Privacy Collection Notice - Online ID verification

The Commonwealth Bank of Australia and its subsidiaries (the Group) provide or distribute a wide range of financial and non-financial products and services.

This Privacy Notice describes how your personal information is collected for online ID verification by members of the Group, including:

• the Commonwealth Bank of Australia
• Commonwealth Securities Limited (CommSec)

In this Privacy Collection Notice, 'we', 'us' or 'our' refers to the Group.

We collect the following types of personal information as part of our online ID verification process: 

• Your full name, mobile number, email address, home address, date of birth and employment category;
• Scan(s) of your identity documents (e.g. a driver’s licence, passport, birth certificate or Medicare card);
• Extracts of key information from your identity documents (e.g. issuing state and licence numbers of drivers licence, or issuing state and registration number for birth certificates); and
• If you are an adult, a ‘selfie’ photo (that is converted and held as a biometric template). We will ask for your consent prior to collection of your ‘selfie’.

We generally collect this information from you directly. Please note that providing false or misleading information about your identity is an offence under the Anti-Money Laundering and Counter-Terrorism Act 2006 (Cth).

We collect your information to verify your identity:

• To meet our ‘Know Your Customer’ requirements under Anti-Money Laundering and Counter-Terrorism Act 2006 (Cth), and other anti-money laundering, counter-terrorism funding, regulations or other instruments;
• To more effectively identify, mitigate and manage financial crime and fraud risks through knowing who uses the Group’s products and services; and
• To provide you with the Group’s financial products and services.

Further information on our online ID check process

We will disclose your personal information to credit reporting bodies, Commonwealth and state government departments and other verification partners  (our ‘identity service providers’) who match your information with their records and/or information held by the issuer or official record holder (which include fraud watch lists) by accessing third party systems. 

Our identity service providers will assess and advise the Group whether all or some of the information you provided match their records and/or information held by the issuer or official record holder for that identity document.

We will advise you if the Group is unable to verify your identity electronically what other steps you may be able to take to complete the identification process (e.g. visit a branch).

Below is further information on the types of organisations we may disclose your identity information to: 

(a) Checking your personal details with Credit Reporting Bodies

The Group discloses your name, address and date of birth to selected credit reporting bodies for the purposes of having the credit reporting body assess whether your information matches (in whole or in part) the information the credit reporting body holds on record.

Please be aware, if you apply for credit, the Group will advise you separately if it checks your creditworthiness against information held by any credit reporting body.

(b) Other organisations used to help conduct identity verification

The Group also provides your identity information to:

• Commonwealth and state government departments (including by accessing and using  systems which match your identity information against information held by the document issuer or official record holder using third party systems).
• If you would like further information about the operation and management of these systems, you can visit the IDMatch website at https://www.idmatch.gov.au/.
• Verification partners (such as GBG, Equifax and Daon) who coordinate the electronic identification process for the Group, including by accessing and using (on our behalf) systems which match your identity information against information held by the document issuer or official record holder  or by performing additional matches against other public and proprietary databases.
  
  The verification partners may record, use and disclose your information in accordance with their own privacy policies and legal obligations. Some of these verification partners operate outside of Australia. As a result, we may send your identity information overseas. 

(c) Biometric checks

The Group also conducts biometric checks based on a photograph of your face (a ‘selfie’). The Group will separately ask for your consent to collect your ‘selfie’.

Your photograph will be shared with our identity service providers for the purpose of performing the relevant identity check.

Your photograph will be retained and used to ensure no other new customers seek to use your likeness or photograph to impersonate you as part of a ‘fraud watchlist.’     

If you choose not to consent to your information being checked with the document issuer or official record holder via third party systems, then we may not be able to verify your identity and provide you with our services.

For some of the Group’s products & services, if you prefer not to proceed with electronic ID verification, you can choose to visit a branch  to complete the identification process in-person. This may still involve your information being checked with the document issuer or official record holder via third party systems.

Our Group Privacy Statement is available on our website at commbank.com.au or upon request from any branch of the Commonwealth Bank, and should be read in conjunction with the above. It contains further details about our information collection and handling practices including information about:

• other ways we may collect, use or exchange your information;
• how you may exercise your rights to access and seek correction of your information; 
• how to make a complaint about a breach of your privacy rights or about the way we handle your identity information; and
• our complaint handling procedures.