Nomination for the Australian Privacy Foundation ‘Big Brother Awards’ 2011
BBA2011 FINALIST

Criteria for a BBA2011 Award
The purpose of these Awards is to publicise privacy-abusive behaviour.  A responsible approach is adopted.  
As appropriate for the particular Award Category the nominee should be a public or private sector individual or organization, a government program or initiative, or a private sector business activity:
•	in or associated with Australia
•	responsible for a truly outstanding abuse (or defence) of privacy.
For a nominee to be considered, they need to be identified, their acts or behaviours that warrant an Award need to be briefly described, and some evidence needs to be provided, preferably both some originating with the nominee itself, and some from other sources such as the media. The deed for which they are nominated should have at least partially been put into practice – they lose points for just planning or announcing something!  Further details about BBA2010-11 are available at http://www.privacy.org.au/bba/.

A.  Name of Nominee 

Biometrics Institute

B.   Award Category: Privacy Abuser Categories for an “Orwell” Award -

Worst Corporate Invader – for a corporation that has shown a blatant disregard for privacy.

C.  Description
Award is for ongoing misleading and deceptive conduct in relation to its Privacy Code

The Biometrics Institute Privacy Code is heavily promoted by the biometrics industry as a positive form of privacy protection and as a significant achievement of the Biometrics Institute. In reality, after four years of operation, the Code has only four subscribers (out of a base of 110 members). When the details of the four subscribers are examined, it becomes clear that the Code has no support from major biometrics vendors or users. In addition, none of the subscribers provides a link or any information about the Code on their websites or in their privacy policies, and only one organisation even mentions the Code.

Two of the signatories are consultants. It is difficult to see how the provisions of the Code have any relevance to consultants, as they will not collect or use personal information. Key Code provisions such as access rights and audit requirements appear completely irrelevant to consultants.

Two of the signatories are vendors. However, these vendors are not large or significant organisations. The Biometrics Institute membership list includes major vendors such as IBM and UNISYS who have not signed the Code.

Overall, a subscription rate of 4 out of 110 (including two consultants) is an embarrassing level of support for a Code that has been in place and heavily promoted since July 2006. This level of support reveals the true nature of the Code. It is a token form of privacy protection that provides positive PR for the biometrics industry, without providing any additional requirements for the real providers and users of biometrics in Australia.

The Code was registered by the Office of the Privacy Commissioner (now the Office of the Australian Information Commissioner) in July 2006 (effective from 1 September 2006). The Biometrics Institute constantly draws attention to the OPC approval and highlights this as a significant achievement for the Institute. 

None of this promotion of the Code and promotion of the OPC's approval mentions that the Code has virtually no subscribers. The Biometrics industry is using the name of the Office of the Privacy Commissioner to promote the sale and distribution of biometrics technology in Australia, without any evidence that the Code provides any additional privacy protection for the bulk of biometrics implementations beyond the default requirements of the Privacy Act.
The Code also requires an independent review to be conducted every three years. The Biometrics Institute Privacy Code includes a review process, which includes the establishment of an Independent Code Review Panel, comprising:
1. An independent chairperson; and
2. An equal number of consumer and industry representatives which the Biometrics Institute Board may from time to time nominate.

In fact, the Independent Code Review Panel for the first review consisted entirely of members of the Biometrics Institute. The supposedly independent Chair was in fact a Code subscriber. The composition of the Panel bears absolutely no resemblance to the requirements for the establishment of an Independent Code Review Panel as set out in the Code. 

It is important to note that privacy and consumer advocacy groups have declined to give any legitimacy to the Code by engaging in consultations with the Biometrics Institute regarding Code content (for example, code reviews). Until the industry shows a substantial degree of commitment to the Code (e.g. through a majority of large members signing the Code) the privacy and consumer advocacy community has no plans to re-engage with the Biometrics Institute on this issue.

Biometrics continue to be on of the most high profile forms of privacy intrusion – yet the Institute has not taken any serious steps to manage privacy issues. The Code is a sham.

D.  Evidence of the Actions and References
The Code: http://www.biometricsinstitute.org/displaycommon.cfm?an=1&subarticlenbr=8 
Code subscribers: http://www.biometricsinstitute.org/displaycommon.cfm?an=1&subarticlenbr=80 
Australian Privacy Foundation complaint to the Privacy Commissioner regarding the Code (2009):
http://www.privacy.org.au/Papers/BioCode-OFPC-091203.pdf 

E.  Why the Nominee Deserves the Award:
Scope
The development and promotion of the Biometrics Institute Privacy Code has a negative impact on privacy protection for all citizens who may come into contact with biometrics. Biometrics are increasingly common in night-clubs, passports, border entry, driver registration and the workplace. 

Seriousness
The Code gives the impression that some form of protection is in place (additional to the Privacy Act) when in fact the Code has absolutely no membership or support. Further, the sham “independent review” of the Code brings the entire co-regulatory approach to privacy into disrepute.

F. Other Comments (including Nominee Response)

This nomination form was emailed to the nominee on 18 March for comment by 8 April 2011. No response was received by the Coordinator of BBA2011 by 9 April 2011.

This nomination also raises serious questions about the competency of the Office of the Australian Information Commissioner, who have refused to take any steps to de-register or improve the Code, despite the lack of membership and the absence of an independent review.