pdf (94.46 KB)

Table of Contents

Introduction.

Privacy and the electoral roll

Secondary purposes permitted by the Commonwealth Electoral Act 1918 and the Electoral and the Referendum Regulations 1940 and relevant privacy issues.

Effectiveness of legislative controls on use of electoral roll for secondary purposes.

Changes to legislative controls.

Disclosure of information for political purposes and the Commonwealth Electoral Amendment Act (No. 1) 2000

Public register privacy principles.

Introduction

An important part of Australia's democratic process is the requirement to register to vote. With few exceptions, it is compulsory for citizens to enrol to vote once they have reached 18 years of age. Enrolment involves providing personal information to the Australian Electoral Commission (the Commission) for inclusion in the electoral roll, which is available for public inspection. One purpose of the electoral roll is to protect the integrity of the electoral process by preventing fraudulent enrolment. The focus of this inquiry by the Joint Committee on Electoral Matters (the Committee) is the effectiveness of the Commonwealth Electoral Act 1918 (the Electoral Act) in achieving this.

Of equal importance is the effectiveness of the Electoral Act in restricting the use and disclosure of the electoral roll for secondary purposes, or purposes other than the purpose for collecting information. Because it is compulsory to provide personal information for inclusion on the electoral roll, citizens have a strong expectation that this information will only be used for the purpose for which it was collected. Recent public debate in this area has reinforced the view that the community expects that the privacy of personal information collected by government agencies will be protected.

The focus of this submission will be on the need for legislative reform with respect to use and disclosure of the electoral roll, within the context of the third element of the inquiry’s terms of reference. Legislative and technological developments have eroded the effectiveness of the existing legislative framework in safeguarding the privacy of individuals on the electoral roll. Developments in information technology have enhanced the ease with which data may be copied, modified, cross-matched and disseminated and curtailed the effectiveness of the current provisions in the Electoral Act aimed at preventing unauthorised secondary use. The conversion of the electoral roll to electronic form has also given rise to the potential for new uses of electoral information that have limited connection with the primary purpose of the roll.

This submission will examine how these developments have contributed to:

• increasing the potential for using the electoral roll for possibly inappropriate purposes, particularly commercial purposes; and
• diminishing the openness and accountability in relation to the use and disclosure of electoral information, particularly by third parties.

Privacy and the electoral roll

The Commonwealth Electoral Act 1918 (the Electoral Act) and the Privacy Act 1988 (the Privacy Act) provide the legislative privacy framework governing the electoral roll. If passed, the Privacy Amendment (Private Sector) Bill 2000 (the Privacy Bill), currently before the Parliament, will also be relevant.

One of the fundamental principles of information privacy is that personal information that is provided by an individual for one purpose should not be used or disclosed for another unrelated purpose unless the individual has consented or there are sound public interest reasons for doing so. The Information Privacy Principles (the IPPs), contained in section 14 of the Privacy Act, have the effect of requiring Commonwealth agencies to use and disclose electoral information only for the purpose for which it was collected, unless the identified exceptions apply. The IPPs recognise the right of individuals to know when and why information concerning them is used, and to whom it is disclosed. The IPPs also give individuals the right to have access to, and to correct, records held by an agency that contain personal information concerning them.

Public registers such as the electoral roll pose particular privacy issues because the collection and publication of personal information is compulsory. The collection of personal information is compulsory in two senses. Firstly, it is compulsory for all Australian citizens to enrol to vote. Secondly, in order to enrol an individual must provide a range of detailed personal information, including full name, residential address, phone number, postal address, former surname, data of birth, country of birth, citizenship and former enrolled address.

The Electoral Act requires the Commission to publish the names and addresses of all electors on the electoral roll and to make this information available for public inspection. Public inspection of the roll enables individuals to check the accuracy of their own enrolment details, to check the correctness of the enrolment of other electors, and in doing so, to prevent electoral fraud. Availability for inspection in this way is directly related to the primary purpose of maintaining the electoral roll.

In requiring publication of the electoral roll, Parliament has also sought to balance the public interest in protecting the integrity of the electoral process against an individual’s right to privacy. There are legislative measures in place that seek to minimise the adverse impact on the privacy of individuals of making personal information available for public inspection. However, there is increasing evidence to suggest that the existing privacy regime, constituted by the Privacy and Electoral Acts, is no longer effective in preventing inappropriate use of the electoral roll.

The Committee itself has noted the level of concern in the community about unauthorised use and disclosure of the roll in its 1997 report on the conduct of the 1996 Federal Election. The Committee recommended that “sections 89 to 92 of the Electoral Act, concerning improper use of roll information, be reviewed to take account of developments in computer technology.” The Government supported the recommendation and the Commission has commenced an inquiry that is yet to be completed.

Recommendation 1

That the Electoral Commission’s inquiry into sections 89 to 92 of the Electoral Act be given the highest priority and that the findings of the review be taken into account in strengthening privacy protections governing the electoral roll.

