Service Victoria Act 2018
Authorised by the Chief Parliamentary Counsel
Authorised Version
i
Service Victoria Act 2018
No. 14 of 2018
TABLE OF PROVISIONS
Section Page
Part 1—Preliminary 1
1 Purposes 1
2 Commencement 2
3 Definitions 2
4 Meaning of service agency 8
Part 2—Transfer of customer service functions to Service Victoria 9
Division 1—Ministerial agreements 9
5 Transfer of customer service functions 9
6 Service Victoria CEO and service agency head must give effect
to agreement or notice 10
Division 2—Transferred customer service functions 10
7 Transfer back of customer service functions to service agency 10
8 Delegation of transferred customer service functions 11
Division 3—Other matters 11
9 Use and disclosure of regulated information 11
Part 3—Transfer of identity verification functions to Service
Victoria 13
Division 1—Ministerial agreements 13
10 Transfer of identity verification functions 13
11 Service Victoria CEO and service agency head must give effect
to agreement or notice 14
Division 2—Transferred identity verification functions 14
12 Transfer back of identity verification functions to service
agency 14
13 Delegation of transferred identity verification functions 15
Division 3—Other matters 16
14 Service agencies authorised to disclose regulated information to
Service Victoria 16
-- 1 of 53 --
Section Page
ii
Authorised by the Chief Parliamentary Counsel
Part 4—Role of Service Victoria 17
15 Functions of Service Victoria CEO 17
16 Powers of Service Victoria CEO 17
17 Service Victoria database 18
18 Exercise of power not to give applications or requests to service
agency for determination 18
Part 5—Customer service functions 19
Division 1—Performance of customer service functions 19
19 Service Victoria CEO must comply with customer service
standards 19
Division 2—Customer service standards 19
20 Development of customer service standards 19
Division 3—Minimum standards for customer service information
and account information 20
21 Service Victoria CEO must comply with minimum standards 20
22 Minimum standard for collection of information 21
23 Minimum standard for use or disclosure of information 21
24 Minimum standard for retention of information 22
Part 6—Identity verification and electronic identity credentials 24
Division 1—Performance of identity verification functions 24
25 Service Victoria CEO must comply with identity verification
standards 24
Division 2—Identity verification and electronic identity credentials 24
26 Application for temporary electronic identity credential 24
27 Determination of application for temporary electronic identity
credential 25
28 Interim refusal notices—issue of temporary electronic identity
credential 27
29 Limit on use of temporary electronic identity credentials 27
30 Renewal of electronic identity credentials 28
31 Interim refusal notices—renewal of ongoing electronic identity
credential 29
32 Status and level of assurance may be recorded on electronic
identity credentials 30
33 Increase in levels of assurance 30
34 Interim refusal notices—increase in level of assurance 32
35 Electronic identity credential as evidence of identity 33
36 Suspension of electronic identity credentials 34
37 Effect of suspension of electronic identity credential on
statutory timeframes 35
-- 2 of 53 --
Section Page
iii
Authorised by the Chief Parliamentary Counsel
38 Cancellation of electronic identity credential by Service
Victoria CEO 36
39 Cancellation of ongoing electronic identity credential by
individual 37
40 Review by VCAT 38
Division 3—Identity verification standards 38
41 Minister may make identity verification standards 38
42 Guiding principles for making and use of identity verification
standards 39
43 Service Victoria CEO to use identity verification standards 40
Division 4—Minimum standards for identity information 40
44 Service Victoria CEO must comply with minimum standards 40
45 Minimum standard for collection of identity information 41
46 Minimum standard for use or disclosure 41
47 Minimum standard for retention of information 42
Part 7—Offences 43
48 Improper issue of electronic identity credentials 43
49 False or misleading statement in applications 43
50 Unauthorised access to, use of or disclosure of data or
information 43
51 Restrictions on access, use or disclosure of data or information 44
Part 8—General 45
52 Delegation 45
53 Reporting requirements 45
54 Handling of regulated information under other Acts 46
55 Disclosure and use of regulated information to which a secrecy
provision applies 47
56 Audit 47
57 Review of operation of Act 48
58 Regulations 48
═══════════════
Endnotes 50
1 General information 50
-- 3 of 53 --
Authorised by the Chief Parliamentary Counsel
Authorised Version
1
Service Victoria Act 2018†
No. 14 of 2018
[Assented to 15 May 2018]
The Parliament of Victoria enacts:
Part 1—Preliminary
1 Purposes
The purposes of this Act are—
(a) to provide for the delivery of Government
services to the public by Service Victoria;
and
(b) to provide for a regulatory framework for the
provision of identity verification functions
by the Service Victoria CEO.
Victoria
-- 4 of 53 --
Part 1—Preliminary
Service Victoria Act 2018
No. 14 of 2018
2
Authorised by the Chief Parliamentary Counsel
2 Commencement
(1) Subject to subsection (2), this Act comes into
operation on a day or days to be proclaimed.
(2) If a provision of this Act does not come into
operation before 30 September 2018, it comes
into operation on that day.
3 Definitions
In this Act—
account information means any regulated
information collected by the Service Victoria
CEO in the exercise of any customer service
function under this Act in respect of a
Service Victoria account that relates to any
of the following—
(a) any record of an individual's Service
Victoria account usage;
(b) details of current authorities issued,
or official information documents
given or issued, to the individual to
whom the Service Victoria account
relates, whether or not obtained through
Service Victoria;
(c) details of any expired or cancelled
authorities issued to the individual to
whom the Service Victoria account
relates obtained through Service
Victoria;
authority means a licence, permit, approval,
authority or other authorisation (by whatever
name) given, granted or issued under an
enactment;
credential usage history means the record of the
usage of an electronic identity credential;
-- 5 of 53 --
Part 1—Preliminary
Service Victoria Act 2018
No. 14 of 2018
3
Authorised by the Chief Parliamentary Counsel
consent means express consent or implied
consent;
Council has the same meaning as in the Local
Government Act 1989;
customer service function means a function of the
following kind conferred on a service agency
under an enactment (whether express or
implied)—
(a) receiving an application or a request
for an authority or official information
document;
(b) receiving payment of any appropriate
fee required to be paid under an
enactment in respect of an application
or request for an authority or official
information document;
(c) delivering an authority or official
information document;
customer service information means any
regulated information collected by the
Service Victoria CEO in the exercise of any
customer service function under this Act
which relates to any of the following—
(a) authorities or official information
documents;
(b) applications for the issue or grant of
an authority or official information
document;
customer service standards means the standards
developed under section 20;
electronic identity credential means a temporary
electronic identity credential or an ongoing
electronic identity credential;
function includes duty;
-- 6 of 53 --
Part 1—Preliminary
Service Victoria Act 2018
No. 14 of 2018
4
Authorised by the Chief Parliamentary Counsel
Health Complaints Commissioner means the
Commissioner within the meaning of the
Health Complaints Act 2016;
health information has the same meaning as in
the Health Records Act 2001;
identifier has the same meaning as in the Health
Records Act 2001;
identity document means a document that
purports to provide evidence of an
individual's identity specified in the
identity verification standards;
identity information means, in relation to an
individual—
(a) an identity document or other
information that an individual provides
to the Service Victoria CEO for the
purposes of verifying the individual's
identity; and
(b) any other prescribed information;
identity verification function means a function
conferred on a service agency under an
enactment (whether express or implied) that
requires—
(a) an individual to provide the service
agency with information verifying the
individual's identity; or
(b) the service agency to obtain
information verifying an individual's
identity; or
(c) the service agency to verify an
individual's identity;
identity verification standards means the
standards made by the Minister under Part 6;
-- 7 of 53 --
Part 1—Preliminary
Service Victoria Act 2018
No. 14 of 2018
5
Authorised by the Chief Parliamentary Counsel
Information Commissioner means the person
appointed under section 6C of the Freedom
of Information Act 1982;
level of assurance means—
(a) in relation to an electronic identity
credential, the degree of confidence
that a credential is taken to provide as
set out in the identity verification
standards; or
(b) in relation to an identity verification
function, the level of assurance required
for the purposes of that function as
set out in the identity verification
standards;
official information document means a document
(by whatever name) given or issued under an
enactment by a public entity containing
information held by a public entity relating
to an individual, a matter or a thing;
Examples
Birth certificate or an assessment notice under the
Working with Children Act 2005.
