Australia's new face verification system will actually improve privacy

Australia's national face verification service will significantly improve the privacy of biometric data processed by the government rather than lessen it, a privacy impact assessment of the system has found.

The face verification service (FVS) launched just over a year ago, allowing the AFP and DFAT to match a person's facial image against records held by Immigration.

The FVS complements the existing document verification service (DVS). It is intended to reduce cross-border crime by letting law enforcement agencies share facial images to verify people and identify unknown individuals.

The new capability for the AFP and DFAT was the first phase of the program. Other types of images such as visa and passport photos will be added over time, driver license images held by states and territories are also likely to be included, and more agencies will be given access.

But the introduction and expansion of the system have continued to raise privacy concerns.

Privacy advocates and the ACT government claimed prior to the platform's launch that it would allow police 'unprecedented and extraordinary' access to citizens' personal data without proper safeguards.

These concerns prompted the Attorney-General's Department to release the privacy impact assessment it had conducted on the design of the system.

The assessment did not identify any significant risks or privacy issues.

Today the AGD - the lead agency for the system - quietly disclosed another set of privacy impact assessment documents on the FVS, this time conducted by DFAT.

The documents reveal that DFAT contracted Stephen Wilson of Lockstep Consulting last year to conduct a PIA on the capability for DFAT and the AFP to access the image data held by Immigration.

This PIA also found no significant privacy issues.

Instead, it found that the FVS would actually improve privacy compared to how the three agencies currently share data.

The FVS will avoid "unnecessary manual handling of, and exposure to, biometric data by data holding agencies", Wilson wrote.

"The FVS will, over time, reduce the exposure of biometric data, by helping [Immigration, DFAT and the AFP] shift from ad hoc data transfers to more specific transactions," the report said.

"In particular, instead of caching relatively large volumes of facial data locally, DFAT officers will be able to make targeted matching inquiries against DIBP [Immigration], with significantly reduced extraneous flows and aggregations of images."

It will also formalise the handling of biometric data by restricting functionality to the specific agencies and named staff members who meet the requirements set out on the FVS access policy, Wilson said.

The findings will likely give the government more confidence in forging ahead with plans to open up the FVS to the private sector - as has occurred with the DVS - in the future.

The system operates as a hub-and-spoke model facilitating query and response requests. Agency users access the FVS through a web-based portal that allows them to compare an image on a one-on-one basis with another record to verify an individual's identity.

At the moment the system is restricted to one-to-one verification and image retrieval. In the longer term it will be capable of one-to-many search to identify an image in a photo.