Service Victoria (Transfer of Births, Deaths and Marriages Identity Verification Functions) Regulations 2021

Transferred identity verification function - a task described in Schedule 1 that, under section 10(5) of the Service Victoria Act 2018, must be performed by the Service Victoria CEO rather than by the original service agency (here, the Registrar). The function is limited to collecting identity information and verifying the applicant’s identity. It does not include deciding the underlying application, issuing certificates, or updating the Register.

Identity information - not defined in these regulations. It would derive from the identity verification framework the Service Victoria CEO uses, which is likely linked to the Digital Identity system (Trusted Digital Identity Framework or similar). The regulations do not prescribe what counts as acceptable identity information; that is a matter for the Service Victoria CEO’s own processes.

Registrar - the Registrar of Births, Deaths and Marriages under the Births, Deaths and Marriages Registration Act 1996. The same individual holds functions under the Relationships Act 2008 for the Relationships Register.

Register - the register kept under the Births, Deaths and Marriages Registration Act 1996.

Relationships Register - the register kept under Chapter 2 of the Relationships Act 2008.

Adult, child, parent - defined by cross-reference to the Births, Deaths and Marriages Registration Act 1996. This matters for items 6-11 where the type of applicant and whom they apply on behalf of changes the verification process.

Change - defined by cross-reference to the Births, Deaths and Marriages Registration Act 1996 (relevant to change of name items 5-7).

Registrable caring relationship and registrable domestic relationship - defined by cross-reference to Chapter 2 of the Relationships Act 2008 (relevant to items 12 and 13).

Registered relationship - defined by cross-reference to the Relationships Act 2008 (relevant to item 4).

Online only - a key limitation: every item in Schedule 2 (now revoked) and all current Schedule 1 items require the application to be made “by input into an Internet site or a mobile application maintained for that purpose”. The transfer does not apply to paper, counter or telephone applications. The Service Victoria CEO’s role is triggered only when the applicant uses a digital channel.

Sunset clause - the regulations will automatically lapse on 10 March 2031 unless re‑made. This is a standard feature of Victorian subordinate legislation; it forces a periodic review of whether the transfer is still appropriate.

No penalty provisions - the regulations do not create any offence or penalty. The verification function is a procedural step. Anyone providing false identity information would be liable under other legislation (e.g., the Births, Deaths and Marriages Registration Act 1996 or the Crimes Act 1958), not under these regulations.

The primary entity affected is the Service Victoria CEO - the office holder established under the Service Victoria Act 2018. The CEO must now perform the identity collection and verification steps for the listed online transactions. This imposes an operational obligation: the CEO must maintain a fit-for-purpose digital identity verification system, manage identity information in accordance with privacy and security obligations under the Service Victoria Act 2018, the Privacy and Data Protection Act 2014 (Vic) and possibly the Health Records Act 2001 (if any health information is collected, though the listed functions involve identity, not health data). The CEO also bears the compliance burden of ensuring the verification process meets the requirements of the relevant Registrar under the parent Acts, and that any errors in identity verification do not lead to incorrect registry entries.

The Registrar of Births, Deaths and Marriages is affected indirectly: the Registrar loses direct operational control over the identity verification step for these online applications. However, the Registrar retains all decision-making authority on the substantive application (e.g., whether to issue a birth certificate, register a change of name, alter a sex record). The Registrar must coordinate with the Service Victoria CEO to receive the verified identity information and to decide the application. This adds a handover point that did not exist previously. The Registrar’s own identity verification procedures for non-digital channels are unaffected.

Applicants - persons who wish to search the registers, change their name, alter their sex record, register a relationship, etc., and who choose to apply online. For such applicants, the identity verification process is now conducted through the Service Victoria platform rather than directly through the Registry. This may change the user experience (e.g., a single sign-on via Service Victoria’s digital ID) and may impose additional identity document requirements if Service Victoria’s verification standards differ from those the Registrar previously used. Applicants who apply on paper or in person are unaffected and deal with the Registrar as before.