ongoing electronic identity credential means an
electronic identity credential issued under
section 27(6);
personal information has the same meaning as in
the Privacy and Data Protection Act 2014;
public entity has the same meaning as in the
Public Administration Act 2004;
public service body has the same meaning as in
the Public Administration Act 2004;
regulated information means personal
information, health information, identifiers
and unique identifiers;
-- 8 of 53 --
Part 1—Preliminary
Service Victoria Act 2018
No. 14 of 2018
6
Authorised by the Chief Parliamentary Counsel
service agency has the meaning given by
section 4;
service agency function means a customer service
function or an identity verification function;
service agency head means—
(a) in the case of a public service body—
the public service body Head within the
meaning of the Public Administration
Act 2004; or
(b) in the case of a public entity that is a
body corporate—the chief executive
officer of the entity; or
(c) in the case of a public entity that is an
unincorporated body—the secretary or
chairperson of the committee managing
the affairs of the entity; or
(d) in the case of Victoria Police—the
Chief Commissioner of Police within
the meaning of the Victoria Police
Act 2013; or
(e) in the case of a person described in
section 4(1)(e)—that person;
service agency Minister, in relation to a service
agency function, means the Minister
responsible for administering the enactment
that confers the function on the service
agency;
Service Victoria means—
(a) if an Administrative Office within the
meaning of the Public Administration
Act 2004 is prescribed, that
Administrative Office; or
-- 9 of 53 --
Part 1—Preliminary
Service Victoria Act 2018
No. 14 of 2018
7
Authorised by the Chief Parliamentary Counsel
(b) if no Administrative Office is
prescribed, the Department responsible
to the Minister administering this Act;
Service Victoria CEO means the person
employed under section 12(2) of the Public
Administration Act 2004 as the Head of
Service Victoria;
Service Victoria database means the database
established under section 17;
special body has the same meaning as in the
Public Administration Act 2004;
temporary electronic identity credential means
an electronic identity credential issued under
section 27(1);
transferred customer service function means
a customer service function that is, by
operation of Part 2, transferred to the
Service Victoria CEO;
transferred identity verification function means
an identity verification function that is, by
operation of Part 3, transferred to the Service
Victoria CEO;
transaction has the same meaning as in the
Electronic Transactions (Victoria)
Act 2000;
unique identifier has the meaning given in
Schedule 1 to the Privacy and Data
Protection Act 2014;
Victoria Police has the same meaning as in the
Victoria Police Act 2013.
-- 10 of 53 --
Part 1—Preliminary
Service Victoria Act 2018
No. 14 of 2018
8
Authorised by the Chief Parliamentary Counsel
4 Meaning of service agency
(1) A service agency is any of the following—
(a) a public service body;
(b) a public entity;
(c) Victoria Police;
(d) a Council;
(e) a person holding an office or position
established by or under an Act (other than
the office of member of the Parliament
of Victoria) or to which the person was
appointed by the Governor in Council, or
by a Minister, otherwise than under an Act.
(2) A service agency does not include a special body
(other than Victoria Police).
-- 11 of 53 --
Part 2—Transfer of customer service functions to Service Victoria
Service Victoria Act 2018
No. 14 of 2018
9
Authorised by the Chief Parliamentary Counsel
Part 2—Transfer of customer service
functions to Service Victoria
Division 1—Ministerial agreements
5 Transfer of customer service functions
(1) Subject to subsection (3), the Minister and the
service agency Minister may agree for the Service
Victoria CEO to perform a customer service
function that is to be prescribed as a transferred
customer service function.
(2) An agreement under subsection (1) must be in
writing and a copy of it must be given to the
service agency head and the Service Victoria
CEO.
(3) If the Minister is the service agency Minister, the
Minister may publish a notice in the Government
Gazette that—
(a) the customer service function is to be
prescribed as a transferred customer service
function; and
(b) as a result of that prescription, the Service
Victoria CEO is to perform the function.
(4) A copy of a notice under subsection (3) must be
given to the service agency head and the Service
Victoria CEO.
(5) Despite anything to the contrary in the enactment
that confers a customer service function on a
service agency, on the commencement of a
regulation that prescribes the customer service
function to be a transferred customer service
function—
(a) the customer service function is to be
performed by the Service Victoria CEO; and
-- 12 of 53 --
Part 2—Transfer of customer service functions to Service Victoria
Service Victoria Act 2018
No. 14 of 2018
10
Authorised by the Chief Parliamentary Counsel
(b) the service agency cannot perform the
customer service function unless it is
delegated to the service agency head
under section 8.
(6) A regulation prescribing a customer service
function to be a transferred customer service
function must not be made unless—
(a) an agreement has been made under
subsection (1) in respect of that function; or
(b) a notice has been published under
subsection (3) in respect of that function.
6 Service Victoria CEO and service agency head must
give effect to agreement or notice
The Service Victoria CEO and a service agency
head must use best endeavours to give effect to an
agreement under section 5(1) or a notice under
section 5(3) that applies to them.
Division 2—Transferred customer service functions
7 Transfer back of customer service functions to
service agency
(1) Subject to subsection (2), the Minister and the
service agency Minister may agree for the transfer
back to a service agency of any transferred
customer service function.
(2) If the Minister is the service agency Minister, the
Minister may publish a notice in the Government
Gazette that—
(a) the transferred customer service function
is to be prescribed as a revoked customer
service function; and
(b) as a result of that prescription, the service
agency is to perform the function.
-- 13 of 53 --
Part 2—Transfer of customer service functions to Service Victoria
Service Victoria Act 2018
No. 14 of 2018
11
Authorised by the Chief Parliamentary Counsel
(3) An agreement under subsection (1) must be in
writing and a copy of it must be given to the
service agency head and the Service Victoria
CEO.
(4) A copy of a notice under subsection (2) must be
given to the service agency head and the Service
Victoria CEO.
(5) On the commencement of a regulation that
prescribes a transferred customer service function
to be a revoked customer service function—
(a) the customer service function is to be
performed by the service agency in
accordance with the enactment that confers
the function on the service agency; and
(b) the Service Victoria CEO cannot perform
that function.
8 Delegation of transferred customer service functions
(1) The Service Victoria CEO, by instrument, may
delegate any transferred customer service function
to the service agency head of the service agency
from which that function is transferred.
(2) A service agency head to whom a transferred
customer service function is delegated under
subsection (1) may delegate that function to any
person or class of person employed by, or acting
on behalf of, the service agency from which the
function is transferred.
Division 3—Other matters
9 Use and disclosure of regulated information
(1) This section applies despite anything to the
contrary in any Act (other than the Charter of
Human Rights and Responsibilities Act 2006)
or law.
