Identity Verification Services Rules 2024

The instrument relies on several concepts defined in the Act rather than in the Rules themselves. An “approved identity verification facility” is the infrastructure hub through which identity verification services are delivered. The Rules specify two such facilities: the DVS Hub (Document Verification Service) and the Face Matching Service Hub. A “connection” to a facility is the technical or administrative arrangement that enables an entity to send requests and receive responses. The Rules treat each connection as potentially covering multiple “kinds of documents”, which are defined exhaustively in section 8(5). That list comprises 16 document types ranging from birth certificates and driver’s licences to medicare cards, aviation security identification cards, and entries on the electoral roll. Notably, each document type is a separate kind even if issued by different authorities; a driver’s licence from New South Wales and one from Victoria are the same kind of document for fee calculation purposes.

A “participation agreement” is the contract between an entity and the Commonwealth that governs access to the identity verification system. The Rules prescribe certain privacy laws and government authorities that the Act requires to be referenced in those agreements. The “NDLFRS hosting agreement” refers to the agreement for hosting the National Driver Licence Facial Recognition Solution, which is subject to its own prescribed privacy laws under Part 3. The “competitive neutrality” concept in section 9(2) is crucial: it allows a government authority to opt into paying per-request fees by giving notice that charging itself is appropriate because it competes with private sector entities. Without such notice, government authorities pay no per-request fee. The “prescribed government authorities” listed in section 6 are bodies that must be covered by participation agreements, likely because they have special intelligence or law enforcement functions that require access without the usual participation agreement formalities, though the Act’s precise requirement is referenced only by cross-reference.

The Rules directly affect two broad categories: government authorities and non-government entities. Government authorities include Commonwealth, state and territory bodies that use identity verification services. The fee table distinguishes between them and non-government entities by charging government authorities significantly lower base connection fees: $5,470.95 versus $24,610.40 for the DVS Hub, and $12,000 versus $31,139.45 for the Face Matching Service Hub. That price differential is substantial , roughly 4.5 times lower for DVS and 2.6 times lower for FMS. Government authorities are also able to avoid per-request fees entirely unless they affirmatively notify the Department that competitive neutrality makes charging appropriate. This creates an implicit subsidy for government over private sector entities, which may affect competition in markets where government agencies provide services that compete with private businesses , for example, in identity verification for financial services.

Non-government entities , banks, insurers, telecommunications providers, gig economy platforms, property managers, and any other private organisation that needs to verify identities , must pay both connection fees and per-request fees. The per-document fee for connection (column 3) is the same for both government and non-government, but the base connection fee is much higher for non-government. The per-request fee of $0.40 per DVS or FVS transaction may seem modest but can accumulate significantly for high-volume users processing thousands or millions of verifications annually.

The five prescribed government authorities (ACIC, ASIS, ASIO, NACC, ONI) are specifically identified in section 6. Their inclusion in the participation agreement framework likely means they have special access or reduced formalities, though the Rules do not specify the precise benefit. The six state and territory privacy laws prescribed in both Parts 2 and 3 affect any entity that handles personal information under those jurisdictions , compliance with those laws becomes a condition of participation.

Finally, the 18-month period for finalising participation agreements under section 6A affects all entities that need to enter into such agreements. Organisations that delay beyond 18 months from the relevant trigger date risk being unable to connect to or use the identity verification facilities until an agreement is in place.

The core duty imposed by the Rules is the obligation to pay fees. Section 8 creates a duty to pay a connection fee for each connection to an approved identity verification facility. The amount is the base connection amount plus a per-kind-of-document fee that multiplies the number of document types the entity seeks to verify by the per-document amount. If an entity already has a connection and wants to replace it with one covering additional document types, only the per-document fee for the new types is payable , the base fee is not charged again. That is a sensible design that avoids double-charging. However, if an entity wants a second separate connection (for example, to segregate verification requests between business units), the full fee applies again because subsection (2) says “the amount of the fee for the connection is the sum” of base and per-document amounts.

Section 9 imposes a fee of $0.40 per request for DVS and FVS services. This fee is payable by non-government entities automatically and by government authorities only if they have given notice under subsection (2). The notice can cover all requests or particular kinds of requests. This right to elect whether to pay is significant: a government authority can choose to internalise the cost only when its verification activities compete with private sector providers. The competitive neutrality principle is mentioned but not defined in the Rules; it presumably refers to the Commonwealth’s Competitive Neutrality Policy, which requires government businesses to charge prices that reflect full costs to avoid unfair advantages.

Entities also have the right to connect to the facilities, provided they comply with the Act and the Rules. The Rules do not impose eligibility criteria beyond what the Act requires. The prescribed privacy laws in Parts 2 and 3 indicate that entities must have regard to those laws in their participation agreements, though the precise obligations are not spelled out in this instrument. The duty of the Department or the relevant Secretary is to prescribe these laws and authorities, which this instrument does.

