Biometrics Code
Summary of Meeting

Wed, 21 Apr 2010 15:00

Chris Connolly and Julie Cameron met with OPC staff today regarding the Biometrics Code of Conduct.

We went through all of our concerns very carefully, noting that biometrics is a high priority, sensitive privacy issue, and conveying our alarm that the OPC doesn't appear to see any problems with the Code.

To summarise our main points:

- The Code is only signed by 5 organisations and 3 of them are consultants
- The Code is used to portray Biometrics Institute members as privacy positive and best practice, but virtually no members are bound by the code provisions
- None of the code subscribers acknowledges that they are bound by the Code in their websites or privacy policies
- No PIAs are being conducted in the biometrics industry prior to implementations
- None of the major biometrics implementations (night clubs, airports, driver licences) are covered by the Code
- The independent review (a requirement of the OPC guidelines and the code itself) was a sham, as the independent chair was actually a code subscriber, all the review committee members were code subscribers and/or institute members, and there were no consumer reps
- The Code review failed to identify a single problem with the Code or make any recommendations for improvement, despite the obvious flaws
- Overall the code does more harm than good for privacy protection

The OPC staff (Timothy Pilgrim and Andrew Solomon) indicated that they were in further discussions with the Biometrics Institute regarding the independence of the Code review. This may take 2-3 weeks.

We indicated that this issue now has consequences, namely:

- It potentially sets a precedent that a regulator would approve a code despite no take-up
- It potentially sets a precedent that a regulator would approve an independent review that excluded consumers and was riddled with conflicts
- The episode has "damaged confidence in the Privacy Commissioner" (my exact words)

We also indicated that we were considering launching a full campaign on this issue, including:

- Another formal letter to OPC asking them to suspend the Code registration until an independent review is completed, and asking them for a specific response on what criteria they use to register codes (regarding take-up and independent review)

- A joint letter from APF and a couple of peak consumer organisations to   the Minister (Ludwig), the consumer affairs minister, the ACCC, ASIC and ACMA making it clear and on the record that we believe this approval is wrong and should not set a precedent, noting that this has broad implications for the entire co-regulation process across all sectors, and asking each of them to send us their criteria for 'independent' review.

- Public statements on our web site and maybe on the web sites of other consumer organisations

- An open letter to every member of the Biometrics institute outlining the main issues and questioning the integrity and viability of the Code

We were left with the impression that they were about to discuss some of these issues with the Biometrics Institute, but they didn't want to raise any expectations. Timothy will convey our concerns to Karen.