Consent obligations for government users

This page provides information on collecting consent when verifying an individual’s identity through the Document Verification Service (DVS), as outlined in:

Using a consent statement

You must collect a person’s express consent to verify their identity using the DVS.

You can collect consent through a written statement that seeks a person’s permission to collect, use and disclose their personal information to verify their identity. Consent statements protect privacy by allowing a person to control when their personal information is collected, used and disclosed.

Writing a consent statement for the DVS

Collecting express consent

Clause 23.3(a) of your participation agreement requires you to collect express consent before verifying a person’s identity through the DVS. It requires you to make sure certain information is included in your consent statement:

  • confirmation that the person is authorised to provide their personal information
  • the reason the information is being requested and what it will be used for.

What express consent is

Express consent is consent that a person gives openly and obviously. They can give it either verbally or in writing. You can collect express consent electronically through methods such as a checkbox.

You are not allowed to infer that a person has given their consent. Because express consent must be unambiguous, requiring individuals to ‘opt out’ of consent is also not permitted.

What informed consent is

A person gives informed consent when they are aware of the consequences of giving or not giving their consent. This means you need to clearly state how your organisation will handle personal information. You should make sure your consent statement is written in plain language and clearly sets out what will happen if a person gives or does not give consent.

Consent statement example

You may want to refer to the following model consent statement when drafting your consent statement. This example is available in the DVS Access Policy:

☐ I confirm that I am authorised to provide the personal details presented and I consent to my information being checked with the document issuer or official record holder via third party systems for the purpose of confirming my identity.

To ensure the consent statement reflects your organisation’s specific circumstances, you may want to seek legal advice.

Other necessary information

Clause 23.3(b) sets out the information you must give a person before they can give their express consent. It is up to you to decide how to provide this information. It can be:

  • a link within the consent statement to external documents
  • included in the text of the consent statement itself.

If you choose to link to external documents – such as privacy policies or legislation – you must make sure your consent statement links to them clearly. You must make sure individuals can review this information before giving their consent. 

Obligation not to disclose identification information

  • Clause 24.2 of your participation agreement prohibits you from using identification information collected as part of a DVS request to:
  • create a data profile of the person
  • offer to supply goods and services (or enable another to do so)
  • advertise or promote goods or services (or enable another to do so)
  • conduct market research.

If you do not meet this obligation, you will be in breach of your participation agreement. Your use and access to the DVS may therefore be suspended or terminated.

Using the Collection Notice Template

We have published a Collection Notice Template. You can customise this template to create a notice that will let people know:

  • when you can collect their personal information
  • how you will handle their information after you have collected it.

The Collection Notice Template also has general guidance to help you meet your obligations under the participation agreement.

Your obligations when providing information

The box below helps you understand how to meet each of the requirements under clause 23.3(b) of your participation agreement.

  1. How you use the DVS: Your agency must inform individuals about how you use the DVS. This may require that your consent statement includes reference to a ‘third-party system’ for the purpose of identity verification. The consent statement example above is enough to achieve this.
  2. Your legal obligations: Your agency must inform individuals about its legal obligations when collecting personal information. This may include directing a person to the privacy legislation that your agency applies (such as the Privacy Act 1988 (Cth) or equivalent state, territory or New Zealand legislation).
  3. Rights of individuals: Your agency must inform individuals of their legal rights in relation to their personal information. This may include providing information about their ability to access and correct their information, about destruction of their information or about their right to know what information is being held.
  4. Consequences of declining to consent: Your agency must inform a person about will happen if they choose to withhold consent, such as not being able to access your agency’s services.
  5. Complaints mechanisms: You must provide individuals with information about how they can make complaints about the collection, use or disclosure of their personal information.
  6. Information about operation of the DVS: We encourage you to direct individuals to the IDMatch website for information about the operation of the DVS. You may wish to provide the link to the IDMatch home page in your consent statement or supporting information.

More on consent obligations

The OAIC has published resources explaining express, informed and bundled consent at Consent to the handling of personal information.

If you need more information on consent statements, please contact us at ivscompliancereporting@ag.gov.au.

This information should not be taken as legal advice. You should seek legal advice if you do not understand your legal obligations or how the legal requirements for collecting consent apply to you.