-- 14 of 53 --
Part 2—Transfer of customer service functions to Service Victoria
Service Victoria Act 2018
No. 14 of 2018
12
Authorised by the Chief Parliamentary Counsel
(2) A service agency is authorised to disclose
regulated information that the agency holds to the
Service Victoria CEO or a delegate of the Service
Victoria CEO but only for the purpose of enabling
any of the following functions to be performed—
(a) transferred customer service functions;
(b) a function that is ancillary to a function
described in paragraph (a).
Note
See section 55 for the disclosure of information to which a secrecy
provision applies.
-- 15 of 53 --
Part 3—Transfer of identity verification functions to Service Victoria
Service Victoria Act 2018
No. 14 of 2018
13
Authorised by the Chief Parliamentary Counsel
Part 3—Transfer of identity verification
functions to Service Victoria
Division 1—Ministerial agreements
10 Transfer of identity verification functions
(1) Subject to subsection (3), the Minister and the
service agency Minister may agree for the Service
Victoria CEO to perform an identity verification
function that is to be prescribed as a transferred
identity verification function.
(2) An agreement under subsection (1) must be in
writing and a copy of it must be given to the
service agency head and the Service Victoria
CEO.
(3) If the Minister is the service agency Minister, the
Minister may publish a notice in the Government
Gazette that—
(a) the identity verification function is to be
prescribed as a transferred identity
verification function; and
(b) as a result of that prescription, the Service
Victoria CEO is to perform the function.
(4) A copy of a notice under subsection (3) must be
given to the service agency head and the Service
Victoria CEO.
(5) Despite anything to the contrary in the enactment
that confers an identity verification function on
a service agency, on the commencement of a
regulation that prescribes the identity verification
function to be a transferred identity verification
function—
(a) the identity verification function is to be
performed by the Service Victoria CEO; and
-- 16 of 53 --
Part 3—Transfer of identity verification functions to Service Victoria
Service Victoria Act 2018
No. 14 of 2018
14
Authorised by the Chief Parliamentary Counsel
(b) the service agency cannot perform the
identity verification function unless it is
delegated to the service agency head under
section 13.
(6) A regulation prescribing an identity verification
function to be a transferred identity verification
function must not be made unless—
(a) an agreement has been made under
subsection (1) in respect of that function; or
(b) a notice has been published under
subsection (3) in respect of that function.
11 Service Victoria CEO and service agency head must
give effect to agreement or notice
The Service Victoria CEO and a service agency
head must use best endeavours to give effect to an
agreement under section 10(1) or a notice under
section 10(3) that applies to them.
Division 2—Transferred identity
verification functions
12 Transfer back of identity verification functions to
service agency
(1) Subject to subsection (2), the Minister and the
service agency Minister may agree for the transfer
back to a service agency of any transferred
identity verification function.
(2) If the Minister is the service agency Minister, the
Minister may publish a notice in the Government
Gazette that—
(a) the transferred identity verification function
is to be prescribed as a revoked identity
verification function; and
(b) as a result of that prescription, the service
agency is to perform the function.
-- 17 of 53 --
Part 3—Transfer of identity verification functions to Service Victoria
Service Victoria Act 2018
No. 14 of 2018
15
Authorised by the Chief Parliamentary Counsel
(3) An agreement under subsection (1) must be in
writing and a copy of it must be given to the
service agency head and the Service Victoria
CEO.
(4) A copy of a notice under subsection (2) must be
given to the service agency head and the Service
Victoria CEO.
(5) On the commencement of a regulation that
prescribes a transferred identity verification
function to be a revoked identity verification
function—
(a) the identity verification function is to
be performed by the service agency in
accordance with the enactment that confers
the function on the service agency; and
(b) the Service Victoria CEO cannot perform
that function.
13 Delegation of transferred identity verification
functions
(1) The Service Victoria CEO, by instrument, may
delegate any transferred identity verification
function to the service agency head of the service
agency from which that function is transferred.
(2) A service agency head to whom a transferred
identity verification function is delegated under
subsection (1) may delegate that function to any
person or class of person employed by, or acting
on behalf of, the service agency from which the
function is transferred.
-- 18 of 53 --
Part 3—Transfer of identity verification functions to Service Victoria
Service Victoria Act 2018
No. 14 of 2018
16
Authorised by the Chief Parliamentary Counsel
Division 3—Other matters
14 Service agencies authorised to disclose regulated
information to Service Victoria
(1) This section applies despite anything to the
contrary in any Act (other than the Charter of
Human Rights and Responsibilities Act 2006)
or law.
(2) A service agency is authorised to disclose
regulated information that the agency holds to the
Service Victoria CEO or a delegate of the Service
Victoria CEO but only for the purpose of enabling
any of the following functions to be performed—
(a) transferred identity verification functions;
(b) a function that is ancillary to a function
described in paragraph (a).
Note
See section 55 for the disclosure of information to which a secrecy
provision applies.
-- 19 of 53 --
Part 4—Role of Service Victoria
Service Victoria Act 2018
No. 14 of 2018
17
Authorised by the Chief Parliamentary Counsel
Part 4—Role of Service Victoria
15 Functions of Service Victoria CEO
The Service Victoria CEO has the following
functions—
(a) to perform transferred customer service
functions;
(b) to develop customer service standards to
improve the delivery of Government services
to individuals;
(c) to verify identity and to perform transferred
identity verification functions;
(d) to assist the Minister to develop identity
verification standards to achieve a consistent
and secure process to verify identity;
(e) to issue electronic identity credentials;
(f) to provide advice and information on matters
relating to customer service functions and
identity verification functions;
(g) to perform functions ancillary to a function
referred to in paragraphs (a) to (c);
(h) to perform any other functions conferred by
or under this Act or any other enactment.
16 Powers of Service Victoria CEO
(1) The Service Victoria CEO has power to do all
things that are necessary or convenient to be done
for or in connection with the performance of the
Service Victoria CEO's functions.
(2) In addition, for the purposes of performing a
transferred customer service function, the
Service Victoria CEO may exercise any power
(whether express or implied) under the enactment
that confers the customer service function on the
service agency that is necessary or convenient to
-- 20 of 53 --
Part 4—Role of Service Victoria
Service Victoria Act 2018
No. 14 of 2018
18
Authorised by the Chief Parliamentary Counsel
be exercised to perform that transferred customer
service function.
17 Service Victoria database
(1) The Service Victoria CEO must establish and
maintain a database for the purposes of recording
information required for the performance of the
functions of Service Victoria and the Service
Victoria CEO.
(2) The Service Victoria database—
(a) must be kept electronically; and
(b) may include the following in relation to
individuals who use Service Victoria
services—
(i) account information;
(ii) electronic identity credentials;
(iii) credential usage history;
(iv) customer service information;
(v) identity information; and
(c) may be comprised of multiple databases.
18 Exercise of power not to give applications or
requests to service agency for determination
(1) This section applies if the Service Victoria CEO
does not give an application or request for an
authority or official information document that
the Service Victoria CEO has received to the
appropriate service agency for determination
because the application or request does not meet
the requirements under the relevant enactment.
(2) The exercise of that power is not to be taken to be
a decision of the service agency to reject or refuse
the application or request.