The Rules themselves do not create penalties. They are made under the Identity Verification Services Act 2023, which contains the enforcement mechanisms for non-payment of fees and non-compliance with participation agreement obligations. The Rules specify that fees are payable “for the purposes of paragraph 42(1)(a) and (b) of the Act”, meaning that the Act’s provisions about fee recovery, late payment, and possible termination of access apply. The Rules do not reproduce those provisions, so entities must consult the Act to understand the consequences of non-payment.

The prescribed privacy laws under Part 2 and Part 3 carry their own enforcement regimes. If an entity handling a state or territory privacy law fails to comply with that law, it may face penalties under that jurisdiction’s legislation. The Rules effectively incorporate those laws into the federal identity verification framework by requiring participation agreements to address them. Breach of a participation agreement could lead to the agreement being terminated under the Act, which would cut off access to identity verification services.

The prescribed government authorities in section 6 are immune from some enforcement actions due to their intelligence and law enforcement functions , ASIS and ASIO are generally exempt from many Commonwealth oversight mechanisms. Their inclusion in the Rules suggests they are still subject to the participation agreement framework, but enforcement against them would likely be limited by their statutory immunities. The 18-month period for finalising participation agreements under section 6A does not carry an express penalty, but failure to finalise within that time may prevent the entity from connecting or continuing to use the facilities, depending on provisions in the Act.

The Rules explicitly interact with six state and territory privacy laws by prescribing them for purposes of the Act. Those laws are: the Privacy and Personal Information Protection Act 1998 (NSW), the Privacy and Data Protection Act 2014 (Vic), the Information Privacy Act 2009 (Qld), the Personal Information Protection Act 2004 (Tas), the Information Privacy Act 2014 (ACT), and the Information Act 2002 (NT). This means that entities using the identity verification system must comply not only with the Commonwealth Privacy Act 1988 (if applicable) but also with the relevant state or territory law where they operate or where the personal information is collected. Western Australia and South Australia are noticeably absent, likely because they do not have equivalent comprehensive privacy legislation; in those jurisdictions, only the Commonwealth Privacy Act applies.

The Rules also interact with the Identity Verification Services Act 2023 itself, as they are made under it and fill in the gaps left by that Act. For example, the Act likely provides that participation agreements must include certain privacy requirements; the Rules specify which privacy laws those requirements refer to. The Act sets a default period for finalising participation agreements; the Rules prescribe a longer 18-month period.

The list of prescribed government authorities in section 6 interacts with the Acts establishing those bodies. ASIS and ASIO, for instance, have their own secrecy provisions and exemptions from Commonwealth privacy law under the Intelligence Services Act 2001 and ASIO Act 1979. By prescribing them in the Rules, the instrument overrides any blanket exemption they might otherwise claim, at least for the purpose of participation agreements. The note in section 8 that fees do not include GST reminds users that the A New Tax System (Goods and Services Tax) Act 1999 applies separately; GST may be payable on top of the specified amounts.

The document types listed in section 8(5) interact with numerous other Commonwealth and state laws. A “medicare card” is defined by reference to the National Health Act 1953; an “MSIC” is defined under the Maritime Transport and Offshore Facilities Security Act 2003; an “aviation security identification card” under the Aviation Transport Security Act 2004. The Rules do not create new definitions but rely on existing statutory definitions.

The Identity Verification Services Rules 2024 is an instrument as originally made. There is no amendment history recorded in the text provided, and no amending instruments are referenced. The Rules came into force on a date specified in the Act or in the Rules themselves , the source does not include commencement provisions, but typical instruments commence the day after registration or on a specified date. Since the Rules are made under the Identity Verification Services Act 2023, they likely commenced after that Act received Royal Assent (which was in 2023) and the Rules were registered on the Federal Register of Legislation.

Future amendments are possible. The fee amounts in section 8 and section 9 are specific dollar figures that will need periodic adjustment for inflation or cost recovery. The Explanatory Statement (not provided) would explain the basis for the figures , likely cost recovery under the Australian Government Cost Recovery Guidelines. If costs change, the Minister or the Secretary will need to amend the Rules. Similarly, the list of prescribed privacy laws may need updating if states or territories enact new privacy legislation or amend existing ones. The list of prescribed government authorities could expand if new intelligence or integrity bodies are created.

The 18-month period in section 6A could be amended if experience shows it is too short or too long. The application provisions in Part 5 may need updating if the Act is amended to change the transitional arrangements. Users should check the Federal Register of Legislation for any amending instruments, as the Rules are likely to be updated regularly.

The source does not mention any litigation history, and as a 2024 instrument there has been insufficient time for significant case law to develop. However, several potential areas for future litigation can be identified from the Rules’ provisions. The fee calculations in section 8 are complex, especially the distinction between new connections and replacement connections under subsection (3). An entity might dispute whether a technical change constitutes a replacement connection or a new connection, leading to a different fee. The “kinds of documents” definition in subsection (5) is exhaustive but could be interpreted differently , for example, whether a document issued under state law but not listed could still be verified under a catch-all provision elsewhere.

