Australian Parliamentary Library Bills Digests Australian Parliamentary Library Bills Digests[Index] [Search] [Download] [Bill] [Help]
Migration Legislation Amendment (Identification and Authentication) Bill 2003
WARNING:
This Digest was prepared for debate. It reflects the legislation as introduced
and does not canvass subsequent amendments. This Digest does not have
any official legal status. Other sources should be consulted to determine
the subsequent official status of the Bill.
CONTENTS
Passage History
Purpose
Background
Main Provisions
Comments
Conclusions
Endnotes
Contact Officer & Copyright Details
Migration Legislation Amendment (Identification and Authentication) Bill 2003
House: Representatives
Portfolio: Immigration and Multicultural and Indigenous Affairs
Commencement: The substantive provisions of the Bill commence on the earlier of a date fixed by proclamation, or 6 months from royal assent to the Bill.
The Minister states the purpose of the Bill is to strengthen and clarify existing statutory powers to identify non-citizens.
Biometric information helps authenticate identity as it relates to a relatively invariant aspect of who a person is. There are six generic types of biometric in use today: face, iris, fingerprint, hand, signature and voice. In contrast, other authentication systems rely on possession of particular identifying documentation (such as a passport) or knowledge (a password).
By way of background, it should be noted that biometric information does not of itself identify an individual. The usefulness of a biometric record is when it can be identified as belonging to an individual by some additional information or when it can be compared against similar record or records. In an immigration context, the collection of non-citizen biometric information would be useful if the non-citizen subsequently committed or attempted to commit identity fraud, or their data could be checked against equivalent data overseas.
This Bill provides the framework for the collection of biometric data by immigration officials. Current Australian and overseas immigration regimes routinely require photographs and signatures. The Bill expands the powers available to collect other biometric information, including finger prints, iris scans, facial scans and body measurements, from non-citizens in particular circumstances and sets out a regulatory framework for the database or databases that would be established.
The bill is part of a whole of government approach to tackle the growing incidence of identity fraud worldwide. Identity fraud arises when a person pretends to be someone else in order to obtain a particular immigration outcome, or goods and services through the use of a fictitious name or the adoption of another person’s name.
Identity fraud not only impacts on the integrity of the immigration program, at an organised level it may be linked to terrorism and organised crime, including money-laundering and credit card skimming. At an individual level, identity fraud would include taxation and social security fraud.
To the extent that identity fraud may be committed by a non-citizen, there may be a link between immigration fraud and identity fraud in a criminal context.
Elements in the Government’s approach to combat identity fraud include proposals beyond the immigration context, for example:
Key issues in considering this Bill are whether the biometric database or databases, in relation to non-citizens in a non-criminal context, are proportionate to the size of the currently undetected identity fraud by non-citizens, and how the information collected will achieve these purposes.
Precise measurement of the extent of identity fraud is
difficult. Detected fraud can be measured, but extrapolating that into
any total figure involves a degree of guesswork. In
In relation to immigration fraud, a UK Cabinet Office report entitled Identity Fraud: A Study released in July 2002 states that 50 cases of fraudulent travel documentation were detected every month at Heathrow Airport Terminal 3. It estimates that at least 10 times that number that were not detected.(7) The report also states that the number of entry documents at UK ports of arrival in 2000 detected as being counterfeit were 0.006% of the total.(8)
In
The provisions of the Migration Act 1958 require both non-citizens and citizens to provide ‘evidence of the person's identity’ in certain circumstances. For example:
The only provision in the Migration Act 1958 that expressly authorises the taking of biometric information for the purposes of identification is section 258. That provision applies to people in immigration detention.
Section 258 of the Act states:
Where a person is in immigration detention by virtue of this Act, an authorized officer may do all such things as are reasonably necessary for photographing or measuring that person or otherwise recording matters in order to facilitate the person's present or future identification.
While the provision would support the taking of a variety of types of personal identifiers, it would appear that, in addition to the usual photographs and signatures, fingerprinting is the main means of facilitating identification at present.(14)
The practice of fingerprinting detainees is governed by Departmental instructions. Migration Series Instruction (MSI) 125 on Fingerprinting of Detainees explains that:
MSI 125 also provides certain safeguards to the current process where the use of reasonable force is contemplated:
In contrast to the current regime, the Migration Legislation Amendment (Identification and Authentication) Bill sets out a definition of a personal identifier, a number of circumstances in which it may be required, how it is to be provided, stored, used and the circumstances in which it must be destroyed. It lifts the Departmental instructions into primary legislation.
The Bill also broadens the basis for collection of identifying material, from immigration detainees assessed on a case by case basis, to an ‘opt-out’ regime in relation to people who fall within prescribed categories.
Identity fraud and its consequences for security, crime and delivery of entitlements is the subject of increasing attention worldwide. Policies, and preferred technologies, vary. Some examples of proposed schemes follow.
