7Simplified outline of this Subdivision

7 Simplified outline of this Subdivision

Two types of agreement govern the requesting and provision of identity verification services:

(a) participation agreements (which are agreements between the Department and other authorities, persons and bodies about the requesting and provision of identity verification services using the approved identity verification facilities); and

(b) the NDLFRS hosting agreement (which is an agreement between the Department and authorities of a State or Territory that supply identification information stored and used in the NDLFRS).

A request for an identity verification service can be made only by a party to a participation agreement, and only identification information made available by a party to a participation agreement can be used in an identity verification service.

The Department may develop, operate and maintain the approved identity verification facilities. The Department is required to maintain the security of electronic communications to and from the facility, including by encrypting the information, and to protect the information from unauthorised interference or unauthorised access.

Participation agreements and the NDLFRS hosting agreement contain safeguards for the privacy of individuals whose identification information is used in requesting identity verification services or responding to such requests. The safeguards include committing the parties to the agreement to complying with standards set by the Privacy Act 1988 or similar State or Territory laws (even if those standards would not otherwise apply to a party).

Participation agreements also need to provide for a range of other privacy safeguards relating to identity verification services, including:

(a) privacy impact assessments of requesting the services; and

(b) obtaining an individual’s express consent to the collection, use and disclosure of the individual’s identification information for the purposes of requesting the services (unless the collection, use and disclosure is by a government authority authorised by another law to do so); and

(c) limits on the purposes for which the services may be requested and on what may be done with information received in response to requests; and

(d) annual reporting and auditing of compliance with agreements; and

(e) suspension or termination of a party’s ability to request services if the party has not complied with the agreement or access policies for the services.