Thank you for the opportunity to make a submission to the Senate Legal and Constitutional Legislation Committee’s Inquiry into the Australian Citizenship Bill 2005 (the Bill).

The Office of the Privacy Commissioner (the Office) is an independent statutory body responsible for promoting an Australian culture that respects privacy. The Privacy Commissioner has responsibilities under the Privacy Act 1988 (the Privacy Act) and other federal legislation to regulate the way Commonwealth and ACT Government agencies and many private sector organisations collect, use, store and disclose individuals’ personal information.

Given the functions of this Office, this submission focuses on the aspects of the Citizenship Bill that deal with ‘personal identifiers’, specifically Clause 10 and Part 2, Division 5.

Our Office was provided with the opportunity to comment on draft versions of the Bill prior to its introduction to the House of Representatives and appreciates this degree of engagement in the process. I acknowledge that our comments and recommendations made at this stage in the process have, to some extent, been incorporated into the Bill as tabled. Whilst it is possible that some of our outstanding issues may be addressed in the regulations, I believe that it is appropriate to raise these matters in the context of this submission. Specifically, these issues relate to the implications of the proposed changes on the maintenance of proportionality in respect of the collection and retention of identifying information.

Proportionality - collection

In outlining a broad range of possible identifiers that may be collected for the purpose of confirming an individual’s identity, there is a risk that the legislation may encourage identity verification processes (and the subsequent collection of personal information, including biometric information) that are disproportionate to any identified risk. I understand that, in accordance with section 41, the requirements for individuals to provide personal identifiers will be specified in the regulations. In discussions with the Department of Immigration and Multicultural and Indigenous Affairs (DIMIA) regarding the draft Bill, DIMIA has committed to consider the principle of proportionality when drafting regulations concerning personal identifiers in order to ensure that their collection, use and retention is balanced with the potential impact on the privacy of the individual.

DIMIA has advised that it will consult with the Office on the development of the regulations in addition to the consultative arrangements that are in place with the Attorney General’s department. This Office would welcome the opportunity to engage in this process.

Proportionality – data retention

It is the understanding of this Office that the primary purpose for the collection of personal identifiers (including biometric information) in accordance with section 40(1) of the Bill, is to confirm the identity of persons seeking Australian citizenship or proof of citizenship. I note, however, that section 42(4) allows for personal identifiers to be accessed for other purposes, such as ‘combating document and identity fraud in citizenship matters’ and ‘complementing anti‑people smuggling measures’. It would appear that these uses anticipate the ongoing retention of personal identifiers collected for identity verification purposes.

This Office appreciates that biometrics can be a useful identity verification tool. However, it is unclear that introducing biometric technology into citizenship processes would necessarily require the retention of any further identifying information other than that which is currently retained where an individual applies for or is granted citizenship or proof of citizenship under the Citizenship Act. For example, a citizenship applicant could be biometrically matched to an identifier held in the individual’s visa documentation to confirm their identity before the granting of citizenship. However, it is not clear that this would necessitate the ongoing retention of the biometric identifier with the individual’s citizenship record.

The retention of personal identifiers and particularly biometric identifiers in databases allowing for future access, use and disclosure poses privacy risks, despite the limitations on these secondary functions specified in the bill. Any additional retention of personal information (particularly biometric information) other than that which is currently the case should be proportional to the problem the agency seeks to address by retaining the information.

This Office suggests that any additional retention of personal identifiers and particularly biometric identifiers is undertaken with caution and in consideration of the principle of proportionality. The Committee may wish to consider how the possibility of any potential disproportionate retention might be addressed in the Bill or in the attendant regulations.

Types of personal identifier

Information Privacy Principle (IPP 1) in the Privacy Act provides that personal information should only be collected by an agency where the collection is necessary for or directly related to a purpose that is directly related to a function or activity of that agency.

Section 10(2) of the Bill also discusses limitations on the collection of personal information specifying the types of identifier that can be prescribed in the regulations and which may subsequently be collected for purposes under the Act. I note however, that the limiting factor under section 10(2)(c) is that the Minister must be satisfied that ‘obtaining the identifier will promote one or more of the following purposes…’ (emphasis added).

To ensure that the operation of the Citizenship Act remains consistent with the privacy standards in the Privacy Act, I would suggest that the terminology used in this provision is aligned to that used in IPP 1 of the Privacy Act. Specifically, I suggest that the Committee consider whether the phrase ‘will promote’ might be amended to ‘is necessary for’ or ‘is reasonably necessary for’.

Yours Sincerely

Timothy Pilgrim

Deputy Privacy Commissioner

16 January 2005