Parent or guardian applicants (items 7, 10, 11) - the regulations require identity verification of the parent or guardian who makes the application for a child. That parent or guardian must submit their own identity information through the Service Victoria system.

Service Victoria itself as an organisation - beyond the CEO, the agency must allocate resources to develop and maintain the digital verification system, train staff, and handle any complaints or data breaches related to identity information. The regulations increase the scope of Service Victoria’s operations, but the cost allocation is not addressed in the instrument.

Third-party intermediaries - businesses or lawyers that assist clients with name changes or relationship registrations may interact with the Service Victoria platform on behalf of clients. The regulations do not restrict who can input the application; but the identity verification must be performed on the actual applicant. An intermediary cannot circumvent the verification step. This could increase compliance costs for practices that previously managed identity verification in-house with the Registrar.

Private sector providers of identity verification services - the regulations do not mandate a specific verification system. The Service Victoria CEO may choose to use government-built systems (e.g., the Digital Identity system) or contract-out verification to private providers. The regulations are technology-neutral. However, they effectively centralise the identity verification market for these 13 functions into a single government entity, reducing choice for applicants and potentially crowding out private verification services that might have been offered direct to the Registrar.

The regulations themselves impose no duties on applicants or rights separate from those under the parent Acts. However, several duties arise implicitly from the transfer.

Duty on Service Victoria CEO - to perform the transferred identity verification functions in a manner consistent with the Service Victoria Act 2018 and any applicable standards. This includes a duty to collect identity information only for the purpose specified (the application), to store it securely, to dispose of it in line with records management laws, to verify the identity to a reasonable standard, and to pass the verification result to the Registrar without undue delay. The CEO also has a duty not to exceed the transferred function: the regulations do not authorise the CEO to decide the substantive application or to issue a certificate. Overstepping could expose the CEO to judicial review.

Duty on the Registrar - to accept the identity verification performed by the Service Victoria CEO as sufficient for the purposes of the underlying application. The Registrar cannot require the applicant to re-verify identity through a separate channel unless the verification fails or is incomplete. This duty arises from the transfer scheme: if the regulation says the function is transferred, the Registrar cannot insist on doing it again. However, the Registrar retains the right to be satisfied as to identity before proceeding; if the Service Victoria CEO’s verification is inadequate, the Registrar may request additional information, but that would be a separate matter not covered by the transferred function.

Duty on applicants - to provide accurate identity information. There is no specific duty in these regulations; the duty arises under the parent Acts (e.g., making a false statement in an application may be an offence under the Births, Deaths and Marriages Registration Act 1996). The identity verification process itself does not create a statutory duty of cooperation, but practical compliance (providing documents, answering questions) is necessary to complete the transaction.

Right of applicants - to have their identity verified by the Service Victoria CEO rather than being required to appear in person or send documents by post, provided they choose the online channel. This could be seen as a limited procedural right to a digital pathway. An applicant who cannot use the online channel has no right to demand a digital alternative; the regulations only transfer the function for online applications. There is no right to have identity information handled in any particular way - privacy rights are sourced from the Privacy and Data Protection Act 2014 and the Health Records Act 2001, not these regulations.

No private right of action - the regulations do not create a cause of action for individuals if the Service Victoria CEO verifies identity incorrectly or mishandles data. Any remedy would lie in general law (tort, contract, or under privacy legislation). The regulations are administrative; they do not confer a statutory duty enforceable by individuals.

Right to review - if identity verification fails, the applicant might be unable to proceed with the underlying application. There is no internal merits review right under these regulations. The applicant could contact the Service Victoria CEO for reconsideration, or if the underlying application is refused by the Registrar on grounds including identity, the applicant may have review rights under the parent Acts (e.g., under the Victorian Civil and Administrative Tribunal Act 1998 for some decisions). The regulations do not affect those rights.

These regulations contain no penalty provisions, no infringement offences, and no enforcement mechanisms. They are a purely administrative instrument that transfers functions. The only potential enforcement consequences arise indirectly if a duty is breached under other legislation.