The competitive neutrality notice in section 9(2) could be challenged. A non-government entity might argue that a government authority should be required to pay per-request fees because its verification activities compete with private sector providers, while the government authority might argue it has discretion. The Rules do not define “competitive neutrality” or prescribe any criteria for when notice is appropriate. This could lead to disputes about the reasonableness of a government authority’s decision not to give notice.

The prescription of state and territory privacy laws may also be challenged if an entity argues that a particular state law is incompatible with the federal framework or that the Act does not authorise the prescription of that law. The application provisions in section 10 , applying Part 2 to agreements made before commencement , could be challenged as retrospective, though the instrument explicitly says it applies whether the agreement was made before or after commencement. Courts would need to determine whether the Act authorises such retrospectivity.

Given the instrument’s recent date, no cases have yet tested these provisions. Users should monitor the Federal Court and Administrative Appeals Tribunal for decisions on fee disputes or participation agreement terms.

Several features of the Rules are likely to catch practitioners off guard. The first is the distinction between a new connection and a replacement connection under section 8(3). If an entity simply adds document types to an existing connection, it must work out whether it is “replacing” the existing connection. The example in the instrument shows that adding two new document types to a DVS Hub connection that already covers three types costs $909.10 (2 × $454.55). But if the entity instead sought a second separate connection, the fee would be the full base amount plus the per-document fee for all document types on that new connection. The instrument does not clearly define when a change is a replacement versus a new connection. The practical risk is that an entity might inadvertently trigger a full connection fee by requesting a new connection rather than modifying an existing one.

Second, government authorities may assume they are always exempt from per-request fees. They are not. Section 9(2) requires them to give notice to the Department that, taking account of competitive neutrality, it would be appropriate to charge. Without that notice, they pay nothing. But if they later discover that their identity verification activities compete with private businesses, they may face claims of unfair competition or complaints to the Australian Competition and Consumer Commission. Conversely, if a government authority gives notice and later wants to revoke it, the Rules do not provide a mechanism , once notice is given, the fee applies.

Third, the per-document fee for connection applies for each “kind of document” in subsection (5). The list includes 16 items, but many entities will need to verify multiple kinds. For a non-government entity connecting to the DVS Hub with all 16 document types, the connection fee is $24,610.40 plus 16 × $454.55 = $7,272.80, totalling $31,883.20 , plus GST. For the Face Matching Service Hub, that figure is $31,139.45 plus 16 × $850 = $13,600, totalling $44,739.45. These are one-off charges but must be paid before connection.

Fourth, the 18-month period for finalising participation agreements in section 6A is a trap for the unwary. The Act likely sets a default shorter period , perhaps 6 or 12 months , and the Rules prescribe a longer one. But entities must check which trigger event starts the clock. If they miss the deadline, they may lose access to the identity verification system and face reapplication.

Fifth, the instrument does not address fee refunds or adjustments. If an entity overpays or if the connection fee changes after payment, there is no provision for reimbursement. Entities should verify fee amounts at the time of payment.

Compliance with the Identity Verification Services Rules 2024 involves several practical steps. First, any entity that wishes to connect to an approved identity verification facility must calculate the correct connection fee using section 8. Determine whether you are a government authority or a non-government entity. Identify all the kinds of documents you intend to verify from the list in subsection (5). Decide whether you need a single connection covering multiple document types or multiple connections. If you already have a connection and want to add document types, ensure you use the replacement connection formula under subsection (3) rather than applying for a new connection. Submit payment of the base amount plus the per-document fee with your connection application.

Second, if you are a non-government entity, budget for ongoing per-request fees of $0.40 each for DVS and FVS. Volume matters: a million requests cost $400,000. If you are a government authority, decide whether competitive neutrality requires you to pay per-request fees. If you operate a commercial activity that competes with private providers, you should give notice to the Department under section 9(2)(a). The notice can cover all requests or particular kinds; specify clearly which requests are included. Consider seeking legal advice on the competitive neutrality analysis, as the Rules do not define the term.

Third, ensure your participation agreement addresses the prescribed privacy laws listed in Part 2 (and Part 3 for the NDLFRS hosting agreement). If you operate in New South Wales, Victoria, Queensland, Tasmania, the ACT or the Northern Territory, your agreement must reflect compliance with those jurisdictions’ privacy legislation. If you operate in multiple states, you must comply with each relevant law. The participation agreement itself will likely include clauses requiring you to maintain privacy compliance; the Rules tell you which laws count.

Fourth, note the 18-month period in section 6A. If you are entering into a participation agreement, monitor the start date of that period and ensure the agreement is finalised well before the deadline. The period may run from the date the Act came into force, the date of your application, or another trigger , check the Act and any guidance from the Department.

Fifth, monitor for amendments. The fees and prescribed lists are likely to change. Subscribe to the Federal Register of Legislation for updates. Finally, maintain records of all connection and request fee payments, notices given under section 9(2), and participation agreement versions. These records will be crucial if any dispute arises over fee calculation, connection status, or privacy compliance.