10Extra privacy obligations of parties to participation agreement that request services

10 Extra privacy obligations of parties to participation agreement that request services

(1) A participation agreement must require each party to the agreement that proposes to request identity verification services: (a) either: (i) to request a DVS or FVS for the purposes of verifying the identity of an individual; or (ii) to request an FVS or FIS for the purposes of protecting a shielded person or someone else associated with such a person; and (b) to comply with the access policy for each service the party requests; and (c) not to use the outcome of an identity verification service the party requested in relation to an individual as the only evidence of the individual’s identity in criminal or civil proceedings to which the individual is a party. (2) A participation agreement must provide for each party to the agreement that proposes to request identity verification services: (a) not to disclose identification information received by the party as a result of an identity verification service the party requested, except: (i) as required by law; or (ii) as permitted by law in circumstances specified in, or identified in accordance with, the agreement; and (aa) if the identity verification service is an FVS—to take reasonable steps to destroy each facial image of an individual that is created, for the purposes of the request, by the party requesting the service, as soon as reasonably practicable after the image is no longer required for the purposes of the request, unless the image is: (i) a Commonwealth record (within the meaning of the Archives Act 1983); or (ii) required by a law of the Commonwealth, a State or a Territory, or by an order of a court or tribunal, to be retained; and (b) if the party is a government authority—not to permit an individual who is an officer, member of staff, employee or contractor of the party to: (i) make on behalf of the authority a request for an identity verification service that may result in a facial image being provided in response; or (ii) deal with a facial image provided in response to such a request; unless the individual has been trained in facial recognition and image comparison.

Note: Facial images are not provided in response to requests by or on behalf of non‑government entities.