-- 21 of 53 --
Part 5—Customer service functions
Service Victoria Act 2018
No. 14 of 2018
19
Authorised by the Chief Parliamentary Counsel
Part 5—Customer service functions
Division 1—Performance of
customer service functions
19 Service Victoria CEO must comply with customer
service standards
The Service Victoria CEO must comply with
customer service standards when performing—
(a) transferred customer service functions; or
(b) a function that is ancillary to a function
described in paragraph (a).
Example
An example of a function that is ancillary to a
function described in paragraph (a) is refunding a
payment that was collected as part of exercising a
transferred customer service function.
Division 2—Customer service standards
20 Development of customer service standards
(1) The Service Victoria CEO must develop standards
that relate to one or more of the following—
(a) the customer experience with the provision
of services;
(b) the development and design of processes for
the provision of services;
(c) the handling of customer complaints,
including response times for handling
customer complaints;
(d) the monitoring of and reporting on
compliance with the customer service
standards;
(e) any other matter related to the exercise of
customer service functions.
-- 22 of 53 --
Part 5—Customer service functions
Service Victoria Act 2018
No. 14 of 2018
20
Authorised by the Chief Parliamentary Counsel
(2) Customer service standards must be published on
the Internet.
Division 3—Minimum standards for customer
service information and account information
21 Service Victoria CEO must comply with minimum
standards
(1) The Service Victoria CEO must comply with
the minimum standards set out in this Division
for the collection, use, disclosure and retention
of customer service information and account
information.
(2) For the purposes of Division 8 of Part 3 of
the Privacy and Data Protection Act 2014, a
contravention of the minimum standards set out
in this Division involving personal information is
taken to be an interference with the privacy of an
individual.
(3) For the purposes of Division 9 of Part 3 of
the Privacy and Data Protection Act 2014, a
contravention of the minimum standards set out
in this Division involving personal information is
taken to be a contravention of an Information
Privacy Principle of the Privacy and Data
Protection Act 2014.
(4) For the purposes of Part 6 of the Health Records
Act 2001, a contravention of the minimum
standards set out in this Division involving health
information is taken to be an interference with the
privacy of an individual.
(5) For the purposes of section 66 of the Health
Records Act 2001, a contravention of the
minimum standards set out in this Division
involving health information is taken to be a
contravention of that Act.
-- 23 of 53 --
Part 5—Customer service functions
Service Victoria Act 2018
No. 14 of 2018
21
Authorised by the Chief Parliamentary Counsel
22 Minimum standard for collection of information
(1) The Service Victoria CEO must not collect
customer service information unless the collection
is necessary to perform any functions under this
Act for an individual to whom that information
relates.
(2) The Service Victoria CEO must not collect
account information unless—
(a) the collection is necessary to perform any
functions under this Act for an individual
to whom that information relates; and
(b) the individual has consented.
23 Minimum standard for use or disclosure of
information
(1) The Service Victoria CEO must not use or
disclose customer service information unless the
use or disclosure is necessary—
(a) to perform any functions under this Act for
an individual to whom that information
relates; or
(b) for a person authorised by the Service
Victoria CEO to carry out administrative,
technical or other functions relating to the
management, maintenance or auditing of the
Service Victoria database.
(2) The Service Victoria CEO must not use or
disclose account information unless the use or
disclosure is necessary—
(a) to perform any functions under this Act for
an individual to whom that information
relates and the individual has consented; or
(b) for a person authorised by the Service
Victoria CEO to carry out administrative,
technical or other functions relating to the
-- 24 of 53 --
Part 5—Customer service functions
Service Victoria Act 2018
No. 14 of 2018
22
Authorised by the Chief Parliamentary Counsel
management, maintenance or auditing of the
Service Victoria database.
(3) Despite subsections (1) and (2), the Service
Victoria CEO may use or disclose customer
service information or account information if—
(a) the information is personal information and
it is used or disclosed in accordance with
Information Privacy Principle 2.1(d), 2.1(e),
2.1(g) or 2.1(h) of the Privacy and Data
Protection Act 2014; or
(b) the information is health information and it is
used or disclosed in accordance with Health
Privacy Principle 2.2(h), 2.2(i) or 2.2(j) of
the Health Records Act 2001.
24 Minimum standard for retention of information
(1) The Service Victoria CEO must not retain any
incomplete application for an authority or official
information document for longer than the earlier
of—
(a) 90 days after the creation of the application;
or
(b) any other period required by law.
(2) Subject to subsection (1), the Service Victoria
CEO must not retain customer service information
relating to an individual after the earlier of—
(a) notification being received from the service
agency that the transaction to which the
information relates is complete; or
(b) any other period required by law.
-- 25 of 53 --
Part 5—Customer service functions
Service Victoria Act 2018
No. 14 of 2018
23
Authorised by the Chief Parliamentary Counsel
(3) The Service Victoria CEO must not retain account
information after the earlier of—
(a) the closure or expiry of the account to which
the information relates; or
(b) any other period required by law.
(4) The Service Victoria CEO must not retain any
authority or official information document, or
copy of an authority or official information
document, once it has been delivered to the
individual to whom it relates, unless required
by law.
-- 26 of 53 --
Part 6—Identity verification and electronic identity credentials
Service Victoria Act 2018
No. 14 of 2018
24
Authorised by the Chief Parliamentary Counsel
Part 6—Identity verification and
electronic identity credentials
Division 1—Performance of identity
verification functions
25 Service Victoria CEO must comply with identity
verification standards
The Service Victoria CEO must comply with the
identity verification standards when—
(a) verifying identity under this Part; or
(b) performing a function that is ancillary to
identity verifications under this Part.
Division 2—Identity verification and
electronic identity credentials
26 Application for temporary electronic identity
credential
(1) An individual may apply to the Service Victoria
CEO for the issue of a temporary electronic
identity credential in the form and manner
determined by the Service Victoria CEO.
(2) An application for a temporary electronic identity
credential must—
(a) be made in a form and manner consistent
with the determination made under
subsection (1); and
(b) be accompanied by any identity information
required by the determination made under
subsection (1).
-- 27 of 53 --
Part 6—Identity verification and electronic identity credentials
Service Victoria Act 2018
No. 14 of 2018
25
Authorised by the Chief Parliamentary Counsel
27 Determination of application for temporary
electronic identity credential
(1) If an individual makes an application under
section 26, the Service Victoria CEO must—
(a) issue a temporary electronic identity
credential to the individual; or
(b) issue an interim refusal notice to the
individual in accordance with section 28.
(2) A temporary electronic identity credential or
interim refusal notice under subsection (1) must
be issued—
(a) in the case of an individual who is a member
of a prescribed class of individual—within
the period prescribed for that class; or
(b) in any other case—within 10 days after
receiving the application under section 26.
(3) The Service Victoria CEO must issue a temporary
electronic identity credential to an individual
unless—
(a) any or all of the identity information
accompanying the application under
section 26 cannot be verified using the
procedure set out in the identity verification
standards; or
(b) the Service Victoria CEO issued an
electronic identity credential to the
individual and that credential was
suspended under section 36; or
(c) the individual, before making the
application, made the same, or a
substantially similar, application that—
(i) was refused under section 28; and
(ii) was accompanied by the same or
substantially similar information.
-- 28 of 53 --
Part 6—Identity verification and electronic identity credentials
Service Victoria Act 2018
No. 14 of 2018
26
Authorised by the Chief Parliamentary Counsel
(4) Before a temporary electronic identity credential
issued to an individual expires under subsection
(5), the Service Victoria CEO must determine
whether the individual, other than an individual
to whom an ongoing electronic identity credential
is issued, consents to the continuation of the
temporary electronic identity credential as an
ongoing electronic identity credential.
