Source document: https://docs-lawep.s3.us-east-2.amazonaws.com/1697632357666.pdf (Australia)
Key points • Australia’s largest database of people 18+ is held by Equifax on our consumer credit bureau – approximately 18 million of an estimated 18.9 million adults • Equifax is also accredited to verify Government-issued documents via the Document Verification Service, and gazetted by regulation for access to the Commonwealth electoral roll.
• While Government-issued documents can be used where reasonably necessary to verify an individual, both credit reports and the Commonwealth electoral roll can only be used to verify an individual for the purposes of the Anti-Money Laundering and Counter Terrorism Financing Act.

• Existing identity capabilities in Australia would need to be modified to support age verification requirements.
• Rigorous privacy measures would need to be introduced, including controls on the collection and/or retention of any age-verification record and prohibition on subsequent disclosure or reuse.

Age verification Verification capabilities in Australia are focussed on identity verification, typically a single one-off process when a person first seeks the provision of a service, e.g.

opening a bank account, or when a previously unknown person establishes an engagement, e.g.
renting a property or enabling a criminal history check when starting a job.

However, verification of age for pornographic or gambling websites [18+ sites] would be a different dynamic, requiring confirmation of age eligibility every time a site is accessed.

Moreover, unlike identity verification, the critical outcome is not verification of a person’s specific day/month/year of birth, but rather confirmation of their 18+ eligibility to view the site.
Most critically, whereas legislation/regulator rules around identity require a record to be kept, the retention of a list of people accessing 18+ sites would be extremely problematic.

Existing identity capabilities – Australia’s three key verification sources 1.

Government-issued documents via Document Verification Service The Department of Home Affairs’ Document Verification Service (DVS) allows checks of certain Government-issued documents1.
When launched in 2012, 1 Full list of documents here Inquiry into age verification for online wagering and online pornographySubmission 189 the DVS initially only permitted checks where Commonwealth law required identity verification; subsequently this was broadened to allow checks by any business having a reasonably necessary need to verify an individual.
A match on the DVS is not indicative of being 18+; both drivers licence (~75% of the population) and passports (57.4% of citizens) can be held by a person under 18 years of age.

Access to the DVS is via accredited entities, including Equifax.

2.

Commonwealth electoral roll The Commonwealth electoral roll can be used to verify identity for the purpose of meeting the Anti Money Laundering and Counter Terrorism Financing Act [AML-CTF].
Use of the roll for any other identity verification purpose is not permitted.

Access is via entities gazetted under regulations of the Commonwealth Electoral Act 1918, including Equifax since August 20072.

There are 16,486,185 names of people over 18 on the roll.

Matching on the electoral roll is therefore indicative of an eligible person.
3. Credit reporting information Credit reports can be used for identity verification; however, as with the electoral roll, credit reporting information can only be used for identity checks required by the AML-CTF Act, and further, the process must be in the manner prescribed by the Attorney-General’s department.

Equifax holds > 18 million names; only people 18+ can be retained on the consumer credit bureau and therefore matching, as with the electoral roll, is indicative of an eligible person.
Privacy While our submission is to inform the Committee about aspects of Terms of reference 6 (a), strong privacy controls will be critical, and the following are some preliminary high-level points requiring further consideration: 2 Election and Referendum Regulations 1940 27/8/07 https://www.legislation.gov.au/Details/F2007C00619 Inquiry into age verification for online wagering and online pornographySubmission 189 - Minimise, or if possible, eliminate, the retention of any record of age- verification, including a prohibition on disclosure or reuse of any personal information relating to a request for age verification; - 18+ sites should not know who a viewer is, only know that a person viewing or using the site has been verified as 18+; - Similarly, the entity verifying age should not know what site the person wishes to view, only that age verification has been requested; - The age verification process should be conducted using the minimum details - required to achieve a match; In a more mature identity environment, people could choose to obtain a reusable age-verification token for them to provide when needed.
Effectiveness There is a trade-off between the integrity of an identity or age check, the friction of the process and the amount of personal information a person is required to disclose.

The greater the level of detail demanded by a process, the higher the integrity of the result, i.e.
a person’s name and date of birth may be known by other people, but not their driver’s licence number; requiring an out-of-wallet question (mother’s maiden name or last source of credit applied for) achieves greater integrity, but requires more disclosure.
RECOMMENDATION To create a level-playing field in Australia’s capability to conduct identity and age verification, the Privacy Act (Part IIIA) should be amended to allow for use of credit reporting information where an entity has a reasonable business need to verify identity or age.

Similar changes should also be considered for the Commonwealth electoral roll.

Inquiry into age verification for online wagering and online pornographySubmission 189