9General privacy obligations of parties to participation agreement

9 General privacy obligations of parties to participation agreement

(1) Each party to a participation agreement must: (a) be subject to the Privacy Act 1988; or (b) be subject to a privacy law that: (i) is a law of a State or Territory; and (ii) is prescribed by the rules for the purposes of this subparagraph; or (c) agree in the agreement to comply with the Australian Privacy Principles, with any modifications of subclauses 7.8 and 12.2 of those principles (about laws of the Commonwealth) specified in the agreement, as if the party were an APP entity; or (d) be a government authority prescribed by the rules for the purposes of this paragraph; or (e) if the agreement deals only with the requesting of DVSs by, and provision of DVSs to, an authority of New Zealand or a person or body operating in New Zealand—be an authority, person or body subject to the Privacy Act 2020 of New Zealand.

Note: A DVS is the only identity verification service available to a party to an agreement described in paragraph (e).

(2) A participation agreement must provide for: (a) privacy impact assessments of requesting identity verification services; and (b) the obtaining of an individual’s express consent to the collection, use and disclosure, for the purposes of requesting identity verification services, of identification information that relates to the individual included in such a request, unless: (i) the request is made by or on behalf of a government authority; and (ii) collection, use and disclosure of that information for the purposes of protecting a shielded person, or someone else associated with a shielded person, are implicit in functions conferred by law on the authority; and (c) the provision, to an individual from whom such express consent is being sought, of information about matters described in subsection (3); and (d) each party to have arrangements for dealing with complaints by individuals whose identification information is held by the party; and (e) each party to the agreement (except the Department) to report to the Department on breaches of security that relate to the party and are relevant to a matter dealt with in the agreement; and (f) the Department to inform the Information Commissioner of a breach of security that: (i) is reported to the Department under a provision of the agreement covered by paragraph (e); and (ii) is a data breach that is reasonably likely to result in serious harm to an individual whose identification information is involved in the breach; and (g) the Department to notify each party to the agreement that is relevant to, or impacted by, a data breach of which the Information Commissioner is informed under paragraph (f); and (h) each party notified under paragraph (g) of a data breach, that is impacted by that breach, to take reasonable steps to notify each individual to whom the identification information relates. (3) For the purposes of paragraph (2)(c), the matters are as follows: (a) how the party seeking express consent uses identity verification services; (b) how any facial images of the individual collected by the party from the individual for requesting an identity verification service or from a response to a request for an identity verification service will be used and disposed of; (c) whether any such facial images will be retained or used for purposes other than those for which the identity verification service is to be requested; (d) what legal obligations the party seeking to collect the identification information has in relation to that collection; (e) what rights the individual has in relation to the collection of the identification information; (f) the consequences of the individual declining to consent; (g) where the individual can get information about making complaints relating to the collection, use and disclosure of the identification information for the purposes of requesting and provision of identity verification services; (h) where the individual can get information about the operation and management of the approved identity verification facilities by the Department in connection with the requesting and provision of identity verification services. (4) A participation agreement must provide that a party to the agreement is not authorised to use or disclose identification information obtained for the purposes of requesting or providing identity verification services for the purposes of any of the following: (a) engaging in activities that would allow the party to create a data profile of the person whose identity is being verified (including where it would allow the person’s behaviour to be tracked (whether or not online)); (b) offering to supply goods or services; (c) advertising or promoting goods or services; (d) enabling another person or entity to offer to supply goods or services; (e) enabling another person or entity to advertise or promote goods or services; (f) market research.