The Law Council of Australia has called for a bill that will increase the powers of the immigration department to collect biometric identifiers to not be passed before an assessment by the privacy commissioner of its impact.
Representatives of the Law Council appeared yesterday before a Senate inquiry into the Migration Amendment (Strengthening Biometrics Integrity) Bill 2015.
In addition to measures to combine separate personal identifier collection powers into a broader discretionary power, the bill provides what its explanatory memorandum describes as "flexibility" on the types of biometric identifiers that can be collected, allowing through regulation the expansion of types that can be collected, and the circumstances in which they are collected.
The bill also includes measures that will enable biometric identifiers to be collected from people, such as minors or disabled persons who are incapable of giving consent, without getting the consent of a parent, guardian or independent person.
"The bill will expand the powers of collection for personal information including sensitive biometric data for both Australian citizens and non-citizens," the chair of the Law Council's Privacy Law Committee, Olga Ganopolsky, told a Sydney hearing of the Senate inquiry.
The inquiry is being conducted by the Senate Legal and Constitutional Affairs Legislation Committee.
"Notably the bill will enable the collection of biometrics such as fingerprints or iris scans from all Australian citizens who are travelling or returning from overseas," Ganopolsky said.
"As currently drafted, the bill will enable the Department of Immigration to seek policy approval for and introduce a regulation for the collection of a wide range of other identifiers, such as a sample of blood by finger prick or [the] taking of a sample of saliva, for a wide range of purposes."
"This has the potential to impact on the travel and privacy of citizens who might not be suspected of contravening any Australian law or pose a risk to national security," Ganopolsky said.
The Law Council's written submission (PDF) to the inquiry argues that "the power to prescribe both a purpose for which personal identifiers may be collected and the collection of biometric data via regulation raises the potential for the scheme to go beyond the initial intention of the Bill and the Migration Act, without adequate parliamentary scrutiny."
"Permitting the purposes and collection of biometric data to be increased by regulation is not sufficiently defined to allow people to know the extent of the restrictions on their rights and freedoms and for them to know their legal," it states.
The Law Council has made suggestions for a range of changes to the bill.
In addition to the bill not being passed "until Parliament and the Australian community have the opportunity to consider the results of a privacy impact statement on the Bill conducted by the Privacy Commissioner," the organisation's submission argues that there should be amendments to "provide for additional security measures reflecting the sensitivity of the information collected and expressly address the requirement to notify the individual and Privacy Commissioner for data breach notification in the event of a breach".
The bill should also set out the purposes for which biometric personal identifiers are collected and the types that can be collected.
"[W]hile a range of personal identifiers may be required, the highly personal nature of such data should not be underestimated and its collection, use, retention and disclosure ought to be tightly controlled," Ganopolsky said yesterday.
"The bill should be amended so that one or more personal identifiers can only be required from an individual where the minister or the Department of Immigration and Border Protection officer reasonably believes that the person has or will potentially breach an Australian law or the individual may pose a threat to national security," Ganopolsky said.
The Law Council believes there needs to be a review of the powers of the privacy commission to deal with matters involving 'bodily privacy' as well as information privacy.
The review should consider establishing a new office holder to oversee biometric privacy. Ganopolsky pointed to the example of the independent Biometrics Commissioner in the UK.
The inquiry is due to table its report on 12 May.