History of the Bill

The Migration Amendment (Streamlining Visa Processing) Bill 2018 (2018 Bill) was introduced into the House of Representatives on 29 November 2018. The Bill was not debated, and lapsed at the dissolution of the 45th Parliament on 11 April 2019.[1]

The present Bill was introduced into the House of Representatives on 4 July 2019, and is in identical terms to the 2018 Bill.

A Bills digest was prepared in respect of the 2018 Bill.[2] Much of the material in the present Digest has been sourced from that earlier one.

Purpose of the Bill

The purpose of the Migration Amendment (Streamlining Visa Processing) Bill 2019 (the Bill) is to amend the Migration Act 1958 (the Act) to allow the Minister to require certain classes of visa applicants to provide their biometric data as a precondition to lodging a valid visa application.

The Bill is aimed at streamlining the existing process in which visa applicants can only be legally required to provide biometric data once they have lodged their application.[3]

Background

Biometrics collection under the Migration Act

Under the Act, biometrics are referred to as ‘personal identifiers’, and can include fingerprints and handprints, height and weight measurements, facial images, audio or video recordings, and an iris scan or signature.[4] The Explanatory Memorandum to the present Bill describes the importance of such data as follows:

Once ‘anchored’ to a person’s biographic information, such as a name, nationality and date of birth, a biometric adds significantly to verifying that a person is who they claim to be, and to linking an individual to security, law enforcement and immigration information.[5]

Section 257A was inserted into the Act by the Migration Amendment (Strengthening Biometrics Integrity) Act 2015, and provides the Minister and immigration officers with broad powers to require non-citizens—as well as Australian citizens entering or leaving the country—to provide biometric data for the purposes of the Act or Regulations.[6] This may be done by ‘identification tests’ performed by Departmental officers, through automated systems such as airport SmartGates, or in another way specified by the Minister or officer.[7]

Despite the broad collection power, there is currently no express statutory requirement that visa applicants provide personal identifiers at the time of lodging their application. The power to collect biometrics under section 257A is structured around requiring personal identifiers from ‘a person’, rather than imposing a general obligation to provide biometrics in specific circumstances, or on a specific class of non-citizens. This means that a requirement to provide personal identifiers can only be made under section 257A once the application is lodged. Nonetheless, failure to provide personal identifiers when required to do so in connection with a visa application renders the application invalid, unless the Minister chooses to waive the requirement.[8]

Current biometrics program

Since 2010 the Department of Home Affairs (DOHA) has been running a biometrics program for offshore visa applicants in designated countries.[9] This involves taking a digital photograph and fingerprint scan at the time the person lodges their application.[10] Applicants applying from a country and for a visa that are part of the program must provide these identifiers at an Australian Visa Application Centre (AVAC) or Australian Biometrics Collection Centre (ABCC) located in the relevant country. These centres are operated by four companies with which the Department has service delivery arrangements.[11]

The DOHA website lists 45 countries as currently part of the biometrics program.[12] The Department states that the current locations for biometrics collection have been selected on the basis of national security and fraud risks, locations where the Australian Government can share facilities with Five Country Conference partners (Canada, New Zealand, the United Kingdom and the United States), and for broad geographic coverage.[13]

Currently applicants provide their biometric data on an ostensibly voluntary basis, with an officer able to invoke section 257A if a person refuses to comply or has submitted an application other than in person.[14]

Use and protection of biometric data

The Privacy Act 1988 and Australian Privacy Principles (APPs) regulate the handling of personal information by Commonwealth government agencies and certain private sector organisations.[15] Under the Privacy Act, biometric information is considered ‘sensitive information’ if it is used for the purpose of automated biometric verification or identification, and therefore afforded a higher level of protection than other types of personal information.[16] Limitations include that sensitive information can only be collected with consent (unless a specified exception applies) and can only be used or disclosed for a secondary purpose to which it was collected if this is directly related to the primary purpose of collection.[17] However, it is an exception to these restrictions if the collection, use or disclosure is required or authorised by an Australian law.[18]

