Andrew Bartlett (Queensland, Australian Democrats) Share this | Hansard source

The Democrats have significant concerns with the Privacy Legislation Amendment (Emergencies and Disasters) Bill 2006. On the face of it, the justification given sounds perfectly reasonable—modifying privacy laws to ensure that they do not impede our ability to respond to major emergencies and disasters. Nobody could be concerned about that, but the big question is whether this bill does that and whether it does it to the minimum extent necessary or whether it is in fact being used as a Trojan Horse for dramatic weakening of the Privacy Act.

The Boxing Day tsunami and the Bali bombings were unquestionably major disasters—tragedies on a scale which, thankfully, we do not experience often in this county. The pain of those disasters is still with us in the hearts and minds of our population. We have had natural disasters in Australia before—Cyclone Tracy, the Ash Wednesday bushfires and a number of others—but the Bali bombings and the tsunami disaster not only were significant in scale but took place overseas, in some ways making them even more traumatic, making our ability to respond more difficult for reasons of distance. The need to operate in different jurisdictions, working with other governments and agencies of other nationalities added unique difficulties. We can all appreciate the anguish of families and friends seeking information on the whereabouts and news of their loved ones. And we can appreciate the difficulties of organisations attempting to help those caught up in the disasters, as they had to contend with both the sheer number of people involved and the mounting of assistance operations across international borders in circumstances of significant chaos.

We would all like to assist where we can in these times of emergency and appreciate the need for individuals and aid agencies to access necessary information. In these traumatic situations, Australians expect information to be accessible in order to assist in the disasters. They expect no less information than necessary but also no more than needed would be made available.

The Democrats believe that with small changes to our current privacy laws we can achieve what is necessary. We should remember that the current law already permits personal information to be used and disclosed in particular circumstances where individuals’ lives and health are at risk and in circumstances of national emergency. We support any minor modifications to our existing legal regime that would help facilitate the location of and assistance to Australians in these situations without undermining the central protections of our privacy laws.

The key question is: does the bill before us achieve this? The government will tell the Australian people that it does. If the problem as recently experienced by some aid organisations following the Bali bombings was to gain ready access to information about individuals to the extent necessary to assist them, then this bill does not achieve that. This bill allows the Prime Minister or Attorney-General, with the stroke of a pen, to dispense with all our privacy protections not only for tsunami or bomb situations but for any reason he or she may consider to be of ‘national importance’.

The government response in the form of this bill, in the view of the Democrats, goes well and truly over the top. It risks washing away significant parts of the privacy protections, which, it should be remembered, have taken a long time and a lot of effort and urging to put in place. It washes away those protections far beyond what the Democrats believe is necessary. Rather than start with the privacy structures already in place and take away only what is necessary to achieve the very precise and limited purpose, the government, in typical fashion, have thrown away all the privacy protections and merely added back some minimal and inadequate protections, putting all the power for doing so in their own hands.

The Democrats have a long history of fighting for the rights of individuals to privacy back to the days of former senator the late Janine Haines in the 1980s. This is a fundamental human right. I note that some members of the current coalition contest how valid the right to privacy is. It is certainly something the Democrats still believe is a basic and valid right which we should protect.

The Privacy Act itself highlights—indeed, it starts by reminding us—that Australia is a party to the International Covenant on Civil and Political Rights. This underlines the importance that the right to privacy holds in a democratic society like ours, one that seeks to uphold civil and political rights. We should not limit or remove those rights except in particularly dire circumstances and then only the minimum amount considered necessary to deal with the situation. I do not believe that Australians want to be exposed to ongoing potential breaches of their privacy for extended periods of time in a circumstance determined only by the Prime Minister or the Attorney-General of the day, and that is what this bill does. It is a blanket approach to curtailing the fundamental rights in relation to privacy, beyond what is necessary, which tips the balance in favour of government against the individual.