If the Service Victoria CEO fails to perform a transferred function - e.g., refuses to verify identity, or does so negligently. That could be a breach of the Service Victoria Act 2018 (s.10(5) read together with these regulations). The Act likely provides for the Minister to issue directions or for the CEO to be removed. There is no penalty for non-performance specified in these regulations; any consequence would be internal government administrative law or potentially a claim for misfeasance if a person suffers loss.

If the Service Victoria CEO does not comply with privacy obligations - the Privacy and Data Protection Act 2014 provides for complaints to the Victorian Information Commissioner, who can make determinations including compensation orders. The regulations do not exempt the CEO from that Act. Similarly, the Health Records Act 2001 may apply if health information (e.g., gender dysphoria treatment records) is collected as part of the identity verification for sex record alterations, though the items only mention “identity information”. The practical risk is that the CEO handles a wide range of personal information and could face penalties for data breaches under the Privacy and Data Protection Act 2014 (maximum penalty for an organisation is 2,000 penalty units; for an individual, 400 penalty units - currently approximately AUD 400,000 and AUD 80,000 respectively, but these amounts apply to the Act, not to these regulations directly).

If an applicant provides false identity information - the regulations themselves do not criminalise that. The false statement would likely be an offence under s.58 of the Births, Deaths and Marriages Registration Act 1996 (making a false declaration) or under the Crimes Act 1958 (obtaining a financial advantage by deception, or forgery). The maximum penalty under the Births, Deaths and Marriages Registration Act 1996 is 60 penalty units (currently about AUD 12,000) or imprisonment for six months, or both. The regulations do not affect those penalties.

If the Registrar refuses to accept the Service Victoria CEO’s verification - the Registrar could be acting outside the statutory scheme. The regulations are made under s.58 of the Service Victoria Act 2018, which empowers the Governor in Council to prescribe transferred functions. If the Registrar fails to give effect to the transfer, the Minister may be able to enforce compliance through directions under the Act. But there is no private enforcement mechanism.

Enforcement by the Ombudsman or IBAC - if systemic failures in identity verification cause harm, the Victorian Ombudsman or the Independent Broad-based Anti-corruption Commission could investigate. But these are general oversight bodies; the regulations themselves do not expand their jurisdiction.

No immunity - the regulations do not confer any immunity on the Service Victoria CEO for errors in identity verification. The CEO remains subject to common law liability for negligence (if a duty of care is owed to applicants) and to liability under the Privacy and Data Protection Act 2014.

Service Victoria Act 2018 - the parent Act. Section 10(5) of that Act provides that a transferred identity verification function is to be performed by the Service Victoria CEO as a transferred function. These regulations prescribe which functions are transferred. The Act also sets out the broader powers and duties of the CEO, including information-sharing and privacy obligations. The Act’s purposes include improving digital service delivery and allowing centralisation of identity verification. These regulations implement that centralisation for the Registry.

Births, Deaths and Marriages Registration Act 1996 - the foundational Act for the Register, the Registrar’s powers, and the substantive application processes for searching the register, registering births, deaths, marriages, changes of name, and alterations of sex records. These regulations only transfer the identity verification step; all other aspects (eligibility, forms, fees, certificates, correction of errors) remain governed by that Act. For example, an application to alter the record of sex under s.30A still requires compliance with s.30A(2) (medical report, statutory declaration). The regulations do not alter those substantive requirements. The definitional cross-references (e.g., “adult”, “child”, “parent”) ensure that terms used in the regulations match the Registrar’s own definitions.

Relationships Act 2008 - governs registration of domestic and caring relationships. The regulations transfer identity verification for searching the Relationships Register (Item 4), registering a relationship (Item 12) and revoking registration (Item 13). Again, the substantive requirements (e.g., giving notice, cooling-off periods) remain under the Relationships Act 2008. The cross-referenced definitions of “registered relationship”, “registrable caring relationship”, “registrable domestic relationship” and “Relationships Register” tie into that Act’s parts.

