Purpose of the Bill

The purpose of the Migration Amendment (Streamlining Visa Processing) Bill 2018 (the Bill) is to amend the Migration Act 1958 (the Act) to allow the Minister to require certain classes of visa applicants to provide their biometric data as a precondition to lodging a valid visa application.

The Department states this will streamline the existing process in which visa applicants can only be legally required to provide biometric data once they have lodged their application.[1]

Background

Biometrics collection under the Migration Act

Under the Act, biometrics are referred to as ‘personal identifiers’, and can include fingerprints and handprints, height and weight measurements, facial images, audio or video recordings, and an iris scan or signature.[2] The Explanatory Memorandum to the present Bill describes the importance of such data as follows:

Once ‘anchored’ to a person’s biographic information, such as a name, nationality and date of birth, a biometric adds significantly to verifying that a person is who they claim to be, and to linking an individual to security, law enforcement and immigration information.[3]

Section 257A was inserted into the Act by the Migration Amendment (Strengthening Biometrics Integrity) Act 2015, and provides the Minister and immigration officers with broad powers to require non-citizens—as well as Australian citizens entering or leaving the country—to provide biometric data for the purposes of the Act or Regulations.[4] This may be done by ‘identification tests’ performed by Departmental officers, through automated systems such as airport SmartGates, or in another way specified by the Minister or officer.[5]

Despite the broad collection power, there is currently no express statutory requirement that visa applicants provide personal identifiers at the time of lodging their application. The power to collect biometrics under section 257A is structured around requiring personal identifiers from ‘a person’, rather than imposing a general obligation to provide biometrics in specific circumstances, or on a specific class of non-citizens. This means that a requirement to provide personal identifiers can only be made under section 257A once the application is lodged. Nonetheless, failure to provide personal identifiers when required to do so in connection with a visa application renders the application invalid, unless the Minister chooses to waive the requirement.[6]

Current biometrics program

Since 2010 the Department of Home Affairs (DOHA) has been running a biometrics program for offshore visa applicants in designated countries.[7] This involves taking a digital photograph and fingerprint scan at the time the person lodges their application.[8] Applicants applying from a country and for a visa that are part of the program must provide these identifiers at an Australian Visa Application Centre (AVAC) or Australian Biometrics Collection Centre (ABCC) located in the relevant country. These centres are operated by four companies with which the Department has service delivery arrangements.[9]

The DOHA website lists 45 countries as currently part of the biometrics program.[10] The Department states that the current locations for biometrics collection have been selected on the basis of national security and fraud risks, locations where the Australian Government can share facilities with Five Country Conference partners (Canada, New Zealand, the United Kingdom and the United States), and for broad geographic coverage.[11]

Currently applicants provide their biometric data on an ostensibly voluntary basis, with an officer able to invoke section 257A if a person refuses to comply or has submitted an application other than in person.[12]

Use and protection of biometric data

The Privacy Act 1988 and Australian Privacy Principles (APPs) regulate the handling of personal information by Commonwealth government agencies and certain private sector organisations.[13] Under the Privacy Act, biometric information is considered ‘sensitive information’ if it is used for the purpose of automated biometric verification or identification, and therefore afforded a higher level of protection than other types of personal information.[14] Limitations include that sensitive information can only be collected with consent (unless a specified exception applies) and can only be used or disclosed for a secondary purpose to which it was collected if this is directly related to the primary purpose of collection.[15] However, it is an exception to these restrictions if the collection, use or disclosure is required or authorised by an Australian law.[16]

The Migration Act authorises the use and disclosure of identifying information for a range of purposes.[17] This includes, for example, disclosures:

• for the purpose of data-matching in order to authenticate the identity of a person, identify persons who may be of ‘character concern’ or a security concern, or to combat document and identity fraud[18]
• that are reasonably necessary for the enforcement of federal, state or territory criminal law[19]
• that are required by or under an Australian law[20]
• to federal, state and territory agencies to verify the person is an Australian citizen or holds a particular class of visa[21] and
• to a foreign country or law enforcement or border control body in a foreign country (if authorised by the Secretary or Australian Border Force Commissioner).[22]

It is an offence to access or disclose identifying information without authorisation.[23]

A key concern in connection with the 2015 legislation which introduced section 257A was the privacy impact of the Bill’s measures—particularly in light of the broad discretion conferred by section 257A—and the absence of a Privacy Impact Assessment (PIA) of the Bill.[24] The Department produced a PIA for the Bill in August 2015, which found that ‘while the privacy of individuals may be affected by the Bill, the expansion of the powers to collect personal identifiers is necessary and proportional to achieve the purpose of the Bill’.[25] The explanatory materials for the current Bill do not state that a PIA has been conducted or is planned.