None of this should in any way be used to suggest that the Democrats do not recognise that there have been some difficulties experienced by aid agencies in getting access to information in times of disaster, but I draw attention to the evidence given by the Australian Privacy Foundation to the Senate Standing Committee on Legal and Constitutional Affairs examining this legislation. They said:

... examples given of the Privacy Act preventing sensible use of personal information are due either to a wilful or inadvertent misunderstanding of the Act, which would be best addressed through better short-term communications and long-term education rather than wholesale changes to the privacy protection framework in the Act.

In other words, in many cases the examples that people have given where they are saying that the existing act prevents sensible use of personal information are due to the fact that they do not understand the provisions of, and existing exemptions within, the act as it currently is.

There are already far less drastic means by which we can address the situation. For example, it is currently possible for the Privacy Commissioner—who is an independent officer, not a politician—to make a public interest determination where, after considering all competing issues, the commissioner considers whether the public interest in doing the act or engaging in the process ‘outweighs to a substantial degree’ the public interest in adhering to the Information Privacy Principles. Why can’t such a process, with a definitional guide that acknowledges what protection is being given up in a specific circumstance, be modified for emergency situations? There is no such guide at present in the emergency regime that the government is seeking to put in place.

Let us compare further. Currently, the Privacy Commissioner, in making a public interest determination, is required to give reasons, but under the declaration process that the government wants to put in place neither the Prime Minister nor the Attorney-General are required to give any reasons. All they need to say is that in their opinion this is a matter of national importance or national emergency. Let us draw comparisons with what is unfortunately a growing number of examples in other areas in the Attorney-General’s purview or areas like migration. There is, sadly, a growing number of areas where ministers can just make determinations or declarations, say it is in the public interest or the national interest and not need to give any reasons at all—just simply say: ‘It is because I say so.’ I do not believe, and the Democrats certainly do not believe, that that is adequate protection. The current regime also requires the commissioner to specify a time period for which a public interest declaration is to be in force. Limiting the time is something that the Prime Minister or the Attorney-General is not so adequately obliged to do by the declaration process contained in the legislation before us.

To give another example: another process for addressing emergencies that we currently have in place would begin by leaving the privacy regime and existing protections in place but suspending the effect of sanctions for breaching the privacy provisions—effectively, providing for exceptions in cases of national emergency. This already exists under section 23YUF of the Crimes Act, where the minister has the discretion to determine any situation to be an incident appropriate for the usual sanctions to be suspended. The Bali bombings are a specific example of one such incident. Why is it not possible to utilise these existing sections, which already—and quite reasonably, I might say—allow for part of our laws to be overridden where there is a genuine emergency?

Certainly, some aid organisations which gave evidence to the so-called ‘Big Brother’ inquiry expressed frustration that, following the Bali bombing and tsunami incidents, some organisations were still reluctant to disclose details of names, dates, actions and personal details of individuals, and this occasionally added to the difficulties in tracking down and assisting victims and their families. It should be emphasised that there were a lot of much larger difficulties that also impeded that important task. It must be emphasised that these incidents were of an enormous magnitude and a relatively uncommon type. The appropriate and proportional response is to allow limited circumstances for departure from our privacy regime for such uncommon and limited situations.

I do not believe that the departures contained in this legislation are very limited at all. I think they are quite disproportionate. The government’s bill will insert a whole new part into the Privacy Act, a whole new regime that can be implemented in place of our current regime at the stroke of a pen. The bill before us will allow emergencies to be declared in any type of situation that the Prime Minister or Attorney-General considers to be of national significance. The lack of definition or constraints around that do cause concern. It is worth noting that the government has explicitly included the words ‘assisting with law enforcement’ as a single legitimate permitted purpose for the purposes of such a declaration. How convenient it is for the government to be able to dispense with all manner of privacy protection for individuals when enforcing the law following a disruption that the government considers significant.