Secondary purposes permitted by the Commonwealth Electoral Act 1918 and the Electoral and the Referendum Regulations 1940 and relevant privacy issues

In effect, the Privacy Act generally prohibits the use of personal information for secondary purposes. However, there are exceptions to this rule. The Privacy Act permits the use and disclosure of personal information for secondary purposes that have been authorised by law. Ideally, secondary purposes will only be authorised by law when there are clear public interest grounds for doing so and following community consultation. Furthermore, there needs to be effective legislative measures in place to ensure that information will only be used for those secondary purposes.

The use and disclosure of the electoral roll for secondary purposes is authorised by the Electoral Act and the Electoral and the Referendum Regulations 1940 (the Regulations). The Commission is authorised by the Electoral Act to provide copies of the roll in hard copy print or in electronic form (ie. “on tape or disk”) to:

• registered political parties, members of the House of Representatives, and Senators: s 91(2), (3), (4), (4A);
• any person or organisation that the Commission considers appropriate: s 91(2), (4);
• to any person or organisation that conducts medical research or health screening program: s 91(9A)(a);
• printed and microfiche copies of the roll may be provided to government agencies that have been prescribed in the Regulations: s 91(10).

Over the past ten to fifteen years, successive Parliaments have expanded the secondary purposes for which the roll can be used under the Electoral Act. In July this year, the Regulations were further amended by the Electoral and Referendum Amendment Regulations 2000 to allow additional government agencies to obtain electoral information for a broader range of “permitted purposes”.[1]

During October, Parliament amended the Electoral Act by passing the Commonwealth Electoral Legislation (Provision of Information) Act 2000 (POI Act). The POI Act operates retrospectively to validate the past provision of information electronically that was previously unlawful under the Electoral Act. The Commission had received legal advice in June that indicated that the provision of electronic versions of the electoral roll to Government agencies had not always been authorised by the Electoral Act. The Commission had been providing the electoral roll electronically to agencies on the assumption that the Electoral Act did not expressly prohibit such a practice.

Effectiveness of legislative controls on use of electoral roll for secondary purposes

At present, Section 91A of the Electoral Act restricts the use of the electoral roll provided in electronic form to “permitted purposes”, which are secondary purposes authorised in the Regulations. Section 91B of the Electoral Act also prohibits the use and disclosure of the electronic versions of the roll for commercial purposes. In contrast, there are no end-use restrictions on the use of hard copy prints of the roll, which the Commission sells on a relatively unrestricted basis. The absence of restrictions appears to be based on the assumption that storage of information in paper form provides some degree of privacy protection, because of limitations of searching and reproducing paper records.

There is considerable anecdotal evidence to indicate that, as a result of developments in information technology, third parties that are not subject to any use-limitation restrictions are converting printed copies of the roll into electronic form. In a submission to a parliamentary inquiry into the Privacy Bill, the Commission noted that the roll is being scanned or keyed into electronic databases and used for commercial purposes such as direct marketing.[2] There is also evidence of a growing market in databases based upon the electoral roll that have been merged with other public registers.

These developments indicate that technological developments necessitate a review of policy and legislation in relation to the sale of printed copies of the electoral roll.

Recommendation 2

That as a short-term measure, the Commission either restricts or stops making the roll available for sale in printed form. That in the long-term, Parliament consider imposing the same end-use restrictions on electoral information, whether it is provided electronically or in printed form.

Changes to legislative controls

The availability of public registers such as the electoral roll in electronic records enables information to be re-sorted, copied and combined with other information much more easily than if it was stored on paper or microfiche. It is also unclear how legislative restrictions would apply to electoral information that has been merged with other sources of information. It is clear, however, that electoral information re‑organised in these ways is likely to be used for secondary purposes that are inconsistent with the primary purpose of the roll. Personal information from a number of sources can be brought together to create a profile of a person or of a group of people for a number of purposes such as direct marketing. Compiling personal profiles of this kind may be considered by many people to be privacy-intrusive for a number of reasons. People may be unaware that the file exists, be unable to access or correct it, and decisions may be made about them on the basis of false or misleading information.

The POI Act makes changes to legislative controls over the use of information provided to government agencies. Section 3(3) of the POI Act provides that when electoral information has been incorporated into the agency’s information system, any use of the information is taken to be used for a permitted purpose. The effect of this provision will be to validate use and disclosure for any purpose of electoral information that has been merged with other data held by the agency. It is also unclear whether, once the electoral roll has been incorporated into an agency’s information system, the prohibition on use of the roll for commercial purposes still applies.

The POI Act also expands the range of authorised purposes in which the electoral roll can be given to agencies.

Recommendation 3

In order to maintain adequate protection of individual privacy, legislative measures be considered, which provide greater transparency in relation to the disclosure practices of the Commission. The Electoral Act could confer individuals with a right to obtain information about all disclosures made by the Commission to third parties. Consideration should also be given to providing individuals the right to have deleted all information derived from the electoral roll, where it has been collated into other databases unless it is for law enforcement or national security purposes. This would enable individuals to exercise some control over their personal information in the hands of those third parties.

