Laurie Ferguson (Reid, Australian Labor Party, Parliamentary Secretary for Multicultural Affairs and Settlement Services) Share this | Link to this | Hansard source

I move:

That this bill be now read a second time.

The Migration Amendment (Protection of Identifying Information) Bill 2009 (the ‘bill’) amends the Migration Act 1958 (the ‘act’) to ensure that identifying information obtained by the department is protected and governed by part 4A of the act, which regulates the use, access and disclosure of ‘identifying information’. The bill also provides that the personal identifiers and personal information disclosed under certain provisions must only be disclosed by an officer to the extent necessary in order to obtain help from an individual to identify, authenticate the identity of, or locate the subject in connection with the administration of the act.

The act currently provides for a strict regime for the collection, use, access and disclosure of ‘personal identifiers’ collected under the act. This regime was inserted into the act by the Migration Legislation Amendment (Identification and Authentication) Act 2004. Part 4A provides for the obligations relating to identifying information and contains criminal penalties of imprisonment for two years or 120 penalty units, or both, for the unauthorised disclosure modification, impairment or failure to destroy identifying information as soon as practicable when required by the Archives Act 1983.

Section 336A of part 4A, as inserted by the 2004 amendments, provided that the definition for ‘identifying information’ included ‘any personal identifier’ and information and measurements derived from personal identifiers. A ‘personal identifier’ is defined in section 5A of the act to include fingerprints or handprints, measurements of a person’s height and weight, a photograph or other image of a person’s face and shoulders, an audio or video recording of a person’s face, an iris scan, a person’s signature or certain other identifiers prescribed by the regulations.

The Migration Legislation Amendment (Information and Other Measures) Act 2007, however, made an amendment to the definition of ‘identifying information’ in paragraph 336A(a) to provide that it is ‘any personal identifier provided under section 40, 46, 166, 170, 175, 188, 192 or 261AA of the act.’ The purpose of this amendment was to put beyond doubt that the offence provisions in part 4A only applied where the identifying information in question was a personal identifier provided under the specific sections above.

However, since the amendments to the definition in 2007, it has come to the department’s attention that this provision is more limited than the original policy intention intended. Recent legal advice suggests that personal identifiers belonging to our clients that are not currently protected by part 4A include those collected from other agencies (domestic or international), unsolicited external sources and from law enforcement agencies (often shared with the department as part of an investigation). In relation to these personal identifiers, DIAC has been adhering to part 4A of the Migration Act and the Privacy Act, where applicable, so there is no question of either act being breached.

Into the years ahead, Australia is going to be working in close concert with our international partners to pursue projects which may better facilitate travel for the legitimate traveller at the same time as assisting to uncover identity fraud or crime. In particular, identifying information such as biometrics will become an increasingly important tool in the fight against identity crime.

However, it is equally vital that identifying information—including biometrics—is shared strictly in accordance with the Privacy Act 1988 and the disclosure provisions of the Migration Act 1958.

In order to ensure that the rights and privacy of persons, whose personal identifiers are provided by international and external sources, are protected under the act, and to assure our international partners that the data they provide will be given this protection, it makes sense to subject all personal identifiers collected by DIAC for immigration purposes to the same statutory regime, that being part 4A of the act

This bill will align the definition of ‘identifying information’ in the act with the original policy intention in 2004 that all personal identifiers obtained by the department are protected and governed by part 4A of the act. As there are criminal penalties associated with the unauthorised disclosure, modification, impairment or failure to destroy identifying information when required, amendment of the definition by the parliament is required as soon as possible.

In addition to the measures outlined, the bill also introduces a limit for the disclosure of personal information under sections 336FA and 336FB of the act. These sections authorise disclosure of certain personal identifiers for the purpose of obtaining an individual’s help to identify, authenticate the identity of, or locate, a subject. The limit will provide that, for a disclosure of information to be authorised for these purposes, the information must only be disclosed to the extent necessary in order to obtain an individual’s help.

The department ensures that identifying information is treated appropriately and in accordance with the act and the Privacy Act 1988. In particular, the department makes every effort to ensure any disclosures of identifying information outside of the department are done consistently with Information Privacy Principle 11(3). That is, bodies that receive this information are advised that they must not use or disclose of the information for a purpose other than the purpose for which the information was given to them.

The amendments in this bill will further support and enhance the department’s appropriate handling of identifying information concerning our clients, including their personal identifiers.

I commend the bill to the chamber.

Debate (on motion by Mr Haase) adjourned.