The Migration Act authorises the use and disclosure of identifying information for a range of purposes.[19] This includes, for example, disclosures:

• for the purpose of data-matching in order to authenticate the identity of a person, identify persons who may be of ‘character concern’ or a security concern, or to combat document and identity fraud[20]
• that are reasonably necessary for the enforcement of federal, state or territory criminal law[21]
• that are required by or under an Australian law[22]
• to federal, state and territory agencies to verify the person is an Australian citizen or holds a particular class of visa[23] and
• to a foreign country or law enforcement or border control body in a foreign country (if authorised by the Secretary or Australian Border Force Commissioner).[24]

It is an offence to access or disclose identifying information without authorisation.[25]

A key concern in connection with the 2015 legislation which introduced section 257A was the privacy impact of the Bill’s measures—particularly in light of the broad discretion conferred by section 257A—and the absence of a Privacy Impact Assessment (PIA) of the Bill.[26] The Department produced a PIA for the Bill in August 2015, which found that ‘while the privacy of individuals may be affected by the Bill, the expansion of the powers to collect personal identifiers is necessary and proportional to achieve the purpose of the Bill’.[27] The explanatory materials for the current Bill do not state that a PIA has been conducted or is planned.

Committee consideration

Legal and Constitutional Affairs inquiry—2018 Bill

The 2018 Bill was referred to the Senate Standing Committee on Legal and Constitutional Affairs for inquiry and report. The Committee issued its report on 25 February 2019, with the majority recommending that the Bill be passed.[28] The Committee stated that Bill’s proposed changes:

... are an important measure towards making Australia's visa processing system more efficient, and will help officials to identify criminals, terrorists and other applicants of concern faster than is currently the case.[29]

The Australian Greens issued a dissenting report which recommended that the Bill not be passed. The Greens pointed to concerns about the Bill raised by the Law Council of Australia and the Parliamentary Joint Committee on Human Rights, and questioned the capacity for all people subjected to the legislation to provide fully informed consent to the collection of their biometric data.[30] The Greens also raised concerns that the Bill could operate to discriminate against people based on protected attributes (such as race, sex, religion or national origin), by permitting a
non-disallowable instrument to require collection for specified classes of applicants.[31]

Selection of Bills Committee

On 4 July 2019, the Selection of Bills Committee deferred consideration of the current Bill to its next meeting.[32]

Senate Standing Committee for the Scrutiny of Bills

The Scrutiny of Bills Committee has not reported on the current Bill at the time of writing. In the Committee’s report on the 2018 Bill, it expressed concern that by enabling the Minister to determine by way of non-disallowable legislative instrument, classes of visa applicants subject to biometric collection requirements, the Bill leaves to delegated legislation ‘significant elements of the visa processing framework—including matters that may have significant impacts on individuals’ privacy’.[33] It requested advice from the Minister on the necessity and appropriateness of this. The Committee also sought advice as to the appropriateness of amending the Bill to:

• require that the Minister’s determinations be disallowable and
• include specific consultation obligations prior to the making of a determination, including a requirement to consult with and consider the views of the Privacy Commissioner.[34]

The Minister’s response was included and considered in the Committee’s first report of 2019.[35] The Minister advised that the Bill will not expand or impact the nature or type of personal identifiers that can be required, or the purposes for which they can be collected. The Minister stated that exempting from disallowance instruments made under Part 2 of the Act ‘ensures certainty in visa operational matters for the Department, as well as certainty to visa applicants...’.[36] The Minister further advised that no specific consultations were intended to be undertaken prior to making an instrument, stating that the Privacy Commissioner was consulted prior to section 5A (which defines ‘personal identifiers’ and lists the purposes for which they can be collected) being inserted into the Migration Act.[37]

The Committee noted the Minister’s advice, but reiterated its concern about the appropriateness of leaving significant matters to non-disallowable legislative instruments, and drew its concerns to the attention of Senators.[38]

Policy position of non-government parties/independents

Non-government parties and independents do not appear to have commented on the current Bill at the time of writing. However, Labor Senators were part of the majority of the Legal and Constitutional Affairs Committee which recommended the 2018 Bill be passed. As noted above, the Australian Greens issued a dissenting report opposing that Bill.

