Carol Brown (Tasmania, Australian Labor Party, Shadow Parliamentary Secretary for Families and Payments) Share this | Hansard source

I rise to speak on the Migration Amendment (Strengthening Biometrics Integrity) Bill 2015. Labor does not oppose this bill, but we have concerns about some of its provisions and we have circulated amendments that aim to address these concerns.

Biometrics are personal identifiers based on individual physical characteristics such as finger and hand prints, facial images, iris scans and signatures. Any of these identifiers may be digitised and stored in a database. Although these characteristics are unique to individuals, a biometric does not by itself provide exclusive proof of identity. Biometrics are, however, more accurate than documentary checks because they are relatively stable over time, at least for adults, and much more difficult to forge.

In conjunction with documentary evidence, therefore, the collection of biometric data makes the task of those who conduct identity checks at Australia's air and sea ports considerably easier. Accordingly, biometrics have been collected for immigration purposes since 2004 for noncitizens. And since the foreign fighters act became law in 2014, they have been collected for citizens as well.

At present, the Migration Act authorises the collection of biometric data in eight circumstances. The bill now before the Senate consolidates seven of these into a single broad collection power. The eighth circumstance, concerning collection of biometrics from noncitizens in immigration detention, is not affected by the bill.

Most Australians who pass through routine immigration screening are not currently required to provide biometric data. It is not envisaged that this will change as a result of this bill. Nonetheless, the collection and retention of biometric data for immigration checks is reasonable—and, for security and law enforcement checks, it is both reasonable and, in most circumstances, appropriate.

Because of the nature of such data, however, issues of privacy and respect for individuals arise concerning the kind of biometric collected, the age of the person from whom it is collected and the consequences of any misuse of the information. Those issues become more acute for this bill because of the broad power of collection that it authorises.

These issues were canvassed by the Parliamentary Joint Committee on Human Rights and by many submissions to the Senate inquiry on the bill. The joint committee pointed out that creation of a broad discretionary power of collection necessarily limits the right to privacy, the right to equality and nondiscrimination, the right to equality before the law and the rights of the child.

At present, the Migration Act requires that collection of biometric data must be carried out in circumstances affording reasonable privacy to the person, must not be carried out in the presence of a person whose presence is not necessary for the purposes of the test or required by another provision of the act, must not involve the removal of more clothing than is necessary for carrying out the test and must not involve more visual inspection than is necessary for carrying out the test. The bill does not remove these requirements, but it does provide a new power for the minister and authorised officers to require that identifiers be provided in 'another way'—that is, in a way different from the rules set out in the act.

According to the explanatory memorandum, this new power will allow for quick live scanning of a person's fingers. It is not proposed to collect facial images under tests permitted by this new power and no clothing would be removed. However, as the Human Rights Committee has pointed out, the bill itself contains no such restriction. The government has given only a statement of its present intention. There is no guarantee that in future the new power could not be used in a way that contravenes the safeguards in the act.

Under the act, children can only be required to provide an identifier consisting of height and weight measurements or a facial image. The consent of a parent or a guardian must be given, and a parent or a guardian must be present while the test is carried out. However, this bill removes these restrictions. The explanatory memorandum offers several reasons for their removal. The first is that it is a child protection measure, responding to cases in which children have been trafficked or smuggled to Australia, sometimes with parental consent, as part of a family that is not their own. The second is that it is also a response to terrorism incidents in the Middle East and Africa that have involved children. The third is that it provides greater consistency with the practice of other Five Eyes countries. Some of these countries do not set age limits for the collection of biometric data and some do so only as policy.

Clearly, no-one can condone the trafficking of children or the unconscionable conduct of terrorists who manipulate children into becoming their accomplices. The Department of Immigration and Border Protection has stated that it would still be normal practice, as a matter of policy, to obtain the consent of parents or guardians for the collection of biometric data and to have them present while tests are carried out. Nonetheless, it is not surprising that the removal of a legal requirement for this practice to be observed has caused deep unease. The intention may be to prevent the exploitation and abuse of children, but it is not inconceivable that, in the absence of these requirements, circumstances may arise in which they are abused.

Many submissions to the Senate inquiry called for the retention of some form of legal restriction to protect children and other incapable persons. The Law Council of Australia's submission urged that guidelines be established to ensure that the collection of biometric data from children is carried out in a respectful manner and that independent guardians are appointed for unaccompanied children. Similar legislation enacted in the UK contains specific protections for vulnerable groups. Labor is moving four amendments related to this matter. The first two would see clauses incorporated in the bill to specifically require that particular care is taken to ensure that the privacy of minors and incapable people is respected and that they are treated with humanity and respect for human dignity. The third and fourth amendments would introduce legislated requirements as to who must be present when minors and incapable people are required to participate in identification tests without the consent of a parent or guardian.

A further issue that generated much debate when the UK was devising its legislation concerned the period for which biometric data should be retained. Several overseas regimes set a time limit for retention, while allowing possible extension of the limit. In Australia, there is a potential conflict between the provisions of this bill on indefinite retention of data and the recently amended Privacy Act, which requires that personal data must be retained for a reasonable purpose and only for so long as it is useful. Labor have examined this issue and we have concluded that existing provisions should be sufficient to require personal identifiers to be destroyed as soon as possible when they are no longer useful.

The government has assured us that this is certainly its intention. However, we remain concerned that there is no requirement for individuals to be notified if there is a serious privacy breach in relation to their identifying information. Our amendment defines a serious data breach as a situation where there is unauthorised access to or disclosure of identifying information and where there is a real risk of unauthorised use of the information or serious interference with the individual's privacy. Our amendment would require that, in such circumstances, the person responsible for the information would be required to notify the individual of the privacy breach and also to notify the Information Commissioner. We hope this proposed section never has to be used, but we believe this layer of protection is important.

Senators will recall that in 2014 the Department of Immigration and Border Protection was involved in a security breach where the personal details of nearly 10,000 asylum seekers were inadvertently released on the department's website, and earlier this year the department inadvertently disclosed the passport and visa details of world leaders attending the G20 summit in Brisbane. It is true that these were documentary forms of identification, but consider the problems that could arise if biometric data were hacked. Unlike passports, tax file numbers and Medicare numbers, biometric data cannot be changed.

Because of the concerns I have articulated—concerns raised by the Law Council and other informed organisations during the Senate inquiry—Labor believes that this bill requires amendment. If this bill is amended in the ways Labor has proposed, Australia's collection of biometric data for the purpose of immigration and border protection will be safer and more efficient.