Disclosure of information for political purposes and the Commonwealth Electoral Amendment Act (No. 1) 2000

The Commonwealth Electoral Amendment Act (No. 1) 2000 (CEA Act) was also passed in October. The CEA Act authorises the Commission to provide members of the House of Representatives (MPs), Senators and federally registered political parties with a wider range of elector information. In addition to information relating to the name, address, sex, date of birth and salutation, the CEA Act permits the AEC to provide information in relation to each person’s:

• postal address;
• census district;
• most recent enrolment date and enrolment transaction number;
• whether the person is not entitled to be enrolled as an elector of the Commonwealth; or
  • not also enrolled as a State or Territory elector; or
  • less than 18 years old;
• whether the person is a general postal voter;
• whether the person has only recently been enrolled;
• whether the person has re-enrolled and if so the Division and State or Territory in which they were previously enrolled and the enrolment transaction number for the previous enrolment;
• the electoral district for the purposes of State or Territory elections, and the local government area in which the person lives;
• the Australia Post delivery point identifier for each address of the person.

While the amendments appear consistent with the “permitted purposes” for which political parties and politicians may obtain the electoral roll,[3] the CEA does not address the corresponding need to provide effective privacy safeguards over use and disclosure. The Commission noted that political parties merge electoral information with information obtained from other sources in order to build detailed elector profiles.[4] Generally, the community is unaware that political parties compile such private databases based upon personal information that they provide on a compulsory basis. Regardless of how aware, individuals have the right of access and correction.

The Privacy Bill would amend the Privacy Act so as to extend privacy protection to private sector organisations. The Bill would give individuals the right to see information held on them by a business, but not information held on them by a political party. If the information held by a business is wrong, the Bill allows a person to have it corrected. By contrast, a person would be unable to have corrected information held by a political party that is wrong.

Moreover, political parties could disclose electoral information to third parties for permitted purposes under the Electoral Act, without being required to notify or get the consent from individuals. These third parties may include private polling or research organisations that will also be exempt from the Privacy Bill as a result of contractual arrangements.

The Privacy Bill has this effect because, as it is currently drafted, it would exempt political organisations from the application of the Privacy Act.[5] It also exempts in a more limited way the acts or practices (in summary) of:

• members of parliament
• local government councillors
• the contractors of members of parliament, local government councillors and political parties
• the sub-contractors of these contractors and
• volunteers working for political parties

who carry out for any purpose in connection with an election under an electoral law, a State, Territory or Commonwealth referendum or in connection with participation of the member, counsellor or political party in another aspect of the political process (section 7C).

While the Bill may assist in providing some privacy protections against the inappropriate merging of electoral roll data with data from other sources where the Bill applies, the political exemption would not provide any protection against such activity by an exempt political organisation or potentially another organisation acting under contract to the political organisation.

Recommendation 4

In order to achieve an appropriate balance between the privacy rights of individuals and the ability of political parties and individuals to contribute to the democratic process, individuals should be conferred the right to access records held by political parties and to obtain correction or deletion of that information. Individuals should also be allowed to know when and to whom political parties have disclosed information to third parties.

Use or disclosure by political parties for commercial purposes of data, derived from the electoral roll, should be prohibited.

These objectives could be achieved by appropriate modification of the political exemption in the Privacy Amendment (Private Sector) Bill 2000.

Public register privacy principles

Under the Privacy Act, public registers such as the electoral roll may fall under the definition of “generally available publication” which means “a magazine, book, newspaper or other publication that is or will be generally available to members of the public”. The effect of this definition is to exempt public registers from the IPPs relating to limitations on use and disclosure, requirements of security and data quality, rights of access and disclosure.

Technological developments in the collection, use and disclosure of personal information meant that a review of these provisions is overdue.

Recommendation 5

That consideration be given, possibly through a broad public inquiry, to reviewing and updating the privacy protection of information held in public registers.

Recommendation 6

Subject to the review proposed in recommendation 5, consideration should be given to amending the Privacy Act to ensure that all public registers maintained by government agencies are excluded from the definition of “generally available publications” in order to ensure that they are subject to all obligations under the IPPs.

Such a requirement exists in the Victorian Information Privacy Bill 2000 (the Victorian Bill) and the NSW Privacy and Personal Information Protection Act 1998 (the NSW Act). Clause 16 of the Victorian Bill provides that:

A public sector agency or a Council must, in administering a public register, so far as is reasonably practicable not do an act or engage in a practice that would contravene an Information Privacy Principle in respect of information collected, held, managed, used, disclosed or transferred by it in connection with the administration of the public register if that information were personal information.

Part VII of the New ZealandPrivacy Act 1993 (the NZ Act) protects the privacy of personal information on public registers with a set of Public Register Privacy Principles (PRPP). These principles prohibit the re-sorting of personal information from a public register, and the combination of personal information from various public registers for commercial purposes.