Committee consideration

Legal and Constitutional Affairs Committee

The Bill was referred to the Senate Standing Committee on Legal and Constitutional Affairs for inquiry and report. The Committee issued its report on 25 February 2019, with the majority recommending that the Bill be passed.[26] The Committee stated that Bill’s proposed changes:

... are an important measure towards making Australia's visa processing system more efficient, and will help officials to identify criminals, terrorists and other applicants of concern faster than is currently the case.[27]

The Australian Greens issued a dissenting report which recommended that the Bill not be passed. The Greens pointed to concerns about the Bill raised by the Law Council of Australia and the Parliamentary Joint Committee on Human Rights, and questioned the capacity for all people subjected to the legislation to provide fully informed consent to the collection of their biometric data.[28] The Greens also raised concerns that the Bill could operate to discriminate against people based on protected attributes (such as race, sex, religion or national origin), by permitting a
non-disallowable instrument to require collection for specified classes of applicants.[29]

Senate Standing Committee for the Scrutiny of Bills

The Senate Standing Committee for the Scrutiny of Bills reported on the Bill on 5 December 2018. It expressed concern that by enabling the Minister to determine by way of non-disallowable legislative instrument, classes of visa applicants subject to biometric collection requirements, the Bill leaves to delegated legislation ‘significant elements of the visa processing framework—including matters that may have significant impacts on individuals’ privacy’.[30] It requested advice from the Minister on the necessity and appropriateness of this. The Committee also sought advice as to the appropriateness of amending the Bill to:

• require that the Minister’s determinations be disallowable and
• include specific consultation obligations prior to the making of a determination, including a requirement to consult with and consider the views of the Privacy Commissioner.[31]

The Minister’s response was included and considered in the Committee’s first report of 2019.[32] The Minister advised that the Bill will not expand or impact the nature or type of personal identifiers that can be required, or the purposes for which they can be collected. The Minister stated that exempting from disallowance instruments made under Part 2 of the Act ‘ensures certainty in visa operational matters for the Department, as well as certainty to visa applicants...’.[33] The Minister further advised that no specific consultations were intended to be undertaken prior to making an instrument, stating that the Privacy Commissioner was consulted prior to section 5A (which defines ‘personal identifiers’ and lists the purposes for which they can be collected) being inserted into the Migration Act.[34]

The Committee noted the Minister’s advice, but reiterated its concern about the appropriateness of leaving significant matters to non-disallowable legislative instruments, and drew its concerns to the attention of Senators.[35]

Policy position of non-government parties/independents

Labor Senators were part of the majority of the Legal and Constitutional Affairs Committee which recommended the Bill be passed. As noted above, the Australian Greens issued a dissenting report opposing the Bill. Other non-government parties and independents have not commented on the Bill at the time of writing.

Position of major interest groups

There has been little commentary on the Bill from interest groups, with only four submissions (including one from the Department) made to the Senate inquiry. The Legal Services Commission of South Australia expressed its support for the Bill.[36] The Law Council of Australia expressed a number of concerns with the Bill, querying the practicality of and rationale for requiring biometrics to be provided as a criterion for valid application lodgement, rather than as part of the
post-lodgement assessment process.[37] In its submission, the Law Council argued that the proposed changes:

• may place onerous requirements on certain applicants, such as those living in remote,
  poverty-stricken conditions, by requiring them to travel to an Australian Consulate post or similar agency
• in relation to onshore applications, appear to be contrary to the Department’s move towards online applications
• require further clarity regarding the way personal identifiers are to be used in the visa processing framework, and the extent to which applicants will be informed of these processes and have an adequate opportunity to respond
• without adequate parliamentary oversight and consultation requirements for the making of determinations, ‘may cast doubt over the non-discriminatory nature of Australia’s migration programme’.[38]

Financial implications

The Explanatory Memorandum states the Bill will have a low financial impact.[39]

Statement of Compatibility with Human Rights

As required under Part 3 of the Human Rights (Parliamentary Scrutiny) Act 2011 (Cth), the Government has assessed the Bill’s compatibility with the human rights and freedoms recognised or declared in the international instruments listed in section 3 of that Act. The Government considers that the Bill is compatible.[40]

Parliamentary Joint Committee on Human Rights

The Parliamentary Joint Committee on Human Rights reported on the Bill on 12 February 2019. It raised questions as to the Bill’s compatibility with the:

• right to privacy
• right to equality and non-discrimination and
• rights of the child.

