Service Victoria (Transfer of Miscellaneous Licensing and Registration Identity Verification Functions) Regulations 2022

Transferred identity verification function. This is the core legal construct. Regulation 5, read with section 10(5) of the Service Victoria Act 2018, turns each function listed in Schedule 1 into a function that must be performed by the Service Victoria CEO rather than by the original agency (the BLA). The note to regulation 5 confirms that the transfer takes effect from 12 May 2022. The function is limited to collecting identity information and verifying the applicant’s identity. It does not include assessing the application on its merits, checking other eligibility criteria, or issuing the licence or registration.

Service Victoria CEO. The CEO of Service Victoria, a statutory body established under the Service Victoria Act 2018, is the recipient of the transferred functions. Service Victoria is the Victorian government’s one-stop shop for transactional services. The CEO exercises the transferred functions under the enabling Act, not under the licensing Acts themselves. This means the BLA remains the decision-maker on the licence, but the identity verification step is outsourced to Service Victoria via regulation.

Business Licensing Authority. Defined in regulation 4 by reference to the meaning of “Authority” in the Business Licensing Authority Act 1998. The BLA is the agency that originally performed these identity checks. After the transfer, the BLA no longer collects or verifies identity information for these specific online transactions. It may still do so for paper or in-person applications, since the regulation only covers online channels.

Mobile application. Defined as “a software application designed for use on a personal electronic device such as a mobile phone or a handheld computing device”. This definition ensures the transfer covers apps as well as websites. The phrase “input into an Internet site or mobile application maintained for that purpose” appears in every Schedule 1 item. It conditions the transfer on the existence of a maintained digital channel. If no such channel exists, the function remains with the BLA. The regulation does not require Service Victoria to create or maintain any particular site or app; it simply transfers the function when one is used.

Natural person requirement. Every item specifically refers to identity checks on natural persons, not on corporations. For example, item 1 covers “an application by a natural person for a licence … to operate a rooming house”. Item 9 covers an application “for a licence to carry on a conveyancing business” but only “if the applicant is a natural person”. This limitation excludes identity verification for corporate applicants, which presumably remains with the BLA.

Internet site or mobile application maintained for that purpose. The regulation does not define “maintained for that purpose”. It likely refers to a site or app operated or authorised by Service Victoria or the relevant agency. But the source does not specify who maintains the site. This creates a gap: if the site is maintained by a private contractor or by the BLA, the transfer may not operate. The term is ambiguous and could generate interpretive disputes.

Applicants for rooming house operator licences. Item 1 covers identity verification when a natural person applies for a licence or renewal under section 11 of the Rooming House Operators Act 2016. Item 2 covers identity information collected for other purposes under sections 15(1)(c), 16, 17 and 18 of that Act, which deal with suitability checks and disqualifying events. Anyone seeking to operate a rooming house and using the online portal must now have their identity verified by Service Victoria rather than the BLA.

Applicants for estate agent licences. Items 3, 4 and 5 cover applications for an estate agent’s licence under sections 17 and 31C of the Estate Agents Act 1980, plus identity information for sections 14(5)(e) and 21(4)(b) of that Act (which relate to associate agents and trust account requirements). Estate agents using the online system will interact with Service Victoria for the identity step.

Applicants for registration as an owners corporation manager. Items 6, 7 and 8 cover registration under sections 179, 180, 181 and 182A of the Owners Corporations Act 2006. These sections deal with manager registration and renewal, and the provision of identity information about associates. Natural person applicants using the online channel will have their identity verified by Service Victoria.

Applicants for conveyancer licences. Items 9 through 12 cover licence applications under sections 13 and 30 of the Conveyancers Act 2006, plus identity information about disqualified persons under section 11(1)(c) of that Act. Conveyancers using the online system are affected.

The Business Licensing Authority. The BLA loses the direct performance of these twelve functions. It may still receive the verified identity result from Service Victoria, but it no longer collects the raw identity data or performs the verification itself. This reduces the BLA’s operational role in the licensing process for online transactions. However, the BLA retains all other functions: eligibility assessment, licence grant or refusal, and enforcement. The regulation does not transfer decision-making power.

Service Victoria. The Service Victoria CEO gains responsibility for performing these twelve functions. This increases Service Victoria’s operational footprint in the licensing space. The CEO must now manage identity verification processes for rooming houses, estate agents, owners corporation managers and conveyancers, in addition to any other transferred functions under the Service Victoria Act. This centralisation may yield economies of scale, but it also concentrates data and liability. If Service Victoria suffers a data breach, the exposure covers multiple licensing schemes.