Position of major interest groups

There was little commentary on the 2018 Bill from interest groups, with only four submissions (including one from the Department) made to the Senate inquiry. The Legal Services Commission of South Australia expressed its support for the Bill.[39] The Law Council of Australia expressed a number of concerns with the Bill, querying the practicality of and rationale for requiring biometrics to be provided as a criterion for valid application lodgement, rather than as part of the
post-lodgement assessment process.[40] In its submission, the Law Council argued that the proposed changes:

• may place onerous requirements on certain applicants, such as those living in remote,
  poverty-stricken conditions, by requiring them to travel to an Australian Consulate post or similar agency
• in relation to onshore applications, appear to be contrary to the Department’s move towards online applications
• require further clarity regarding the way personal identifiers are to be used in the visa processing framework, and the extent to which applicants will be informed of these processes and have an adequate opportunity to respond
• without adequate parliamentary oversight and consultation requirements for the making of determinations, ‘may cast doubt over the non-discriminatory nature of Australia’s migration programme’.[41]

There does not appear to have been any recent commentary regarding the proposed measures.

Financial implications

The Explanatory Memorandum states the Bill will have a low financial impact.[42]

Statement of Compatibility with Human Rights

As required under Part 3 of the Human Rights (Parliamentary Scrutiny) Act 2011 (Cth), the Government has assessed the Bill’s compatibility with the human rights and freedoms recognised or declared in the international instruments listed in section 3 of that Act. The Government considers that the Bill is compatible.[43]

Parliamentary Joint Committee on Human Rights

The Parliamentary Joint Committee on Human Rights has not commented on the present Bill at the time of writing, but reported on the 2018 Bill on 12 February 2019. The Committee raised questions as to the Bill’s compatibility with the:

• right to privacy
• right to equality and non-discrimination and
• rights of the child.

The Committee sought advice from the Minister as to whether the Bill’s measures are proportionate to its stated objective to ensure the integrity of the visa system and protection of the Australian community.[44] It queried whether the Minister’s power to determine classes of persons who must provide personal identifiers is ‘sufficiently circumscribed and accompanied by adequate safeguards’ and whether safeguards are in place for individuals incapable of understanding and consenting to the collection.[45] The Committee also sought advice as to whether there are safeguards in place to ensure the determination of ‘classes of persons’ is based on reasonable and objective criteria, noting the potential for this to lead to distinctions based on protected attributes.[46]

In regards to the rights of the child, the Committee stated that the:

... collection, use, disclosure and retention of biometric information from children as young as 5 years is a serious intrusion into their privacy. It raises specific concerns that it may not be the least rights restrictive approach to achieving the stated objective.[47]

The Minister provided a response to the Committee on 8 March 2019. [48] He emphasised that the Bill provides adequate safeguards in the collection, use, disclosure and retention of personal identifiers, including through existing statutory requirements that a person be informed in advance of matters such as the reason the personal identifier is required, how the information will be collected and used, and the person’s right to complain to the Australian Information Commissioner about the handling of personal information.[49]

In regards to minors and individuals incapable of understanding and consenting to the collection of biometric information, the Minister stated:

In practice, individuals incapable of understanding and consenting to the collection of personal identifiers are also incapable of making a visa application themselves. Instead, these people have a visa application made on their behalf by their legal guardian... Hence, it is the legal guardian of a person incapable of understanding and consenting to the collection of personal identifiers, who will understand the information provided prior to collection of personal identifiers (including how personal identifiers are obtained from minors and incapable persons), who gives consent of the incapable person.[50]