In May 2003, the G8 countries
(
The International Civil Aviation Organisation (ICAO) has adopted a global blueprint for the integration of biometrics into machine readable travel documents to enhance processing, security and crime prevention.(21) Its research into biometric technology indicates some technologies are more reliable than others: face technology provides the best results, followed by fingerprint and iris technology, then signature, hand and voice technologies.(22)
The UK Home Secretary has proposed
a ‘passport’ which incorporates biometric information to enhance airport
processing and security,(23) and a card with biometric information
to access government entitlements.(24)
The French Minister of the Interior has recently introduced a Bill which would require French consulates to fingerprint applicants for tourist visas in order to combat crime and illegal immigration.(27)
Schemes which are currently
operational include Eurodac which operates in EU member states as a way
of reducing forum shopping by asylum seekers.(28) This is
discussed in more detail below. In the
The countries of the European
Union have recently established Eurodac, an automated fingerprint identification
system. As of
The Eurodac system has a number of safeguards. Fingerprints may only be taken of minors over the age of 14. No personal details are held in the data base. The system relies on biometric comparison only. Fingerprints are not stored indefinitely, they are erased if a former asylum seeker becomes a national of a participating state or after 10 years. Finally, the operation of the system is monitored by a supervisory authority.(31)
Item 11, new section 5A defines ‘personal identifiers’ to mean, in relation to a particular person:
Item 11, new section 5A(2) states that before prescribing new tests, the Minister must be satisfied that:
The purposes are set out in the following sub section.(33) Some purposes are quite specific, for example, ‘to detect forum shopping by applicants for visas’. Others, however, are considerably more general. For example:
The implications of a broad set of purposes are discussed in the comments below.
In addition, it should be noted that the definition does not expressly distinguish between the biometric data and the information which links it to a particular person.
The Bill sets out the general circumstances in which non-citizens may be required to supply personal identifiers:
Importantly however, the precise circumstances in which a personal identifier must be supplied is left to regulations. The Bill contemplates that the Minister will prescribe at a later date circumstances in which biometric data is required.
Item 11, new sub section 5A(1) states that the regulations may not prescribe intimate forensic procedures, as defined under the Commonwealth Crimes Act 1914,(38) such as taking a sample of blood or saliva or pubic hair or taking a buccal/oral swab or external examination of a genital or anal area.
Item 20, new sub section 170(4) and item 24 new sub section 188(6) provide that personal identifiers must be taken by an authorised officer,(39) except where prescribed otherwise.
Item 31, new section 258E guarantees certain minimum procedural safeguards when taking personal identifiers. Identification tests:
Moreover, item 31, new section 258F and item 32, new section 261AF provide that identification tests must not be carried out in a manner that is cruel, inhuman or degrading, or that fails to respect human dignity.(40)
Additional safeguards apply in certain cases. Item 32, new section 261AH provides that immigration detainees must be informed in a language they understand of their right to have the tests taken by an officer of the same sex. In addition, to avoid the systematic use of testing as a management tool in detention centers, item 32, new section 261AK restricts retesting of immigration detainees.
Item 30, new section 192A and item 31, new section 258B provide that non-citizens who are suspected of being unlawful non-citizens pursuant to section 188, or who are detained for the purposes of questioning pursuant to section 192, must be informed, in a language they understand, that they have the right to request an authorisation for the test from a senior authorising officer.(41)
There is also provision for the Minister to limit the types of identification tests that an officer or class of officers can carry out.
In relation to the use of force to collect personal identifiers, the Bill treats non-citizens in immigration detention (other than for the purposes of questioning under section 192) differently from non-citizens generally.
Item 32, new section 261AE states that, in relation to a non-citizen in immigration detention, reasonable force may be used in carrying out the identification procedure:
A senior authorising officer is defined in new sub section 261AE(8) to mean an officer whom the Secretary has authorised to perform those functions.
Depending on the circumstances, failure to comply with an identification requirement may:
The Bill defines minors as less than 18 years old and provides that any biometric tests of minors must be carried out with the informed consent of, and in the presence of, a parent or guardian, or an independent person (item 32, sub sections 261AL(2), (4) and (5)). The parent or guardian, or independent person, must be informed of their right to request authorisation of the test from a senior authorising officer. Similar safeguards apply in the case of an incapable person (item 32, new section 261AM).
In relation to minors who are less than 15 years old, the Bill restricts the number of personal identifiers that can be collected from this group to two: measurement of the child’s height and weight and photograph of the child’s face and shoulders (item 32, new sub section 261AL(1)).
Item 33, new Part 4A regulates access to, disclosure of, and modification or impairment of identifying information. It includes disclosure of identifying information to foreign countries and agencies, with the Secretary’s authorisation (item 33, new section 336F).