(5) If an individual does not consent to the
continuation of a temporary electronic identity
credential, the credential expires—
(a) if the individual uses the credential for the
purposes of a transaction—on the later of the
following days—
(i) the day on which that transaction is
finally determined;
(ii) the day on which the Service Victoria
CEO determines that the individual
does not consent to the continuation of
the credential; or
(b) in any other case—10 days after the
credential is issued.
(6) If an individual consents to the continuation of
a temporary electronic identity credential, the
Service Victoria CEO must issue an ongoing
electronic identity credential to the individual.
(7) Unless it is renewed under section 30, an
ongoing electronic identity credential issued
under subsection (6) expires on the earlier of the
following—
(a) the expiry of a period of 10 years after the
day on which the credential is issued;
(b) the expiry of any shorter period prescribed
for the purposes of this subsection.
-- 29 of 53 --
Part 6—Identity verification and electronic identity credentials
Service Victoria Act 2018
No. 14 of 2018
27
Authorised by the Chief Parliamentary Counsel
28 Interim refusal notices—issue of temporary
electronic identity credential
(1) An interim refusal notice issued to an individual
under section 27 must—
(a) specify the reasons that the notice is issued;
and
(b) specify the date on which the notice is
issued; and
(c) invite the individual to submit further
identity information in support of the
application in response to which the notice
is issued within 28 days after the date of the
notice.
(2) Within 7 days after receiving a submission under
subsection (1) from an individual, the Service
Victoria CEO must consider the submission and
either—
(a) issue a temporary electronic identity
credential to the individual; or
(b) refuse to issue a temporary electronic
identity credential to the individual.
(3) If the individual to whom an interim refusal
notice is issued under section 27 does not make
a submission in response to that notice within
28 days after the date on which the notice is
issued, the Service Victoria CEO must refuse to
issue a temporary electronic identity credential
to the individual.
29 Limit on use of temporary electronic identity
credentials
A temporary electronic identity credential may not
be used in relation to the determination of more
than one transferred customer service function or
transferred identity verification function.
-- 30 of 53 --
Part 6—Identity verification and electronic identity credentials
Service Victoria Act 2018
No. 14 of 2018
28
Authorised by the Chief Parliamentary Counsel
30 Renewal of electronic identity credentials
(1) An individual may apply to the Service Victoria
CEO for the renewal of an ongoing electronic
identity credential in the form and manner
determined by the Service Victoria CEO.
(2) An application for the renewal of an ongoing
electronic identity credential must—
(a) be made—
(i) at least 90 days before the credential is
due to expire under section 27(7); or
(ii) if the credential is suspended under
section 36 and the period of that
suspension ends less than 90 days
before the credential is due to expire
under section 27(7), as soon as
reasonably practicable after the end
of the suspension; and
(b) be made in a form and manner consistent
with the determination made under
subsection (1).
(3) If an individual makes an application for the
renewal of an ongoing electronic identity
credential, the Service Victoria CEO must—
(a) renew the ongoing electronic identity
credential; or
(b) issue an interim refusal notice to the
individual in accordance with section 31.
(4) The Service Victoria CEO must renew the
ongoing electronic identity credential or issue an
interim refusal notice under subsection (3)—
(a) in the case of an individual who is a member
of a prescribed class of individual—within
the period prescribed for that class; or
-- 31 of 53 --
Part 6—Identity verification and electronic identity credentials
Service Victoria Act 2018
No. 14 of 2018
29
Authorised by the Chief Parliamentary Counsel
(b) in any other case—within 10 days after
receiving the application for the renewal.
(5) The Service Victoria CEO must issue an interim
refusal notice to an individual if—
(a) the application for the renewal of the
ongoing electronic identity credential does
not comply with subsection (2); or
(b) the Service Victoria CEO is satisfied on
reasonable grounds that the individual is
not the individual to whom the ongoing
electronic identity credential relates; or
(c) the identity of the applicant has not been
verified in accordance with the identity
verification standards.
(6) An ongoing electronic identity credential renewed
under subsection (3) continues in force until the
earlier of the following—
(a) the expiry of a period of 10 years after the
day on which the credential is renewed under
that subsection;
(b) the expiry of any shorter period prescribed
for the purposes of this section;
(c) the cancellation of the credential under
section 38.
31 Interim refusal notices—renewal of ongoing
electronic identity credential
(1) An interim refusal notice issued to an individual
under section 30 must—
(a) specify the reasons that the notice is issued;
and
(b) specify the date on which the notice is
issued; and
-- 32 of 53 --
Part 6—Identity verification and electronic identity credentials
Service Victoria Act 2018
No. 14 of 2018
30
Authorised by the Chief Parliamentary Counsel
(c) invite the individual to submit further
identity information in support of the
application for the renewal of the ongoing
electronic identity credential within 28 days
after the date of the notice.
(2) Within 7 days after receiving a submission under
subsection (1) from an individual, the Service
Victoria CEO must consider the submission and
either—
(a) renew the ongoing electronic identity
credential; or
(b) refuse to renew the ongoing electronic
identity credential.
(3) If the individual to whom an interim refusal
notice is issued under section 30 does not make
a submission in response to that notice within
28 days after the date on which the notice is
issued, the Service Victoria CEO must refuse to
renew the ongoing electronic identity credential.
32 Status and level of assurance may be recorded on
electronic identity credentials
The Service Victoria CEO may record the status
and level of assurance of an electronic identity
credential from time to time on the credential.
33 Increase in levels of assurance
(1) An individual may apply to the Service Victoria
CEO for an increase in the level of assurance of
an ongoing electronic identity credential issued to
the individual in the form and manner determined
by the Service Victoria CEO.
(2) An application for an increase in the level of
assurance of an ongoing electronic identity
credential must—
-- 33 of 53 --
Part 6—Identity verification and electronic identity credentials
Service Victoria Act 2018
No. 14 of 2018
31
Authorised by the Chief Parliamentary Counsel
(a) be made in a form and manner consistent
with the determination made under
subsection (1); and
(b) be accompanied by any identity information
required by the determination made under
subsection (1).
(3) If an individual makes an application for an
increase in the level of assurance of an ongoing
electronic identity credential, the Service Victoria
CEO must—
(a) increase the level of assurance of the
ongoing electronic identity credential; or
(b) issue an interim refusal notice to the
individual in accordance with section 34.
(4) The Service Victoria CEO must increase the level
of assurance of the ongoing electronic identity
credential or issue an interim refusal notice under
subsection (3)—
(a) in the case of an individual who is a member
of a prescribed class of individual—within
the period prescribed for that class; or
(b) in any other case—within 10 days after
receiving the application for the increase.
(5) The Service Victoria CEO must increase the level
of assurance of an ongoing electronic identity
credential unless—
(a) any or all of the identity information
accompanying the application for the
increase cannot be verified using the
procedure set out in the identity verification
standards; or
(b) the individual to whom the credential is
issued, before making the application for the
increase, made the same, or a substantially
similar, application that—
-- 34 of 53 --
Part 6—Identity verification and electronic identity credentials
Service Victoria Act 2018
No. 14 of 2018
32
Authorised by the Chief Parliamentary Counsel
(i) was refused under section 34; and
(ii) was accompanied by the same or
substantially similar information; or
(c) the application for the increase does not
comply with the determination under
subsection (1).
