for the purpose of verifying the identity of the individual; and (b) the accredited entity has verified that the biometric information is legitimate.

Note: Because this Chapter applies to an entity only to the extent that the entity is providing accredited services (see section 33), this section does not affect information collected, held etc. by the entity in its capacity as the issuer of the document or other credential.

(2) If the entity is covered by subsection (3), the entity may collect, use, disclose or retain the biometric information for the purposes of issuing a document or other credential that: (a) contains personal information about the individual; and (b) the individual has expressly consented to the issue of; and (c) can be used to assist the individual to prove the individual’s age or identity or a permission or authorisation that the individual holds; and (d) is issued by or on behalf of the entity. (3) The entities covered by this subsection are as follows: (a) a body corporate incorporated by or under a law of the Commonwealth or a State or Territory; (b) a Commonwealth entity, or a Commonwealth company, within the meaning of the Public Governance, Performance and Accountability Act 2013; (c) a person or body that is an agency within the meaning of the Freedom of Information Act 1982; (d) a body specified, or the person holding an office specified, in Part I of Schedule 2 to the Freedom of Information Act 1982; (e) a department or authority of a State; (f) a department or authority of a Territory. (4) Subsection (2) applies despite anything else in this Division. (5) If: (a) the entity (the first entity) is not covered by subsection (3); and (b) the first entity has a written agreement with another entity (the government entity) that is covered by that subsection; and (c) the agreement provides for the first entity to disclose the biometric information of the individual to the government entity for the purposes of issuing a document or other credential that: (i) contains personal information about the individual; and (ii) the individual has expressly consented to the issue of; and (iii) can be used to assist the individual to prove the individual’s age or identity or a permission or authorisation that the individual holds; and (iv) is issued by or on behalf of the entity; the entity may disclose the biometric information in accordance with the agreement if the disclosure occurs within 14 days after the biometric information is collected.