Item 33, new sub section 336K(4) provides for the destruction of identifying information. Importantly, ‘destruction’ is defined narrowly to mean the destruction of the means of identifying the information with the person from whom it was taken or to whom it relates. It would not require the underlying data ‘sample’ to be destroyed.
Item 33, new sub section 336K(1) states as a general principle, ‘destruction’ is required as soon as practicable after the information is no longer required to be kept under the Commonwealth Archives Act 1983. However, new sub section 336K(2) exempts measurements of height or weight, photographs of face and shoulders, and signatures, or the attached identifying information, from the requirement. In addition, new section 336L allows even the identifying information to be indefinitely retained in certain other cases. Those cases are where the person has:
The Bill contemplates collection of biometric information
on a large scale and as such takes
As a party to the International Covenant on Civil and Political Rights, Australia is obliged to ensure that ‘no one … be subjected to arbitrary or unlawful interference with … privacy’.(42) The Human Rights Committee, established to oversee implementation of the treaty by States parties, recognises that ‘as all persons live in society, the protection of privacy is necessarily relative’.(43) Thus, interferences with privacy do not themselves breach the Covenant, they will only do so where the curtailment of the right is unreasonable or not objectively justifiable on a case-by-case basis.(44) The more significant the problem, the more justifiable is a curtailment of the right to privacy.
It follows that the extent of identity fraud by non-citizens, or in the Australian immigration context, is highly relevant to a consideration of whether the interference with privacy permitted by this Bill is justifiable, and therefore complies with the right to privacy enshrined in the Covenant. Arguably, it would be precipitous to proceed with new policy that has significant ramifications for personal privacy in the absence of analysis based on verifiable information.(45)
Moreover, to determine the value of the data to
The international obligations mentioned above are implemented in domestic law through the Privacy Act 1988. The protection of personal information is set out in the Information Privacy Principles (IPPs).(46) Section 16 of the Privacy Act states that an agency, defined to include Commonwealth Departments, shall not collect, use and disclose personal information inconsistently with the IPPs.(47)
IPP 1 states that personal information should only be collected if it is necessary for a lawful purpose directly related to a function or activity of the collector. As noted above, the purposes for collection of identifying material are very generic. For example, the purposes in the Bill for the collection of identifying material is stated to be mere identification both in the present and future.(48) Without further elaboration of the circumstances in which identification is required, this would allow information to be collected in cases where there was rarely if ever immigration fraud. It gives rise to the question whether the creation of a ‘just-in-case’ database is a proportionate response to the scale of identity fraud by non-citizens.
Moreover, the low level of generality of the purposes for the Bill facilitating sharing of information with agencies outside the immigration context, for example, domestic or foreign enforcement agencies. While the Bill prohibits disclosures of certain types of identifiers for the purposes of investigating an offence against an Australian law,(49) the prohibition is not absolute and no such limitation is imposed on sharing of information in relation to foreign offences. Indeed, the Bill itself contemplates the provision of data to foreign law enforcement agencies.(50) Yet there is no guarantee that the use of the identifying information by the law enforcement agency will have any connection with the purpose for which the data was collected in the first instance by the Department of Immigration and Multicultural and Indigenous Affairs.
In addition, it is unclear whether information sharing arrangements with foreign countries would be subject to a consideration of the consequences of that disclosure, for example, whether they would lead to prosecutions under laws that do not have any equivalent in Australian law.
The circumstances in which personal information may be disclosed under the Bill deserves further examination in the light of the IPPs. IPP 11 states that personal information cannot be disclosed to another agency except in certain circumstances. The most relevant of the exceptions for current purposes allows disclosure when it is authorised ‘by or under law’. Accordingly, authorisations should be in primary legislation. Arguably, it is not sufficient to note that information can be disclosed if it ‘takes place under an arrangement with another Commonwealth agency’.(51) If this were the case, then the purpose of the authorised by law disclosures would be frustrated.
As mentioned above, the definition of ‘destroyed’ in
the Bill(52) is weak. It only goes to the destruction of identifying
information and not the sample itself. It would allow the identifying
labels to be removed, but the finger prints, scans etc, to remain. These
anonymous samples could still form the basis of a useful database. Indeed,
anonymous samples alone form the Eurodac database established in
In addition, the need for a database for all the categories of indefinite retention in section 336L could also be tested against some grounds of proportionality. One precedent is the approach in the Eurodac system whereby fingerprints must be destroyed after 10 years or upon grant of nationality. One perhaps unintended consequence of maintaining the indefinite retention of biometric data in cases where citizenship has been granted would be to create distinctions between citizens dependent on the amount of data stored in individual cases.