(6) If the level of assurance of an ongoing electronic
identity credential is increased under subsection
(3), that credential continues in force until the
earlier of the following—
(a) the expiry of a period of 10 years after the
day on which the level of assurance of the
credential is increased;
(b) the expiry of any shorter period prescribed
for the purposes of this subsection.
34 Interim refusal notices—increase in level of
assurance
(1) An interim refusal notice issued to an individual
under section 33 must—
(a) specify the reasons that the notice is issued;
and
(b) specify the date on which the notice is
issued; and
(c) invite the individual to submit further
identity information in support of the
application for the increase in the level of
assurance within 28 days after the date of
the notice.
(2) Within 7 days after receiving a submission under
subsection (1) from an individual, the Service
Victoria CEO must consider the submission and
either—
-- 35 of 53 --
Part 6—Identity verification and electronic identity credentials
Service Victoria Act 2018
No. 14 of 2018
33
Authorised by the Chief Parliamentary Counsel
(a) increase the level of assurance of the
ongoing electronic identity credential; or
(b) refuse to increase the level of assurance of
the ongoing electronic identity credential.
(3) If the individual to whom an interim refusal
notice is issued under section 33 does not make
a submission in response to that notice within
28 days after the date on which the notice is
issued, the Service Victoria CEO must refuse to
increase the level of assurance of the ongoing
electronic identity credential.
35 Electronic identity credential as evidence of identity
(1) The requirements of a transferred identity
verification function to obtain information
relating to an individual's identity or to verify
an individual's identity are met if—
(a) the Service Victoria CEO notifies the service
agency that an electronic identity credential
has been issued to the individual; and
(b) the level of assurance of the credential is
the same as, or higher than, the level of
assurance required for the purposes of the
function under the identity verification
standards.
(2) The suspension, expiry or cancellation of an
electronic identity credential, or the removal or
variation of any information recorded on that
credential, does not, of itself, affect the validity of
a transaction that relied on the credential to verify
the identity of an individual if the suspension,
expiry, cancellation, removal or variation takes
place after the transaction was finally determined.
(3) If the Service Victoria CEO notifies a service
agency that an electronic identity credential has
been issued to an individual, the Service Victoria
-- 36 of 53 --
Part 6—Identity verification and electronic identity credentials
Service Victoria Act 2018
No. 14 of 2018
34
Authorised by the Chief Parliamentary Counsel
CEO must notify the service agency if the
credential is cancelled under section 38.
36 Suspension of electronic identity credentials
(1) The Service Victoria CEO must suspend the
operation of an electronic identity credential if the
Service Victoria CEO is satisfied on reasonable
grounds that the individual to whom the credential
is issued is not the individual to whom the
credential relates.
(2) The Service Victoria CEO may consider
any information the Service Victoria CEO
considers appropriate when determining whether
to suspend an electronic identity credential under
subsection (1).
(3) As soon as reasonably practicable after
suspending an electronic identity credential under
subsection (1), the Service Victoria CEO must
give the individual to whom the credential is
issued a written notice that—
(a) specifies the date and grounds on which the
credential was suspended; and
(b) invites the individual to make submissions
on the suspension within 28 days after the
date of the notice; and
(c) describes the effect of subsection (4).
(4) The suspension of an electronic identity
credential under subsection (1) is revoked if
the Service Victoria CEO does not cancel the
credential under section 38(1) within the period
set out in section 38(2).
-- 37 of 53 --
Part 6—Identity verification and electronic identity credentials
Service Victoria Act 2018
No. 14 of 2018
35
Authorised by the Chief Parliamentary Counsel
(5) The suspension of an electronic identity credential
under this section has effect—
(a) from the time decided by the Service
Victoria CEO and specified in the notice
given to the individual under subsection (3);
and
(b) until the credential is cancelled under
section 38(1) or the suspension of the
credential is revoked under subsection (4).
(6) The suspension of an electronic identity
credential under this section does not affect the
date on which the credential is to expire.
37 Effect of suspension of electronic identity credential
on statutory timeframes
(1) This section applies if—
(a) a service agency is exercising a function
conferred on the service agency by an
enactment in relation to an individual to
whom an electronic identity credential is
issued; and
(b) the Service Victoria CEO has notified the
service agency of the issue of the electronic
identity credential.
(2) If the enactment that confers the function on the
service agency specifies a time period in which
the function must be exercised, that time period—
(a) ceases to run if, and from the time, the
Service Victoria CEO notifies the service
agency of the suspension of the electronic
identity credential; and
(b) begins to run again if, and from the time, the
Service Victoria CEO notifies the service
agency that the suspension of the electronic
identity credential is revoked.
-- 38 of 53 --
Part 6—Identity verification and electronic identity credentials
Service Victoria Act 2018
No. 14 of 2018
36
Authorised by the Chief Parliamentary Counsel
38 Cancellation of electronic identity credential by
Service Victoria CEO
(1) The Service Victoria CEO must, by written notice,
cancel an electronic identity credential that is
suspended under section 36(1) if, after considering
any submission in response to the invitation
under section 36(3)(b), the Service Victoria CEO
remains satisfied on reasonable grounds that the
individual to whom the credential is issued is not
the individual to whom the credential relates.
(2) Notice under subsection (1) must be given within
7 days after the earlier of the following—
(a) the day the Service Victoria CEO receives a
submission from the individual in response
to the invitation under section 36(3)(b);
(b) the end of the period during which the
individual may make a submission in
response to that invitation.
(3) The Service Victoria CEO must cancel an
electronic identity credential if the Service
Victoria CEO is satisfied on reasonable grounds
that—
(a) the credential has been issued or renewed
in error or the level of assurance of the
credential has been increased in error; or
(b) the individual to whom the credential was
issued has died.
(4) The Service Victoria CEO may consider
any information the Service Victoria CEO
considers appropriate when determining whether
to cancel an electronic identity credential under
subsection (3).
(5) After cancelling an electronic identity credential
under subsection (3)(a), the Service Victoria CEO
must, as soon as possible after the credential
-- 39 of 53 --
Part 6—Identity verification and electronic identity credentials
Service Victoria Act 2018
No. 14 of 2018
37
Authorised by the Chief Parliamentary Counsel
is cancelled, give the individual to whom the
credential is issued a written notice that specifies
the date and grounds on which the credential was
cancelled.
(6) A cancellation of an electronic identity credential
has effect from the time at which—
(a) in the case of a cancellation under
subsection (1), notice is given to the
individual under that subsection; or
(b) in the case of a cancellation under
subsection (3)(a), notice of the
cancellation is given to the individual
under subsection (5); or
(c) in the case of a cancellation under
subsection (3)(b), the Service Victoria CEO
cancels the electronic identity credential.
39 Cancellation of ongoing electronic identity
credential by individual
(1) An individual may apply to the Service Victoria
CEO for the cancellation of an ongoing electronic
identity credential in the form and manner
determined by the Service Victoria CEO.
(2) On receiving an application for the cancellation
of an ongoing electronic identity credential, the
Service Victoria CEO must—
(a) cancel the credential; and
(b) as soon as reasonably practicable after
cancelling the credential, give notice in
writing to the individual to whom the
credential is issued of the cancellation.
-- 40 of 53 --
Part 6—Identity verification and electronic identity credentials
Service Victoria Act 2018
No. 14 of 2018
38
Authorised by the Chief Parliamentary Counsel
40 Review by VCAT
(1) A person may apply to VCAT for review of a
decision—
(a) to refuse to issue an electronic identity
credential; or
(b) to cancel an electronic identity credential; or
(c) to refuse to renew an ongoing electronic
identity credential; or
(d) to refuse to increase the level of assurance of
an ongoing electronic identity credential.
