Information Commissioner Prof John McMillan has agreed to highlight the risks surrounding biometric technology to both government and the private sector in future. His positive response follows a campaign by Civil Liberties Australia, the Australian Privacy Foundation and others over many months to raise appropriate awareness among those choosing security systems.
Information boss commits to biometric guidance
To:
Dr Kristine Klugman, Chair, Civil Liberties Australia
Dr Roger Clarke, Chair, Australian Privacy Foundation
Cameron Murphy, Chair, NSW Council for Civil Liberties
Spencer Zifcak, Chair, Liberty Victoria
Michael Cope, Chair, Queensland Council for Civil Liberties
Via email:
Re: guidance on the use of biometric technology
Thank you for your letter to Timothy Pilgrim, Australian Privacy Commissioner, of 19 October 2011, regarding your suggestion that my office publish guidance on the use of biometric technology. Since receiving your letter my office has been reviewing its resources and requests for producing guidance more generally.
I acknowledge that there is an increasing use of biometric technology across both government and private industry in Australia. While there are clear benefits to be gained from the use of this technology in the context of security and identity management, there is a corresponding set of risks that need to be managed and managed well.
Regarding the development of guidance, my office has a significant number of commitments arising from areas such as the government’s ongoing privacy reform agenda. The Australian Law Reform Commission Report 108 For Your Information: Australian Privacy Law and Practice, makes recommendations under 74 headings, most of which contain multiple recommendations. The report makes many recommendations regarding my office providing guidance or undertaking research.
My office has developed a prioritised listing of the guidance to be developed in response to recommendations made by the ALRC, the Australian Government and various parliamentary committees. My office is not in a position to develop dedicated guidance in relation to the use of biometrics in the near term. We will review the prioritised list on a periodic basis and revise the relative priorities as appropriate.
Separately from the question of developing guidance I see significant value in raising awareness of the privacy risks associated with biometric technology. I advise that my office will continue to integrate key messages about the appropriate management of privacy in relation to biometrics where opportunities arise in our interaction with government and private industry.
For your reference, these key messages include:
- considering whether biometric technology is the most appropriate solution and whether the same outcome could be achieved by using less intrusive methods
- conducting a comprehensive Privacy Impact Assessment (PIA), including, as a matter of best practice, broad stakeholder consultation and publication of the PIA
- ensuring that biometric information is appropriately secured.
In addition to providing advice to government and private industry about privacy
protection, my office also has a role in promoting privacy awareness in the broader
community. In this context my office will also continue to deliver messages to the
Australian public about:
- querying why personal information is being collected and what it will be used for
- considering whether it is necessary to provide personal information
- accessing their personal information and correcting it if necessary
- understanding where they can go for more information on their privacy rights, or to make a complaint.
Thank you for raising this important issue with my office.
Yours sincerely
Prof. John McMillan
22 December 2011
(Prof McMillan is the Australian Information Commissioner, boss of the Privacy Commissioner who was apparently on leave when this letter was sent)
NOTE: Original letter to the Privacy Commissioner, on 15 October 2011: