Victoria has threatened to pull out of a state and federal government agreement for the home affairs department to run a facial recognition system because the bill expands Peter Dutton’s powers and allows access to information by the private sector and local governments.

In October the Council of Australia Governments agreed to give federal and state police real-time access to passport, visa, citizenship and driver’s licence images for a wide range of criminal investigations.

The identity matching services bill, introduced in February, enables the home affairs department to collect, use and disclose identification information including facial biometric matching.

Sign up to receive the top stories in Australia every day at noon

In a submission to the parliamentary joint committee on intelligence and security, the Victorian special minister of state, Gavin Jennings, warned that the bill provided “significant scope” for the home affairs minister to expand his powers beyond what was agreed.

This includes the ability to collect new types of identification information and expand identity matching services. For example the bill would allow the commonwealth to collect not just driver’s licence information but also proof-of-age cards, and firearms and marine licences – some of which can be held by children as young as 12.

The commonwealth could collect information that Victoria was not authorised to disclose under its own legislation, the submission warned.

It said citizens may not be adequately informed that information they provide to get a driver’s licence, including biometric data, could be “reused for other law enforcement purposes”.

In its submission the home affairs department said the bill would “enable rather than authorise the use of the services by various government agencies” and the systems would still be governed by federal, state and territory privacy laws.

The Victorian submission said the states had agreed that the private sector would not be given access to the facial verification and identity data-sharing services.

But the bill did not “contain such a restriction, allowing non-government entities to use all identity-matching services” if they met certain conditions, it said.

As the home affairs department explained in its submission, those conditions included that private-sector entities would only have access to verification services, not to identify unknown individuals, and would require the consent of the person whose identity was being checked.

It defended private-sector access to the information, arguing that it would allow financial institutions and telcos “to contribute to national security and law enforcement outcomes”.

The Victorian government submission also complained that providing identity-matching services to local government authorities “goes beyond what was agreed to”. VicRoads “may not be authorised” to share information with the national driver’s licence facial recognition system because of this overreach.

Jennings requested that the commonwealth revise the bill to align it with the agreement. He warned that if the scope of the driver’s licence facial recognition scheme was expanded as proposed in the bill Victoria “would need to consider whether it wishes to participate … and if so, the legal basis on which it would rely”.

Victoria also called for further checks and balances to limit the home affairs department’s use and disclosure of information.

The department submitted that the bill would allow it to help prevent identity crime, which affects 5% of Australians and is estimated to cost $2.2bn a year. “Identity crime is also a key enabler of serious and organised crime, including terrorism,” the submission said.

In addition to invoking the most serious offences, the home affairs department also acknowledges that the systems would be used for “the provision of more secure and accessible government and private-sector services” and “improving road safety through the detection and prosecution of traffic offences”.

The Queensland office of the information commissioner submitted that the bill did not prevent “blanket surveillance techniques” but the home affairs department responded that “indiscriminate use of the face-matching services would not be feasible in practice”.

Agencies would “continue to be subject to legislative privacy protections and information-sharing restrictions that already apply to them”, it said.

The home affairs department said further protections would be included in face-matching services participation agreements, which would require agencies to undertake compliance audits.

“These arrangements are being established and agreed between the commonwealth and all states and territories,” it said. “They are based on the principle that each state and territory retains control over decisions on how its data is shared.”