(2) An application for review under this section must
be made within 28 days after the day on which the
Service Victoria CEO gives notice of the refusal
or decision.
Division 3—Identity verification standards
41 Minister may make identity verification standards
(1) The Minister may make identity verification
standards for the purpose of achieving a consistent
and secure identity verification framework for
transactions.
(2) The identity verification standards are to deal with
digital and non-digital processes and are to deal
with, but are not limited to, the following issues—
(a) determination of the level of assurance
required for each transaction and any
subsequent process for approval by the
service agency Minister;
(b) the identity information required for each
level of assurance;
(c) the process for any exceptions to be applied
if an individual's identity cannot be readily
identified;
-- 41 of 53 --
Part 6—Identity verification and electronic identity credentials
Service Victoria Act 2018
No. 14 of 2018
39
Authorised by the Chief Parliamentary Counsel
(d) any terms and conditions applying to the
issue and renewal of an electronic identity
credential.
(3) The Minister must have regard to the guiding
principles set out in section 42 when making the
identity verification standards.
(4) The identity verification standards are a
legislative instrument within the meaning of the
Subordinate Legislation Act 1994.
42 Guiding principles for making and use of identity
verification standards
The following are the guiding principles for
making and using the identity verification
standards—
(a) user choice—individuals may choose
whether to have a temporary electronic
identity credential or an ongoing electronic
identity credential;
(b) minimal data is to be requested and stored—
individuals must not be asked to provide
more information than necessary in order for
Service Victoria to verify the individual's
identity and personal information can only
be stored with the individual's consent,
unless required by law;
(c) risk-based approach to identity
verification—a consistent and evidence-
based approach is to be employed to
determine the level of assurance of identity
required for transactions;
(d) security, transparency and accountability—
Service Victoria, and any external service
providers engaged to provide identity
verification services are to be regularly
audited by an independent entity to ensure
-- 42 of 53 --
Part 6—Identity verification and electronic identity credentials
Service Victoria Act 2018
No. 14 of 2018
40
Authorised by the Chief Parliamentary Counsel
compliance with privacy and data security
requirements;
(e) flexibility—the standards must, to the
extent practicable, be able to adapt to new
technologies or methods of identity
verification;
(f) national consistency—the standards must,
to the extent practicable, align to national
requirements, as set out in any relevant
national framework or guidelines as in force
from time to time.
43 Service Victoria CEO to use identity verification
standards
The Service Victoria CEO must use the identity
verification standards when performing functions
under this Part.
Division 4—Minimum standards for
identity information
44 Service Victoria CEO must comply with minimum
standards
(1) The Service Victoria CEO must comply with the
minimum standards set out in this Division for the
collection, use, disclosure and retention of identity
information and information recorded on
electronic identity credentials.
(2) For the purposes of Division 8 of Part 3 of
the Privacy and Data Protection Act 2014, a
contravention of the minimum standards set out
in this Division involving personal information is
taken to be an interference with the privacy of an
individual.
(3) For the purposes of Division 9 of Part 3 of
the Privacy and Data Protection Act 2014, a
contravention of the minimum standards set out
-- 43 of 53 --
Part 6—Identity verification and electronic identity credentials
Service Victoria Act 2018
No. 14 of 2018
41
Authorised by the Chief Parliamentary Counsel
in this Division involving personal information is
taken to be a contravention of an Information
Privacy Principle of the Privacy and Data
Protection Act 2014.
(4) For the purposes of Part 6 of the Health Records
Act 2001, a contravention of the minimum
standards set out in this Division involving health
information is taken to be an interference with the
privacy of an individual.
(5) For the purposes of section 66 of the Health
Records Act 2001, a contravention of the
minimum standards set out in this Division
involving health information is taken to be a
contravention of that Act.
45 Minimum standard for collection of identity
information
The Service Victoria CEO must not collect
identity information unless—
(a) the collection is necessary to perform any
identity verification functions under this Act
for an individual to whom that information
relates; and
(b) the individual has consented.
46 Minimum standard for use or disclosure
(1) The Service Victoria CEO must not use or
disclose identity information, an electronic
identity credential, information recorded on a
credential or credential usage history unless the
use or disclosure is necessary—
(a) to perform any functions under this Act
for an individual to whom that information
relates and the individual has consented; or
(b) for a person authorised by the Service
Victoria CEO to carry out administrative,
technical or other functions relating to the
-- 44 of 53 --
Part 6—Identity verification and electronic identity credentials
Service Victoria Act 2018
No. 14 of 2018
42
Authorised by the Chief Parliamentary Counsel
management, maintenance or auditing of the
Service Victoria database.
(2) Despite subsection (1), the Service Victoria CEO
may use or disclose identity information, an
electronic identity credential, information
recorded on a credential or credential usage
history if—
(a) the information is personal information and
it is used or disclosed in accordance with
Information Privacy Principle 2.1(d), 2.1(e),
2.1(g) or 2.1(h) of the Privacy and Data
Protection Act 2014; or
(b) the information is health information and it is
used or disclosed in accordance with Health
Privacy Principle 2.2(h), 2.2(i) or 2.2(j) of
the Health Records Act 2001.
47 Minimum standard for retention of information
(1) The Service Victoria CEO must not retain any
identity information for longer than any period
required by law.
(2) The Service Victoria CEO must not retain
a temporary electronic identity credential,
information recorded on that credential or
credential usage history after that credential
expires or is cancelled unless—
(a) a longer period of retention is required by
law; or
(b) in the case of a temporary electronic identity
credential, an ongoing electronic identity
credential is issued under section 27(6) in
respect of that credential.
(3) The Service Victoria CEO must not retain an
ongoing electronic identity credential, information
recorded on that credential or credential usage
history for longer than any period required by law.
-- 45 of 53 --
Part 7—Offences
Service Victoria Act 2018
No. 14 of 2018
43
Authorised by the Chief Parliamentary Counsel
Part 7—Offences
48 Improper issue of electronic identity credentials
A person must not knowingly issue an electronic
identity credential to an individual to whom the
credential does not relate.
Penalty: 240 penalty units or 2 years
imprisonment or both.
49 False or misleading statement in applications
An individual who applies for an electronic
identity credential, an increase in the level of
assurance of an ongoing electronic identity
credential or the renewal of an ongoing electronic
identity credential must not—
(a) include in the application a statement or
information that the individual knows to be
false or misleading in a material particular;
or
(b) provide with that application any document
that the individual knows to be false or
misleading in a material particular.
Penalty: 240 penalty units or 2 years
imprisonment or both.
50 Unauthorised access to, use of or disclosure of data
or information
(1) A person must not, without reasonable excuse,
access, use or disclose any data or information
obtained by the person under this Act other than—
(a) in accordance with this Act; or
(b) in connection with the performance of
functions under this Act.
Penalty: 240 penalty units or 2 years
imprisonment or both.
-- 46 of 53 --
Part 7—Offences
Service Victoria Act 2018
No. 14 of 2018
44
Authorised by the Chief Parliamentary Counsel
(2) Without limiting what may be a reasonable
excuse, it is a reasonable excuse if the access, use
or disclosure was made—
(a) in good faith for the purposes of this Act; or
(b) with the consent of the person to whom the
information relates; or
(c) to a court or tribunal in the course of legal
proceedings; or
(d) pursuant to an order of a court or tribunal; or
(e) to the extent reasonably required to enable
the investigation or the enforcement of a law
of this State or of any other State or of a
Territory or of the Commonwealth; or
(f) to an Australian legal practitioner for the
purpose of obtaining legal advice or
representation; or
(g) as required or authorised by or under this Act
or any other Act.