On the issue of the Bill’s compatibility with the right to equality and non-discrimination, the Minister noted that decisions on which cohorts will be included in the Minister’s determination:

...will be determined on an objective basis, namely, in line with operational priorities, intelligence, identifiable fraud risks and other factors informed by objective information such as the Department’s collection and analysis of statistics and intelligence information.[51]

In response, the Committee acknowledged the importance of the safeguards identified by the Minister, but nonetheless stated the Minister’s response ‘does not fully address the concern raised in the initial analysis that the power under proposed section 46(2B) may be overly broad with respect to its stated objective’.[52] In concluding its examination, the Committee found that the broad scope of the proposed power raises the potential for it to be used in such ways that may risk being incompatible with the right to privacy, right to equality and non-discrimination, and the rights of the child. However, it also noted that ‘setting out criteria for the exercise of this power by legislative instrument may be capable of addressing some of these concerns’.[53]

Key issues and provisions

In his second reading speech for the Bill, Minister for Immigration, Citizenship, Migrant Services and Multicultural Affairs, David Coleman stated the Bill is aimed at ‘streamlining ... the process by which personal identifiers are required and provided at the time of a person applying for a visa’ and argued:

It's important that identity checks are able to be done against personal identifier data to detect individuals of concern as soon as they make a visa application. Personal identifiers are far superior to checks undertaken using biographic details such as name and date of birth that are contained in identity documents.[54]

The Explanatory Memorandum states that obtaining personal identifiers up front in the application process ‘promotes early detection and assessment of critical information’.[55]

Minister’s determination

Existing section 46 of the Act sets out the requirements for making a valid visa application. Subsection 46(2A) currently provides an application will be invalid if the applicant has been required to provide personal identifiers under section 257A and has not complied with the requirement, unless the Minister has waived the operation of this provision. If a visa application is invalid, it cannot be considered.[56]

Item 1 of the Bill repeals this existing subsection and substitutes proposed subsections 46(2A) to (2D). Proposed subsection 46(2B) provides that the Minister may determine, by way of a
non-disallowable legislative instrument,[57] that visa applicants in a specified class must provide one or more specified types of personal identifiers in one or more specified ways. The Explanatory Memorandum states that the way in which groups of applicants will be specified is ‘highly flexible’, and could include the circumstances of the applicants (such as their country of residence) or the class of visa being applied for, ‘or a combination of different factors such as these’.[58] It further notes:

The flexibility about what classes of applicants ... can be required to provide a personal identifier will enable the Department to collect personal identifiers from specific cohorts in response to emergent risks based on specified circumstances, recent events, and detected or realised threats.[59]

Proposed subsection 46(2C) provides some indication of the broad scope of proposed subsection 46(2B), by stating non-exhaustively that the Minister’s determination may specify: a class of visa applicants ‘in any way’; different types of personal identifiers to be provided by different classes of applicants; or the way in which a personal identifier must be provided, including by way of identification tests carried out by an authorised officer or authorised system.

Under proposed subsection 46(2A), a visa application will be invalid if the applicant falls in a class of applicants specified by the Minister’s determination under proposed subsection 46(2B) but does not comply with the requirement to provide personal identifiers as specified in the determination.

Proposed subsection 46(2D) states that an application will be taken to have complied with the requirement to provide personal identifiers of a specified type if the applicant is in immigration detention, and during the detention has provided a personal identifier of that type as required under the Act.