Privacy and Data Protection Act 2014 - applies to the Service Victoria CEO as a public sector agency. The collection, use and disclosure of identity information collected under these regulations must comply with the Information Privacy Principles. Applicants have rights to access their personal information and to complain about breaches. The regulations do not override or modify those privacy rights. There is no specific exclusion for identity verification; the usual rules apply.

Health Records Act 2001 - may apply if the identity information collected constitutes “health information” as defined in that Act. For sex record alteration applications, it is possible that the identity verification process may collect information about the applicant’s sex or gender history, which could be considered health information. The Service Victoria CEO would then need to comply with the Health Privacy Principles. The regulations do not address this, leaving potential interaction unclear.

Electronic Transactions (Victoria) Act 2000 - supports the validity of online applications and electronic signatures. The regulations implicitly rely on the ability to verify identity online; the Electronic Transactions Act may govern the legal effect of the verification. If the verification uses a digital signature or a biometric, that Act’s provisions on electronic communications and signatures would be relevant.

Charter of Human Rights and Responsibilities Act 2006 - may apply to the identity verification process. The regulations could engage the right to privacy (s.13), the right to freedom of expression (s.15, if a person is prevented from changing their name without adequate verification), and the right to recognition as a person before the law (s.8). The Service Victoria CEO must act compatibly with Charter rights. The regulations are subordinate legislation; they would need to be interpreted consistently with the Charter. No Charter statement is included in the regulations as provided.

Subordinate Legislation Act 1994 - governs the making and sunsetting of regulations. These regulations are subject to s.5 (sunset after 10 years). They were made on 10 March 2021 and will sunset on 10 March 2031. Any re-making would need to comply with the Subordinate Legislation Act’s requirements for consultation, regulatory impact statements, and parliamentary scrutiny.

Other state and Commonwealth laws - identity verification may also involve the Commonwealth Identity Verification Services Act 2020 (if accessing federal identity systems) and the Data Availability and Transparency Act 2022 (if sharing data across borders). These regulations do not reference those Acts, but operational implementation may engage them.

The regulations have been amended by three statutory rules since their original making on 10 March 2021.

Original regulations (S.R. No. 11/2021) - came into operation on 14 March 2021. They contained 6 regulations and two schedules. Schedule 1 listed 5 transferred identity verification functions (items 1-5): searching the Register for entries about a birth, death, marriage, and change of name, and searching the Relationships Register for a registered relationship. Schedule 2 contained transitional provisions. Regulation 6 dealt with revocation of earlier transitional instruments. The original objective was presumably different from the current one; regulation 1 was substituted in 2024.

Service Victoria (Transfer of Births, Deaths and Marriages Identity Verification Functions) Amendment Regulations 2021 (S.R. No. 84/2021) - made on 20 July 2021, commenced 25 July 2021. This amendment added three new items to Schedule 1 (items 6-8). Item 6 covered registering a change of an adult’s name; item 7 covered registering a change of a child’s name; item 8 covered altering the record of sex of a person aged 18 or over. It also added definitions for “registered relationship” and “Relationships Register” in regulation 4. It amended Schedule 2 (transitional) and added a new Schedule 2A (seemingly later revoked by S.R. 38/2024). This expanded the scope of transferred functions from registry searches to include substantive application steps (name change, sex record alteration), significantly increasing the role of Service Victoria in identity verification.

Service Victoria (Transfer of Births, Deaths and Marriages Identity Verification Functions) Further Amendment Regulations 2021 (S.R. No. 154/2021) - made on 7 December 2021, with staggered commencement: regulations 5 and 6 commenced 12 December 2021; regulation 7 commenced 6 March 2022; regulation 8 commenced 3 April 2022; regulation 9 commenced 1 May 2022. This amendment further expanded Schedule 1 by adding items 9-13. Items 9 and 10 covered documents acknowledging name and sex for adults and children; items 11-13 covered registration and revocation of registrable caring and domestic relationships. It also inserted the definitions for “adult”, “change”, “child”, “parent”, “registrable caring relationship”, “registrable domestic relationship”. This amendment extended the transfer to the full suite of registry identity verification functions for sex and relationship matters.