The Committee sought advice from the Minister as to whether the Bill’s measures are proportionate to its stated objective to ensure the integrity of the visa system and protection of the Australian community.[41] It queried whether the Minister’s power to determine classes of persons who must provide personal identifiers is ‘sufficiently circumscribed and accompanied by adequate safeguards’ and whether safeguards are in place for individuals incapable of understanding and consenting to the collection.[42] The Committee also sought advice as to whether there are safeguards in place to ensure the determination of ‘classes of persons’ is based on reasonable and objective criteria, noting the potential for this to lead to distinctions based on protected attributes.[43]

In regards to the rights of the child, the Committee stated that the:

... collection, use, disclosure and retention of biometric information from children as young as 5 years is a serious intrusion into their privacy. It raises specific concerns that it may not be the least rights restrictive approach to achieving the stated objective.[44]

The Minister’s response has not yet been published.

Key issues and provisions

Rationale for the Bill

The Bill was introduced in the House by Minister for the Environment, Melissa Price. In her second reading speech, Minister Price stated that the Bill is aimed at ‘streamlining ... the process by which personal identifiers are required and provided at the time of a person applying for a visa’ and argued:

It is important that identity checks are able to be conducted against personal identifier data to detect individuals of concern as soon as they make a visa application. Personal identifiers are superior to checks undertaken using biographic details such as name and date of birth that are contained in identity documents.[45]

The Explanatory Memorandum states that obtaining personal identifiers up front in the application process ‘promotes early detection and assessment of critical information’.[46]

Minister’s determination

Existing section 46 of the Act sets out the requirements for making a valid visa application. Subsection 46(2A) currently provides an application will be invalid if the applicant has been required to provide personal identifiers under section 257A and has not complied with the requirement, unless the Minister has waived the operation of this provision. If a visa application is invalid, it cannot be considered.[47]

Item 1 of the Bill repeals this existing subsection and substitutes proposed subsections 46(2A) to (2D). Proposed subsection 46(2B) provides that the Minister may determine, by way of a non-disallowable legislative instrument,[48] that visa applicants in a specified class must provide one or more specified types of personal identifiers in one or more specified ways. The Explanatory Memorandum states that the way in which groups of applicants will be specified is ‘highly flexible’, and could include the circumstances of the applicants (such as their country of residence) or the class of visa being applied for, ‘or a combination of different factors such as these’.[49] It further notes:

The flexibility about what classes of applicants ... can be required to provide a personal identifier will enable the Department to collect personal identifiers from specific cohorts in response to emergent risks based on specified circumstances, recent events, and detected or realised threats.[50]

Proposed subsection 46(2C) provides some indication of the broad scope of proposed subsection 46(2B), by stating non-exhaustively that the Minister’s determination may specify: a class of visa applicants ‘in any way’; different types of personal identifiers to be provided by different classes of applicants; or the way in which a personal identifier must be provided, including by way of identification tests carried out by an authorised officer or authorised system.

Under proposed subsection 46(2A), a visa application will be invalid if the applicant falls in a class of applicants specified by the Minister’s determination under proposed subsection 46(2B) but does not comply with the requirement to provide personal identifiers as specified in the determination.

Proposed subsection 46(2D) states that an application will be taken to have complied with the requirement to provide personal identifiers of a specified type if the applicant is in immigration detention, and during the detention has provided a personal identifier of that type as required under the Act.

Absence of an exemption/waiver provision

There is scope under existing provisions in the Act for exemptions to be granted to the requirement to provide personal identifiers under section 257A—this is not the case in regards to the determination power proposed by the Bill. Section 258 states that the Minister may determine, by way of legislative instrument, a specified person or class of persons who must not be required to provide personal identifiers under section 257A.[51] Furthermore, existing subsection 46(2A)—repealed by the Bill—allows the Minister to waive a requirement to provide biometric data in connection with a person’s visa application. The Department’s current exemption policy captures persons such as sovereigns, heads of State, Government Ministers, diplomats and their families, as well as Special Purpose Visa (SPV) holders (such as members of airline crew and transit passengers).[52] The following persons are subject to a partial exemption and may not be required to provide fingerprint scans:

• minors under five
• ‘incapable persons’, defined under the Act as persons incapable of understanding the general nature and effect of, and purposes of, a requirement to provide a personal identifier[53] and
• physically incapacitated persons who may not be able to provide some or all fingerprints.