The public generally. The regulation does not directly affect non-applicants. But because identity verification is a gatekeeping step, the efficiency of Service Victoria’s systems affects how quickly licences are processed. Delays or malfunctions at Service Victoria could bottleneck the entire application, even if the BLA is ready to decide. The regulation also affects the cost structure: the BLA’s cost of performing identity checks may differ from Service Victoria’s, and any cost difference could feed into licence fees (though the regulation does not directly change fees).

Duty of the Service Victoria CEO. Under section 10(5) of the Service Victoria Act 2018, the CEO must perform the transferred identity verification functions. This is a mandatory duty, not a discretionary power. The CEO cannot decline to perform the function if an applicant uses the maintained online site or app. The CEO must collect the identity information and verify the applicant’s identity as specified in each underlying Act. The regulation does not prescribe how the CEO must verify identity (e.g., via document upload, face match, or reference checks). That operational detail is left to Service Victoria’s systems and policies, subject to the Service Victoria Act and any standards.

Right of the applicant to use the online channel. The regulation does not create a right; it merely transfers the function when the applicant uses the online channel. Applicants retain the right to apply by other means (paper, in person) but, if they do, the function stays with the BLA. This may be confusing: an applicant who starts a paper application cannot later switch to the online system and expect the same BLA staff to handle identity checks. The procedural path must be chosen upfront.

Duty of the BLA. The BLA must not perform the transferred function for online applications. If the BLA continues to collect identity information via its own online system after the transfer, it would likely be acting outside its statutory authority. The BLA must cede that step to Service Victoria. The regulation does not explicitly state this prohibition, but it flows from the transfer: if a function is transferred, the original agency no longer has the power to perform it (at least in the same circumstances). For paper or in-person applications, the BLA retains the function.

Rights of the BLA to receive verified information. The regulation does not address how Service Victoria communicates the verification result to the BLA. The BLA needs to know whether identity has been verified before it can decide the licence. The absence of an explicit data-sharing obligation is a gap. Probably the Service Victoria Act or an agreement covers this, but the regulation itself is silent. If Service Victoria fails to transmit the result, the BLA cannot proceed, and the applicant is stuck. This creates a dependency on Service Victoria’s systems and data-sharing protocols.

Privacy rights of applicants. The regulation does not mention privacy, data protection, or the handling of identity information. Applicants have no specific right under this instrument to access, correct, or delete their identity data once collected by Service Victoria. Those rights exist under the Privacy and Data Protection Act 2014 (Vic), but this regulation does not incorporate or reference them. The transfer of the function to Service Victoria means that privacy obligations also transfer, but the applicant’s recourse remains with Service Victoria, not the BLA. This shift may be beneficial or harmful depending on Service Victoria’s privacy practices relative to the BLA’s.

No new right to challenge the transfer. The regulation does not create a right to object to the transfer or to have identity verification performed by the BLA instead. If an applicant prefers the BLA, the only option is to use a non-online channel. For many applicants, that may be impractical or slower.

This regulation does not itself create any penalties. Penalties for identity fraud, false statements, or misuse of identity information arise under the underlying licensing Acts and general criminal law. For example, the Rooming House Operators Act 2016, the Estate Agents Act 1980, the Owners Corporations Act 2006, and the Conveyancers Act 2006 each contain offences for providing false or misleading information. The regulation does not change those penalties. It only changes who collects the information.

Enforcement of the regulation’s operation falls to the Service Victoria Act 2018 and the general law. If the Service Victoria CEO fails to perform a transferred function, the remedy would likely be a judicial review application for failure to exercise a statutory duty. The regulation itself provides no penalty for non-performance by the CEO. Similarly, if the BLA continues to perform a transferred function (e.g., by operating its own identity check for an online application), it may be acting ultra vires. The regulation does not prescribe a penalty for that either. The BLA could potentially face an injunction or a declaration of invalidity.

The absence of explicit enforcement mechanisms in this regulation is typical for a machinery-of-government transfer instrument. The underlying Acts carry the substantive enforcement teeth. However, this also means that if Service Victoria’s identity verification system fails or is hacked, the penalty consequences (e.g., for failing to properly verify an applicant’s identity) remain with the original licensing scheme, but the entity responsible (Service Victoria) is not directly liable under those Acts. There is potential for a mismatch: the BLA could be penalised for granting a licence based on a faulty identity check performed by Service Victoria, even though the BLA had no control over the check. This risk is not addressed in the regulation.