Absence of an exemption/waiver provision

There is scope under existing provisions in the Act for exemptions to be granted to the requirement to provide personal identifiers under section 257A—this is not the case in regards to the determination power proposed by the Bill. Section 258 states that the Minister may determine, by way of legislative instrument, a specified person or class of persons who must not be required to provide personal identifiers under section 257A.[60] Furthermore, existing subsection 46(2A)—repealed by the Bill—allows the Minister to waive a requirement to provide biometric data in connection with a person’s visa application. The Department’s current exemption policy captures persons such as sovereigns, heads of State, Government Ministers, diplomats and their families, as well as Special Purpose Visa (SPV) holders (such as members of airline crew and transit passengers).[61] The following persons are subject to a partial exemption and may not be required to provide fingerprint scans:

• minors under five
• ‘incapable persons’, defined under the Act as persons incapable of understanding the general nature and effect of, and purposes of, a requirement to provide a personal identifier[62] and
• physically incapacitated persons who may not be able to provide some or all fingerprints.
• There is also a general discretion to exempt a person from the requirement to provide biometrics in exceptional circumstances. The Department’s policy guidance suggests this is limited to:
• emergency or compassionate situations (including where the applicant needs to travel urgently to visit a family member with a serious life threatening illness) or
• where there is ‘compelling national interest’ (such as where Australia’s trade or business opportunities, or relationship with a foreign government, would be adversely affected if the person is not granted the visa).[63]

In contrast, the provisions in the current Bill do not provide for similar exemptions or waivers—if a person is captured by a determination by the Minister under proposed subsection 46(2B), there does not appear to be a mechanism by which they can be exempted from complying. This has the potential to operate harshly for certain applicants, such as those who, for example, may need to travel to Australia urgently in compassionate circumstances but who live a long way from a biometrics collection centre in their country. However, in his second reading speech, Minister Coleman stated that ‘it is not intended that the requirement to provide Personal Identifiers as an application validity requirement apply to short stay visas used in emergency situations’.[64]

The Statement of Compatibility states that the policy intention is that the Minister’s determination will impose the following requirements on children applying for a General Skilled Migration visa (as dependants on the parents’ main application):

• children aged up to four years will need to provide a photograph and
• children aged at least five years will need to provide a photograph and fingerprints if resident in a specified country where personal identifier collection is available.[65]

This appears consistent with DOHA’s existing exemptions policy. However, the Statement of Compatibility also indicates that requirements for the collection of personal identifiers will extend to ‘incapable persons’, and states:

...these persons will have had an application made on their behalf by their legal guardian. Their legal guardian will also need to make arrangements to have the incapable person’s personal identifiers collected.[66]

Proposed subparagraph 46(2C)(c)(ii) provides that the Minister’s determination may specify that a type of personal identifier be provided in a way other than through an identification test or an authorised system. The Explanatory Memorandum states that this recognises:

There are circumstances where it is not practical or efficient for personal identifiers to be provided by way of an identification test carried out by an authorised officer or authorised system.[67]

It is not clear whether this could be used to accommodate applicants who, due to emergency or compassionate circumstances, may be unable to attend an AVAC or ABCC. The Department’s policy guidance provides that offshore visa applicants can currently be required to provide personal identifiers:

Consequential and application provisions

Items 2 to 7 make consequential amendments to existing provisions of the Act which deal with the collection of personal identifiers. The effect of this is that certain requirements that currently apply to the collection of biometric data under section 257A, will also apply to collection pursuant to proposed subsection 46(2B). This includes requirements that:

• authorised officers carrying out identification tests inform the person of any prescribed matters[69]
• the collection of personal identifiers be done in circumstances affording reasonable privacy to the person and not involving the removal of more clothing than necessary, or more visual inspection than necessary for carrying out the test[70]
• a person not be required to provide personal identifiers in a cruel, inhuman or degrading way, or in way that fails to treat them with humanity and with respect for human dignity.[71]

Item 8 is an application provision which states the Bill’s amendments will apply in relation to visa applications made on or after commencement.

Concluding comments

The Bill strengthens the legislative basis for collecting personal identifiers from visa applicants at the time of application. Due to the broad collection powers which already exist under the Act, it is unlikely to significantly expand the circumstances in which such information can be collected. As a matter of practice biometric data is already collected from certain classes of offshore visa applicants at the time of lodging their application.

However, the Bill does not appear to contain scope for discretionary exemptions which exist in relation to the existing collection powers. It is not clear from the explanatory materials why such an exemption provision has not been included.