I believe that Australians should be concerned about the new power this gives to the Prime Minister and the Attorney-General—and to all future prime ministers and attorneys-general. Australians should be concerned about the capacity of government agencies, organisations and individuals to disclose and use their personal information in these as yet unknown circumstances and for potentially very significant amounts of time. Furthermore, if you, as an individual, have had your personal information disclosed by and to other entities, the government, in this legislation, has conveniently overlooked the need to destroy such information once the disaster is over or the information is no longer needed for the specific purpose at hand. It provides an open door to abuse of an individual’s privacy, all for the sake of government convenience.

I can understand the attraction for the government in having it made convenient and easy for them, but that is precisely why we have protections like these in the first place. It is always more convenient for government to not have to worry about these sorts of constraints and requirements for protecting citizens’ rights. That is inevitably the case. Again, I can point to a range of examples, both in Australia and amongst some of our allies overseas, where governments have seen great benefit to themselves in being able to work around or ignore the so-called constraints that ensure that the rights of individuals are protected. There are always those constraints, but they are meant to be constraints. They are there precisely because history shows us time and time again that, if you do not have the constraints, governments will abuse their powers. That is not particularly having a shot at this government; it is a simple inevitability. It is the nature of government, particularly for governments that have been in place for a prolonged period of time, to not respect the individual rights of citizens unless there are constraints in place that require them to do so.

Instead of addressing problems encountered during disasters and emergencies, the government has created a privacy disaster situation. The Democrats’ preferred approach would have been to modify only what is necessary under the existing privacy legislation structure, but we are not in a position to implement our preferred approach here; instead, we will be seeking to move amendments to the legislation in the committee stage of the debate to try to address some of the wrongs against our basic civil rights that arise under this bill.

It is worth emphasising that passing this bill unamended does not mean that the current government will automatically breach those rights. It does not mean that I am alleging that there is some devious, nasty, hidden plan where the government is just waiting for this bill to be passed so that it can leap forward into the breach and immediately start abusing privacy rights. But the legislation does, completely unnecessarily, open a significant loophole that will allow any government—future governments as well—to avoid complying with basic privacy rights if they happen to believe at the time that it is convenient or necessary. And what might seem necessary to a government is often very different from what might seem necessary to the wider community.

A balanced solution is possible—one that addresses the concerns of aid agencies and victims in times of emergency while protecting the Australian population from the overzealous dismantling of our privacy laws merely for government convenience. Again, I remind the community that it took a long time to put these privacy laws in place and it has taken a lot of effort to get them strengthened to the point they are at now. Of course, there are still inadequacies with those laws. Not least is the fact that political parties are not required to comply with the privacy laws. That is a perfect example of how political parties have chosen to exempt themselves from inconvenience. We in the Democrats try to ensure that we operate in a way that complies with the privacy laws even though we are exempt from them, because we believe that, in principle, political parties should be required to comply with them. It is an inconvenience—there is no doubt about that—but I think the Australian community would judge that it is an important or necessary inconvenience as a way of ensuring that people’s privacy rights are protected, or at least maximising the prospect of that.

If the government has been criticised for its slow response to emergencies in the past, I do not think that it can seriously blame the Privacy Act for that. A much better place to look is in its own internal procedures for responding promptly. It should have done that before invoking such a radical and unnecessary regime to deal with emergencies. We also need to recognise that in emergencies such as those I have been describing it is very easy to just point to the Privacy Act or some other piece of regulation and say, ‘That’s the problem there; it’s not our fault; it’s something else.’ We need to recognise that these circumstances, precisely because they are disasters, are inevitably chaotic. While that should not be used as an excuse for a slow response, we also need to recognise and accept across the political spectrum that we do not immediately leap in and start criticising agencies, whether government or otherwise, for failing to respond instantly. Sometimes that is just not possible; sometimes responding in a slightly more measured but well thought through way will lead to a much better long-term response than immediate and instant action for the sake of making it look as though action is happening.

On balance, this bill tips the balance too far against the individual in favour of restoring some of the ‘Big Brother’ power to government. I do not believe it is necessary in the circumstances. The Democrats will seek to remedy the situation, at least somewhat, via amendments in the committee stage.