Without the benefit of regulations that set out the circumstances
in which personal identifiers are required and exemptions to those requirements,
the application of the biometric regime established by the Bill is potentially
very broad. Its provisions may apply to any non-citizen in
As noted above, the Minister must prescribe the circumstances in which personal identifiers are to be used and may prescribe exemptions to that regime. Furthermore, the Minister may prescribe further types of biometric measurements that are to be used. It must be asked whether these issues which go to the coverage and intrusiveness of the new regime are properly dealt with by delegated legislation.
The guidelines of the Senate Regulations and Ordinances Committee for delegated legislation suggest that regulations:
Furthermore, the Administrative Review Council in its report Rulemaking by Commonwealth Agencies, recommends that measures which affect individual rights and liberties, including powers of search, should be enacted in primary legislation.(54)
As mentioned above, the Bill limits the tests available in the case of a non-citizen below the age of 15 years, but not the tests available in the case of minors aged between 15 and 18.
Of particular concern is the fact that the Bill would permit a more extensive testing regime in the case of a child than is currently available under the Commonwealth Crimes Act 1914. For example, in the criminal law, authorisation for a forensic test of a suspect or an offender between the age of 10 and 18 years must be given by a magistrate. Moreover, children under the age of 10 are not subject to the forensic procedures provisions of the Crimes Act.
In contrast, the provisions of the Bill contemplate testing with only the consent of a parent or guardian, or in the absence of a parent or guardian, an independent person, and if requested, a senior authorising officer.(55)
The Bill and ensuing regulations will remove a level of doubt about the taking of identifiers from detainees. The Bill provides the Minister with the power to prescribe a wide range of tests, and to prescribe the circumstances in which they can be carried out. It also provides statutory procedural safeguards.(56)
However, current protections under Migration Act 1958 (such as the implication that fingerprinting is a measure of last resort, the prohibition on fingerprinting of minors, and the obligation to destroy data on grant of a visa or deportation) would be removed.
In contrast to the Eurodac system, the Bill does not provide for oversight of the data collection, storage, use and destruction. Were supervisory functions to be given to an independent authority, they would enhance the protections against arbitrary or unlawful interferences with personal information. A lesser degree of oversight would also be possible, for example, by giving the Department of Immigration and Multicultural and Indigenous Affairs reporting functions.
The literature on the usefulness of biometric identifiers indicates that the technology is not 100 per cent reliable at this stage. ICAO’s study found that the technology with the highest compatibility rating still had a relatively high rate of error.(57) Error may be induced for a number of reasons including dummy identifiers (for example, fake fingerprints) or quirks of human physiology (for example, around one in 70,000 people do not have an iris). For this reason, some commentators have recommended multiple types of identifiers, with the concomitant cost implications of such systems.(58)
The Bill gives significant new powers to the Minister
for Immigration and Multicultural and Indigenous Affairs to establish
a database or databases of personal identifiers in relation to non-citizens
by regulation. There is value in codifying in primary legislation current
practice and safeguards in relation to fingerprinting of asylum-seekers,
and indeed there may be value in maintaining equivalent border control
mechanisms as other countries in the interests of avoiding being a ‘soft
target’ for terrorists and other people of concern. In the absence of
a debate regarding what incursions on privacy are considered acceptable
in the context of undetected identity fraud in
See also http://europa.eu.int/scadplus/leg/en/lvb/133081.htm.
(a) an external examination of the genital or anal area, the buttocks
or, in the case of a female or a transgender person who identifies as
a female, the breasts;
(b) the taking of a sample of blood;
(c) the taking of a sample of saliva, or a sample by buccal swab;
(d) the taking of a sample of pubic hair;
(e) the taking of a sample by swab or washing from the external genital
or anal area, the buttocks or, in the case of a female or a transgender
person who identifies as a female, the breasts;
(f) the taking of a sample by vacuum suction, by scraping or by lifting
by tape from the external genital or anal area, the buttocks or, in the
case of a female or a transgender person who identifies as a female, the
breasts;
(g) the taking of a dental impression;
(h) the taking of a photograph or video recording of, or an impression
or cast of a wound from, the genital or anal area, the buttocks or, in
the case of a female or a transgender person who identifies as a female,
the breasts.
This paper has been prepared for general distribution to Senators and Members of the Australian Parliament. While great care is taken to ensure that the paper is accurate and balanced, the paper is written using information publicly available at the time of production. The views expressed are those of the author and should not be attributed to the Information and Research Services (IRS). Advice on legislation or legal policy issues contained in this paper is provided for use in parliamentary debate and for related parliamentary purposes. This paper is not professional legal opinion. Readers are reminded that the paper is not an official parliamentary or Australian government document.
ISSN 1328-8091
© Commonwealth of Australia 2003
Except to the extent of the uses permitted under the Copyright Act 1968, no part of this publication may be reproduced or transmitted in any form or by any means, including information storage and retrieval systems, without the prior written consent of the Parliamentary Library, other than by Members of the Australian Parliament in the course of their official duties.
Published by the Department of the Parliamentary Library, 2003.