Service Victoria (Miscellaneous) Amendment Regulations 2024 (S.R. No. 38/2024) - made on 28 May 2024, commenced 29 May 2024. This amendment substituted regulation 1 (Objective) with the current text; revoked regulation 6 (which had become redundant); revoked Schedule 2 (transitional provisions) in its entirety; and amended Schedule 1 by inserting a new item 1A. Item 1A covers collecting identity information for an application to search the Register for an entry about a birth and adoption under sections 45 and 45A of the Births, Deaths and Marriages Registration Act 1996. This filled a gap: the original item 1 only covered birth searches under s.45, not adoption-related searches under s.45A. The revocation of Schedule 2 tidies up transitional provisions that were no longer needed over three years after commencement.

The cumulative effect of the amendments is a steady expansion of the transferred functions from 5 to 13 items, with a corresponding increase in the scope of identity information collected (now including parent/guardian identity for child applications). The 2024 amendment cleaned up the legislative text by removing spent provisions and adding the missing adoption search.

The regulations, as a statutory instrument, do not contain any reference to litigation, and no judicial decisions have been noted in the source provided. Given that the regulations are relatively narrow in scope - they merely transfer identity verification functions - and have been in operation just over three years, litigation is unsurprisingly sparse. However, potential grounds for challenge or dispute could arise in the future.

Possible challenge: ultra vires - a person might argue that a function listed in Schedule 1 is not a proper “identity verification function” within the meaning of s.10(5) of the Service Victoria Act 2018. The Act itself does not define that term; it is left to the regulations to prescribe. If a court found that a particular item went beyond identity verification (e.g., if it required the Service Victoria CEO to assess substantive matters), the regulation could be struck down as beyond the scope of s.58 and thus invalid. No such challenge has been reported, but the risk exists for novel functions if the CEO misinterprets them.

Possible challenge: inadequate privacy safeguards - an applicant whose identity information is mishandled could bring an action for breach of privacy under the Privacy and Data Protection Act 2014 or the Charter of Human Rights and Responsibilities Act 2006. That would not directly challenge the regulations themselves, but could test the operational implementation. For example, if the Service Victoria CEO collects more information than necessary for identity verification, or retains it beyond the purpose, that could be a breach of the Information Privacy Principles. Such a dispute could reach VCAT or the Supreme Court. No reported cases on this point as yet.

Possible challenge: discrimination - a refusal to verify identity for a sex record alteration application based on an applicant’s gender identity could engage the Equal Opportunity Act 2010 and the Charter. If the Service Victoria CEO’s verification system has a discriminatory effect (e.g., requiring birth certificates that do not match the applicant’s current name or sex), indirect discrimination could arise. Again, no litigation has been reported.

Possible challenge: judicial review of a decision linked to the verification - if the Registrar refuses an application based on identity verification failure, the applicant could seek review of the Registrar’s decision under the Victorian Civil and Administrative Tribunal Act 1998. The Tribunal would consider whether the identity verification was properly performed and whether the Registrar acted within power. However, the regulations do not provide for a separate review of the verification step itself; it is part of the overall decision. The Tribunal’s jurisdiction would come from the parent Act (e.g., s.50 of the Births, Deaths and Marriages Registration Act 1996 for refusal to issue a certificate). Such cases are likely private and unreported.

General observation - the regulations are administrative and uncontroversial in design. They implement a policy of digital centralisation that is common across Australian jurisdictions. The amendments have not sparked public controversy or reported litigation. The sunset clause in 2031 may prompt a review that could reveal operational disputes, but as of the version date (29 May 2024), there is no discernible litigation history.