Service Victoria Act 2018. This is the enabling Act. Section 10(5) of that Act allows the Governor in Council to prescribe transferred identity verification functions by regulation. The current regulations are made under section 58 of that Act. The Service Victoria Act sets out the CEO’s general powers and duties, including obligations around privacy, service standards, and reporting. Those provisions apply to the performance of these transferred functions. The regulation does not override any provision of the Service Victoria Act.

Rooming House Operators Act 2016. Sections 11, 15, 16, 17 and 18 of that Act are referenced in Schedule 1 items 1 and 2. Those sections require identity information to be provided with applications and in relation to disqualifying events. The regulation transfers the collection and verification of that information to Service Victoria, but does not alter the substantive requirements (e.g., the types of identity documents required, the disqualification criteria). The BLA still assesses the information for licensing purposes.

Estate Agents Act 1980. Sections 17, 31C, 14(5)(e) and 21(4)(b) are cited in items 3, 4 and 5. The effect is the same: identity verification for those specific provisions is transferred for online applications. The BLA retains all other functions under the Estate Agents Act.

Owners Corporations Act 2006. Sections 179, 180, 181 and 182A are cited in items 6, 7 and 8. These cover manager registration, renewal, notification of associates, and identity information. The transfer applies only to natural person applicants using the online channel.

Conveyancers Act 2006. Sections 11, 13 and 30 are cited in items 9, 10, 11 and 12. The transfer covers licence applications and identity information about disqualified persons. Similar to the others.

Business Licensing Authority Act 1998. The definition of “Business Licensing Authority” in regulation 4 incorporates the meaning from that Act. The BLA’s general functions under its own Act are not amended by this regulation. The BLA continues to operate and make licensing decisions.

Privacy and Data Protection Act 2014 (Vic). This regulation does not reference this Act, but it applies to Service Victoria as a public sector agency. Any collection, use, or disclosure of identity information by Service Victoria is subject to the Information Privacy Principles in that Act. However, the regulation does not specify which privacy principles apply to transferred functions or whether any exemptions exist. This could create uncertainty if Service Victoria’s identity verification practices differ from the BLA’s.

Other laws potentially affected. The regulation does not address interaction with the Electronic Transactions Act 2000 (Vic), the Surveillance Devices Act 1999 (Vic), or the Spent Convictions Act 2021 (Vic). Nor does it address interstate identity verification or the use of Commonwealth identity credentials (e.g., Document Verification Service). The regulation is silent on these points, which means the general law applies. Given the range of identity verification technologies (biometrics, linked data, third-party verification), this silence leaves regulatory gaps.

The regulations were made on 10 May 2022 and published as S.R. No. 27/2022. They came into operation on 12 May 2022 (regulation 3). The original version contained regulation 6 and Schedule 2, which presumably dealt with other matters (the source does not disclose their content). Those provisions were revoked by the Service Victoria (Miscellaneous) Amendment Regulations 2024, S.R. No. 38/2024, which were made on 28 May 2024 and commenced on 29 May 2024. Regulation 25 of that amending instrument revoked regulation 6, and regulation 26 revoked Schedule 2. The current version (Version No. 002) incorporates only the amendments up to 29 May 2024.

The reason for the revocation is not given in the source. It may reflect that the matters dealt with in regulation 6 and Schedule 2 were no longer needed, perhaps because they duplicated later transfers or were superseded by other instruments. The revocation simplifies the regulations. There is no other amendment history in the source. The endnote also notes that the regulations will sunset 10 years after 10 May 2022, on 10 May 2032, under section 5 of the Subordinate Legislation Act 1994.

The source contains no reference to any litigation concerning these regulations. No cases are cited in the explanatory details, and none are apparent from the text. Given that the regulations are a purely administrative transfer of functions, litigation is unlikely unless someone challenges the vires of the transfer (e.g., arguing that the function is not properly a “transferred identity verification function” under the Service Victoria Act 2018, or that the regulation is beyond the scope of section 58). A challenge might also arise if Service Victoria mishandles identity information (e.g., a data breach leading to identity theft) or if an applicant suffers a processing delay attributable to the transfer. But as of the publication date of this version (29 May 2024), no such litigation is recorded.

The absence of litigation does not mean there are no legal risks. The regulation’s dependence on ambiguous terms (e.g., “Internet site or mobile application maintained for that purpose”) may prompt judicial interpretation in the future. The term “maintained for that purpose” could be litigated if, say, a site is maintained by a third party contractor rather than Service Victoria or the BLA. The note to the regulation states it “will sunset 10 years after the day of making”, so any litigation would need to arise before May 2032.