There is also a general discretion to exempt a person from the requirement to provide biometrics in exceptional circumstances. The Department’s policy guidance suggests this is limited to:

• emergency or compassionate situations (including where the applicant needs to travel urgently to visit a family member with a serious life threatening illness) or
• where there is ‘compelling national interest’ (such as where Australia’s trade or business opportunities, or relationship with a foreign government, would be adversely affected if the person is not granted the visa).[54]

In contrast, the provisions in the current Bill do not provide for similar exemptions or waivers—if a person is captured by a determination by the Minister under proposed subsection 46(2B), there does not appear to be a mechanism by which they can be exempted from complying. This has the potential to operate harshly for certain applicants, such as those who, for example, may need to travel to Australia urgently in compassionate circumstances but who live a long way from a biometrics collection centre in their country.

The Statement of Compatibility states that the policy intention is that the Minister’s determination will impose the following requirements on children applying for a General Skilled Migration visa (as dependants on the parents’ main application):

• children aged up to four years will need to provide a photograph and
• children aged at least five years will need to provide a photograph and fingerprints if resident in a specified country where personal identifier collection is available.[55]

This appears consistent with DOHA’s existing exemptions policy. However, the Statement of Compatibility also indicates that requirements for the collection of personal identifiers will extend to ‘incapable persons’, and states:

...these persons will have had an application made on their behalf by their legal guardian. Their legal guardian will also need to make arrangements to have the incapable person’s personal identifiers collected.[56]

Proposed subparagraph 46(2C)(c)(ii) provides that the Minister’s determination may specify that a type of personal identifier be provided in a way other than through an identification test or an authorised system. The Explanatory Memorandum states that this recognises:

There are circumstances where it is not practical or efficient for personal identifiers to be provided by way of an identification test carried out by an authorised officer or authorised system.[57]

It is not clear whether this could be used to accommodate applicants who, due to emergency or compassionate circumstances, may be unable to attend an AVAC or ABCC. The Department’s policy guidance provides that offshore visa applicants can currently be required to provide personal identifiers:

• at an office of an agency contracted by the department, being an office with personal identifier collection capabilities (for example, at a visa application centre or biometrics collection centre operated by an SDP)
• at a diplomatic, consular or migration office maintained by or on behalf of the Commonwealth outside Australia, being an office with personal identifier collection capabilities (for example where biometric collection takes place at post)
• at an office of Immigration in Australia, being an office with personal identifier collection capabilities (for example, at a State/Territory office, if the applicant has travelled to Australia on another visa before having provided their personal identifiers for the application being processed outside Australia)
• directly to an officer (who may also be a delegate), who has a capability to collect personal identifiers (for example, to an officer operating a Mobile Biometric Collection Unit in the field) or
• in any other way specified (at present there are no additional ways in operation).[58]

Consequential and application provisions

Items 2 to 7 make consequential amendments to existing provisions of the Act which deal with the collection of personal identifiers. The effect of this is that certain requirements that currently apply to the collection of biometric data under section 257A, will also apply to collection pursuant to proposed subsection 46(2B). This includes requirements that:

• authorised officers carrying out identification tests inform the person of any prescribed matters[59]
• the collection of personal identifiers be done in circumstances affording reasonable privacy to the person and not involving the removal of more clothing than necessary, or more visual inspection than necessary for carrying out the test[60]
• a person not be required to provide personal identifiers in a cruel, inhuman or degrading way, or in way that fails to treat them with humanity and with respect for human dignity.[61]

Item 8 is an application provision which states the Bill’s amendments will apply in relation to visa applications made on or after commencement.

Concluding comments

The Bill strengthens the legislative basis for collecting personal identifiers from visa applicants at the time of application. Due to the broad collection powers which already exist under the Act, it is unlikely to significantly expand the circumstances in which such information can be collected. As a matter of practice biometric data is already collected from certain classes of offshore visa applicants at the time of lodging their application.

However, the Bill does not appear to contain scope for discretionary exemptions which exist in relation to the existing collection powers. It is not clear from the explanatory materials why such an exemption provision has not been included.

Members, Senators and Parliamentary staff can obtain further information from the Parliamentary Library on (02) 6277 2500.