51 Restrictions on access, use or disclosure of data or
information
A person must not access, use or disclose any data
or information obtained by the person under this
Act if the person knows or is reckless as to
whether the data or information may be used
(whether by the person or any other person) to—
(a) endanger the life or physical safety of any
person; or
(b) commit, or assist in the commission of, an
indictable offence; or
(c) impede or interfere with the administration
of justice.
Penalty: 600 penalty units or 5 years
imprisonment or both.
-- 47 of 53 --
Part 8—General
Service Victoria Act 2018
No. 14 of 2018
45
Authorised by the Chief Parliamentary Counsel
Part 8—General
52 Delegation
The Service Victoria CEO, by instrument, may
delegate any function or power conferred or duty
imposed on the Service Victoria CEO under this
Act, the regulations or any other enactment to—
(a) a prescribed person; or
(b) a prescribed class of person.
Note
A power to delegate does not include the power to delegate
that power of delegation unless the contrary intention appears
(see section 42A(1) of the Interpretation of Legislation
Act 1984).
53 Reporting requirements
(1) The Service Victoria CEO must provide a report
to the Information Commissioner on the operation
of Service Victoria in relation to personal
information (other than health information) at
intervals of no longer than 12 months.
(2) The Service Victoria CEO must provide a report
to the Health Complaints Commissioner on the
operation of Service Victoria in relation to health
information at intervals of no longer than
12 months.
(3) A report under subsection (1) or (2) must include,
but is not limited to, the following matters—
(a) the number of applications made under
section 26 during the period to which the
report relates;
(b) the number of electronic identity credentials
issued during that period;
(c) the number of applications for the issue of
electronic identity credentials refused during
that period;
-- 48 of 53 --
Part 8—General
Service Victoria Act 2018
No. 14 of 2018
46
Authorised by the Chief Parliamentary Counsel
(d) the number of electronic identity credentials
suspended and cancelled during that period;
(e) details of the transferred identity verification
functions for which electronic identity
credentials were used during that period;
(f) details of any requests for access to
information regarding the use of electronic
identity credentials, including whether such
requests were granted, during that period;
(g) an assessment by the Service Victoria CEO
of the operational issues that have arisen
during that period.
54 Handling of regulated information under other Acts
(1) This section does not affect the handling of
regulated information that would otherwise be
permitted by or under the Privacy and Data
Protection Act 2014, the Health Records
Act 2001 or any other Act.
(2) Except as expressly provided by this Act, this Act
does not affect obligations under the Privacy and
Data Protection Act 2014 or the Health Records
Act 2001 in relation to the handling of regulated
information.
(3) If the Service Victoria CEO becomes aware
that this Act, the Privacy and Data Protection
Act 2014 or the Health Records Act 2001 has
been, or is likely to have been, breached in
relation to regulated information handled under
this Act while in the control of the Service
Victoria CEO, the Service Victoria CEO must,
as soon as practicable after becoming aware of
the possible breach, inform—
(a) in the case of a breach of this Act or the
Privacy and Data Protection Act 2014, the
Information Commissioner; and
-- 49 of 53 --
Part 8—General
Service Victoria Act 2018
No. 14 of 2018
47
Authorised by the Chief Parliamentary Counsel
(b) in the case of a breach of the Health
Records Act 2001, the Health Complaints
Commissioner.
55 Disclosure and use of regulated information to
which a secrecy provision applies
(1) If a secrecy provision applies to regulated
information disclosed to the Service Victoria CEO
by a service agency, the disclosure of that
information to the Service Victoria CEO does not
contravene the secrecy provision if the disclosure
is in accordance with, and for the purposes of,
this Act.
(2) If a secrecy provision applies to regulated
information collected by the Service Victoria
CEO under this Act, the collection, holding,
management or use of that information by the
Service Victoria CEO does not contravene the
secrecy provision if the collection, holding,
management or use is in accordance with, and
for the purposes of, this Act.
(3) In this section—
secrecy provision means a prescribed provision
of an Act that restricts the use or disclosure
of specified information, whether that
restriction is absolute or subject to
qualifications or exceptions.
56 Audit
(1) The Minister, in writing, may require the
Service Victoria CEO to conduct an audit of the
compliance with this Act of any computerised
database maintained by Service Victoria for the
purposes of this Part.
(2) An audit required under subsection (1) must be
undertaken by an independent auditor.
-- 50 of 53 --
Part 8—General
Service Victoria Act 2018
No. 14 of 2018
48
Authorised by the Chief Parliamentary Counsel
(3) The Service Victoria CEO must submit a copy of
the auditor's report on the outcome of an audit
required under subsection (1) to the Minister
within 10 days after receiving that report.
57 Review of operation of Act
(1) The Minister must cause an independent review
of the operation of this Act to be undertaken as
soon as possible after the third anniversary of the
commencement of this Act.
(2) The person who undertakes the review must give
the Minister a written report of the review.
(3) The Minister must cause a copy of the report
of the review to be laid before each House of
the Parliament within 12 months after the third
anniversary of the commencement of this Act.
(4) In this section—
independent review means a review undertaken
by persons who, in the opinion of the
Minister, possess appropriate qualifications
to undertake the review.
58 Regulations
(1) The Governor in Council may make regulations
for or with respect to any matter required or
permitted by this Act to be prescribed or necessary
or convenient to be prescribed to give effect to
this Act.
(2) Regulations made under this section may—
(a) be of general or limited application;
(b) differ according to differences in time, place
or circumstances;
(c) confer a discretionary power or authority or
impose a duty on a specified person or body
or a class of person or body;
-- 51 of 53 --
Part 8—General
Service Victoria Act 2018
No. 14 of 2018
49
Authorised by the Chief Parliamentary Counsel
(d) exempt specified persons or things or classes
of person or classes of thing from complying
with all or any of the regulations—
(i) whether unconditionally or on specified
conditions; and
(ii) either wholly or to such an extent as is
specified;
(e) apply, adopt or incorporate any matter
contained in any document whether—
(i) wholly or partially or as amended by
the regulations; or
(ii) as in force at a particular time; or
(iii) as in force from time to time.
(3) Without limiting the requirements of section 5
or 10, the Minister must not recommend to the
Governor in Council the making of a regulation—
(a) for the purposes of section 5 prescribing
as a transferred customer service function
a customer service function of a service
agency which is a Council; or
(b) for the purposes of section 10 prescribing
as a transferred identity verification function
an identity verification function of a service
agency which is a Council—
unless the Minister has obtained the prior
agreement to that transfer of the relevant Council
or Councils whose functions are to be transferred.
═══════════════
-- 52 of 53 --
Endnotes
Service Victoria Act 2018
No. 14 of 2018
50
Authorised by the Chief Parliamentary Counsel
Endnotes
1 General information
See www.legislation.vic.gov.au for Victorian Bills, Acts and current
authorised versions of legislation and up-to-date legislative information.
† Minister's second reading speech—
Legislative Assembly: 1 November 2017
Legislative Council: 21 November 2017
The long title for the Bill for this Act was "A Bill for an Act to provide
for the delivery of Government services to the public by Service Victoria
and for other purposes."
-- 53 of 53 --