Only online applications are covered. An applicant who uses a paper form, walks into an office, or uses a telephone service still deals with the BLA for identity verification. This bifurcation creates a two-track system. An applicant who starts online and then switches to paper will face a different agency for the identity step, potentially causing confusion and duplication.

The regulation does not mandate Service Victoria to create or maintain any online channel. The phrase “if the application is made by input into an Internet site or mobile application maintained for that purpose” means the transfer only operates if such a channel exists and is used. If Service Victoria does not maintain a site for a particular licence, the function reverts to the BLA. The regulation is passive: it transfers the function in the event of use, but it does not oblige Service Victoria to build or run the channel. This could lead to a situation where no online channel exists and applicants are forced back to paper, undermining the centralisation objective.

No data-sharing obligation specified. The regulation transfers the collection and verification function but does not say how the verified identity result reaches the BLA. If Service Victoria’s system does not communicate with the BLA’s system, the BLA may receive no information or only partial information. The applicant might have identity verified by Service Victoria but still be asked for it by the BLA. The regulation is silent on this critical operational link.

Privacy and data security gaps. The regulation does not address data custody, data retention, or data deletion. The identity information collected may be held by Service Victoria indefinitely, or may be transmitted to the BLA and held there. The regulation does not specify which agency is the data controller. Under the Privacy and Data Protection Act 2014, both agencies have obligations, but the regulation’s silence could lead to disputes over responsibility if a data breach occurs.

Scope limited to natural persons. Corporate applicants for the same licences are not covered. For example, a company applying for a conveyancing licence under section 13 of the Conveyancers Act 2006 would still have its identity information collected by the BLA, even if the natural person behind the company uses the online portal. The regulation does not define what constitutes a “natural person” for joint applicants. If a licence is applied for by two natural persons and a company, the identity verification for the natural persons is transferred, but the company’s is not. This adds complexity.

No transition provisions. The regulation came into effect on 12 May 2022 with no transition period. Applications already in process on that date would have been caught mid-stream. The regulation does not address whether an application started before the transfer but completed after is subject to the new arrangement. This could have resulted in practical disruption for applicants and the BLA.

Sunset clause. The regulations will automatically sunset on 10 May 2032. If no replacement regulation is made before then, the transferred functions revert to the BLA. Any systems built by Service Victoria to perform these functions will become redundant unless renewed. This introduces uncertainty for long-term planning and investment in identity verification infrastructure.

For applicants seeking a licence or registration covered by the twelve items, compliance is straightforward: use the online portal designated by Service Victoria for that specific licence type. The portal must be an “Internet site or mobile application maintained for that purpose”. The regulation does not specify the URL or app name, so applicants should check the Service Victoria website (service.vic.gov.au) or the BLA website for the correct channel. Providing identity information through any other channel (paper, in person, email) will keep the function with the BLA, which may still process it but will not be the transferred function. The applicant should also ensure they provide the exact identity information required under the underlying Act (e.g., for rooming house operators, what section 11 of the Rooming House Operators Act 2016 specifies). The regulation only transfers collection and verification; it does not change the required information.

For the Business Licensing Authority, compliance means ceasing to operate any online identity collection system for these specific transactions. The BLA should redirect applicants to Service Victoria’s portal. It should also update its own systems to accept verified identity data from Service Victoria, if that data is transmitted. If no data transmission occurs, the BLA will need to request the applicant to provide identity information again, which defeats the purpose. Ideally, the BLA and Service Victoria have an operational agreement on data flow.

For Service Victoria, compliance means building or maintaining an online system capable of collecting and verifying identity for each of the twelve functions. The system must comply with the Service Victoria Act 2018, including any applicable privacy and security standards. Service Victoria must also ensure that the verified identity result can be communicated to the BLA (or to the applicant for them to provide to the BLA) in a timely and reliable manner.

For practitioners advising clients, the key compliance steps are: (1) confirm the licence type is covered by Schedule 1; (2) check whether the applicant is a natural person; (3) locate the correct Service Victoria online channel; (4) ensure the applicant provides all required identity information through that channel; (5) retain evidence of identity verification (e.g., a receipt or confirmation number) in case the BLA queries the application due to missing identity data. Practitioners should also be aware that if the online channel is down or unavailable, the application may be delayed. There is no fallback to the BLA for online applications; the transfer is absolute. If Service Victoria’s site is not “maintained for that purpose”, the function stays with the BLA, but that is a factual question. Practitioners should document the attempted online submission if problems arise.

Finally, all parties should note the sunset date of 10 May 2032. After that, the regulations cease to have effect unless remade. Any long-term contractual or system arrangements depending on this transfer should include sunset contingencies.