1. Online only limitation catches out applicants who start online. If a person begins an application via the Service Victoria website but then cannot complete the identity verification (e.g., no suitable ID documents) they cannot simply switch to a paper application without starting again with the Registrar. The transfer applies only to applications “made by input into an Internet site or a mobile application maintained for that purpose”. If verification fails, the application is not complete, and the applicant must approach the Registrar through a non-digital channel. There is no seamless handover between channels.

2. Definitions cross-reference other Acts and change over time. The terms “adult”, “child”, “parent”, “change”, “registrable caring relationship” take their meaning from the Births, Deaths and Marriages Registration Act 1996 and the Relationships Act 2008. If those Acts are amended, the meaning in these regulations automatically changes. A practitioner who only reads these regulations may miss changes in the parent Acts. For example, if the Births, Deaths and Marriages Registration Act 1996 redefines “child” to include a person up to age 21 (currently 18), the verification process for child name changes would unexpectedly apply to 19-year-olds.

3. Parent/guardian identity verification for child applications (items 7, 10, 11) may create a trap if the parent is not an Australian citizen or does not have acceptable identity documents. The regulations do not specify what identity documents are acceptable. The Service Victoria CEO may apply the same standard as for adult applicants. A parent living overseas or without a Victorian driver’s licence may find it impossible to verify identity online, preventing the child from obtaining a name change or sex acknowledgement. There is no alternative process provided in these regulations; the parent must revert to a paper application with the Registrar.

4. No grandfathering for applications in progress at the time of amendments. The amendments (e.g., adding item 1A for adoption searches) took effect on specific dates. Anyone who had started an adoption search application through the Registrar’s direct website before the amendment may have had their application handled by the Registrar, while later applications must go through Service Victoria. The regulations do not provide transitional provisions for partially completed applications (Schedule 2 was revoked in 2024). This could cause confusion for applicants and for Registry staff who need to know which agency is responsible.

5. The objective was substituted in 2024, but the explanatory details are empty. The endnotes state “No entries at date of publication” for explanatory details. This means there is no official guidance on the purpose of the amendment to the objective. Practitioners cannot rely on extrinsic material to interpret why the objective changed. The change may be purely stylistic, but the lack of explanation is a gotcha for those seeking legislative intent.

6. Revoked regulation 6 and Schedule 2 - no longer available online as part of the current version. If someone retrieves an earlier version of the regulations, they might still see regulation 6 and Schedule 2. The current version at 29 May 2024 omits them. Anyone relying on a consolidated version from before 29 May 2024 would mistakenly think those provisions are still in force. The revocation removed transitional provisions that protected the validity of earlier transfers; now those earlier transfers are governed solely by the current Schedule 1. It is unclear whether the revocation could retrospectively affect the validity of past transfers (it likely does not because regulations are not ordinarily retrospective unless expressed; the revocation is prospective from 29 May 2024).

7. The list is exhaustive - if a function is not in Schedule 1, it is not transferred. The regulations do not give the Service Victoria CEO a general power to verify identity for any BDM application. Only those 13 specific functions are covered. If the Registrar develops a new online service (e.g., an e‑certificate ordering system) that requires identity verification, that function would not be transferred until the regulations are amended. This creates a risk of inconsistency: some online applications go through Service Victoria, others remain with the Registrar. Applicants may be confused about which website to use.

8. The identity verification function does not include authorising the issuance of certificates or documents. The Service Victoria CEO only collects and verifies identity. The Registrar still makes the substantive decision. If the Service Victoria CEO mistakenly verifies the wrong person, the Registrar may proceed with an incorrect outcome. Liability for the error may be split between the two agencies, leaving the applicant in a legal grey area.

9. Sunset clause may catch out applicants who plan long-term registrations. The regulations expire on 10 March 2031. If the regulations are not re-made, the transferred functions revert to the Registrar. A person who applied in 2025 with their identity verified by Service Victoria may find that in 2032, a subsequent application (e.g., for a replacement certificate) is handled differently. The sunset could cause administrative disruption if not re-made in time.

