G.P.O. Box 1196
Sydney NSW 2001

enquiries@privacy.org.au

http://www.privacy.org.au/	

14 April 2005

Mr R. Nash
Assistant Secretary
Passports Branch
Department of Foreign Affairs & Trade
R G Casey Building, Barton ACT 0221

Dear Mr Nash

Thank you for your letter of 8 April 2005, replying to our communications of 28 February, 11 March and 17 March.  Although your repeated invitation to discuss the matter is welcome, it is not supported by the information necessary to make such a discussion meaningful.

I attach extracts from several of the previous letters sent to you, explaining our position, and identifying the information that is necessary in order for us to provide you with a considered opinion.  All that we have been provided with is two versions of a brief Background Paper, and they did not contain answers to our questions.

We do not accept that verbal briefings are an appropriate means of conveying complex information.  Verbal statements are capable of many interpretations, and are recorded differently by the various participants in the event.  We have on several occasions ‘played back’ what we believed had been said, and requested confirmation;  but you have not answered those requests.

The Board members of the Foundation have substantial experience in consultative processes with many agencies at both Commonwealth and State level.  There are well-established process norms, including a comprehensive impact assessment project, the provision of information in advance of meetings, and the respecting of confidences.  A process of the kind that you have pursued in relation to this matter does not support meaningful consultation, and consequently denies you and your Minister important information about public interest perspectives on your proposals.

We state once again that we are willing to participate in further meetings, but not until a suitable time after information is provided to us about what the proposal is, what the justification for it is, how it will achieve the purposes, and what privacy impact analysis has been performed.

Yours sincerely

Roger Clarke
Board Member, Australian Privacy Foundation

Contact Details for the APF and its Board Members are at:
http://www.privacy.org.au/About/Contacts.html

Previous Communications on This Matter

In our original submission, on 17 February 2004, we stated as follows:

2.	There is a particular danger that a passport with biometrics, if it was promoted (or allowed) by government to become a more common identifier, could develop into a de facto Australia Card. The additional costs of any biometrics will tempt governments toward 'function creep' as a way of justifying these costs. The Background Paper does not yet give sufficient details of how the legislation will specifically limit the purposes for which a passport may be requested or required as an identifier. The Act should exhaustively define these circumstances, and limit them very narrowly.

7.	It is vital that there be an independent Privacy Impact Assessment of any proposed biometric identification technologies, and implementation schemes, prior to Parliamentary approval being sought.

19.	The privacy framework of the Act should also involve among other things: (i) independent and public Privacy Impact Assessments (or public hearings by the Privacy Commissioner) prior to significant technological changes and new uses and (ii) Parliamentary approval of any such changes”.

22.	The Background Paper contains too few details of the legislative proposals to allow meaningful submissions by interested parties. The exercise of calling for submissions will be a sham if these three pages (and a two page FAQ) are the only information to which parties can react. The web address provided in the Background Paper does not provide any further information to justify the governmentís proposals. We insist that the supporting information should contain something close to draft instructions to Parliamentary Counsel, to allow meaningful submissions, and nothing resembling this is provided at present. 

In our next letter, of 25 February 2004, we stated that we “understand that Adrian is to provide us with the following, in written form:
-	the timetable or "document with milestones"
-	detail about the planned use of biometrics, including technical specifications
-	measures of the problems that are being addressed”.

Further, we stated that “In order for the biometrics aspects of the proposal to be discussed in a meaningful manner, the following information is needed
-	a clear statement of what the proposition is, in sufficient detail to enable analysis. Bob's presentation is a start, but a formal, much more detailed, and written description is needed;
-	an evaluation of the technology. Reference had been made to research already undertaken. We need documentation of that research that we can review, because this is not the kind of thing that can be chatted about in a meeting;
-	evidence that the proposed application of the technology will work. This is especially important given that there is plenty of evidence that it will *not* work;
-	disclosure of the outcomes of the impact assessment that must surely have been performed before a Bill goes before Parliament.

“This information is a condition precedent to a meaningful consultative process in relation to the biometric proposal”.

We also asked for a number of specific items of information.  The requested information has not been provided.

In our letter of 15 March 2004, we stated that “we understand that the new statute may incorporate a broad authorisation for the imposition on all Australians of an intrusive biometric scheme, dependent on new and untried technologies, using an as-yet undescribed system, with as-yet unknown safeguards”;  but “The information provided to date is insufficient for us, or any other interested party, to make an informed assessment of the proposals”.

We also noted that “several specific items of information promised at the meeting on 23 February have not been provided.  In our letter of 25 February, we requested a number of additional and specific items of information, which arose from the information provided during the meeting. We have yet to receive any of this information or even an acknowledgement”.

We concluded that “Because of the serious deficiencies in the information provided by the Department, the Foundation has been prevented from making a substantive submission. We once again draw attention to the general views we provided in our first submission, and to the additional perspectives that we offered and requests that we made during and after the meeting”.

In our letter of 31 May 2004, we stated “Bob Nash mentioned that the ICAO meeting in Montreal later in May will progress specifications eg for interoperability, encryption, PKI key management and reading technology.  We would appreciate a written briefing on the outcome of that meeting”.  We have never received this information.

We also noted that “You have [verbally] committed to a separate consultation, and Privacy Impact Assessment (PIA), before introducing a biometric, but it is not clear if this means before the trial/pilot or just before any decision on wider adoption.  Please clarify your intentions”.  We have received no further information on this matter.

We also asked “you claim that photo-biometric will at least make it more difficult for criminals to have more than one false ID.  Is this a fair representation of your position?”.  No response has been received.

We asked “It was noted that the Biometrics Institute Privacy Code would be submitted to the Privacy Commissioner soon.  Can you tell us if DFAT would be likely to adopt this Code if it is approved?”.  No response has been received.

We asked “It remains unclear if any ‘new’ information (other than the photo-biometric template) would go on the chip (compared to what is currently included in the magnetic stripe/bar code). Please clarify your intentions”.  No response has been received.

We wrote that “we understood Qantas to be saying that they can’t see how they can do what is expected of them in advance passenger processing without direct ‘read’ access to the chip.  The banks (and others) may also see a requirement  (both to satisfy government mandated identity checks and for their own purposes?).  Please clarify your position on this key issue”.  No response has been received.

The letter further stated that “Charles Britton and I challenged these assertions, specifically the SIRCA report estimates of the cost of ID fraud, and argued for ‘proportionality’ principle.  You appear to accepted this ‘in principle’.  Please confirm”.  No response has been received.

We asked for confirmation of figures on passports.  No data has been received.

We drew attention to a number of significant problems with the revised Background Paper.  No responses to these comments have been received.