10. No private right of action for verification delays or errors. If the Service Victoria CEO takes an unreasonable time to verify identity, or does so incorrectly, the applicant has no direct remedy under these regulations. They would have to rely on administrative law remedies (e.g., mandamus to compel performance of a duty) or potentially a negligence action. This is a significant gap for applicants who need urgent certificates (e.g., for a funeral or a wedding).

For the Service Victoria CEO - the primary compliance obligation is to establish and maintain a secure identity verification system that meets the requirements of the Service Victoria Act 2018 and any ICT standards set by the Victorian Government. Specific steps include:

1. Identify each function - ensure the system can recognise when an applicant is applying for one of the 13 functions in Schedule 1 and apply the correct verification processes. For child-related functions (items 7, 10, 11), the system must verify the identity of the applicant parent or guardian, not the child.

2. Collect only necessary identity information - the regulations do not specify what information can be collected. The CEO should limit collection to what is reasonably necessary to verify identity. Collecting additional personal information (e.g., medical history) would likely breach the Information Privacy Principles.

3. Apply consistent verification standards - the identity verification must be sufficient for the Registrar to rely on it. The CEO should coordinate with the Registrar to agree on acceptable identity documents or verification methods (e.g., biometric liveness check, document verification services). The standard should be at least as rigorous as what the Registrar would have applied in person.

4. Record keeping - maintain records of each identity verification: what information was collected, what checks were performed, the outcome, and the date. This record should be capable of being provided to the Registrar if needed (e.g., for auditing or resolving disputes). The Public Records Act 1973 applies.

5. Data retention and destruction - set a retention period for identity information. The Privacy and Data Protection Act 2014 requires that personal information be destroyed or de-identified when no longer needed for the purpose for which it was collected. The CEO should have a policy that identity information is deleted after the underlying application is finalised, unless required for a longer period by law (e.g., for anti‑money laundering purposes, though the regulations are not part of an AML regime).

6. Training - ensure staff (or automated systems) understand that the function is only identity verification, not decision-making. Staff should not advise on the merits of the application or alter records. Refer complex cases to the Registrar.

7. Privacy compliance - conduct a Privacy Impact Assessment for the identity verification system, given the sensitive nature of the registry data (sex, name changes, relationship status). Publish a collection notice for applicants.

For the Registrar - the obligation is to accept the Service Victoria CEO’s verification as sufficient for the online channel. The Registrar should:

1. Update procedures - create a process to receive the verified identity information from the Service Victoria CEO (e.g., via a secure API or data file). Do not request additional identity documents unless the verification is incomplete or suspicious.

2. Train counter staff - if an applicant attempts to apply in person for a matter that is covered by a transferred function, staff should advise the applicant to use the online channel if they wish to have identity verified by Service Victoria. The in-person option remains available but will be processed by the Registrar under the old procedures.

3. Coordinate on verification failures - agree with the Service Victoria CEO on a process for handling cases where verification fails. The Registrar should not refuse the application outright without giving the applicant an opportunity to provide additional identity information through an alternative channel (though the regulations do not require this, it would be prudent to avoid legal challenge).

For applicants - compliance is straightforward: use the Service Victoria website or app for the listed applications. Ensure the identity information provided matches the documents the CEO requires. If the applicant does not have a driver’s licence or passport, they may need to use a different channel (paper or in person) with the Registrar. The applicant should keep a record of the verification transaction (e.g., a reference number) in case of later dispute.

For legal practitioners - if assisting a client with a name change or sex record alteration, advise the client that identity verification is done through Service Victoria, not the Registry. The practitioner cannot do the verification on behalf of the client; the client must personally submit identity information. The practitioner should also check that the client has acceptable digital identity credentials.

General compliance note - the regulations are currently in force and have sunset in 2031. Stakeholders should monitor for any further amendments that add new functions (e.g., the 2024 addition of item 1A). A compliance review should be conducted before each sunset to assess whether the transfer is still appropriate and whether the verification system is functioning as intended. The Subordinate Legislation Act 1994 requires a regulatory impact statement for re‑making if the regulations impose additional costs; that review would be a good opportunity to adjust verification standards.