Note: Where available, the PDF/Word icon below is provided to view the complete and fully formatted document
STANDING COMMITTEE ON LEGAL AND CONSTITUTIONAL AFFAIRS
01/03/2007
AusCheck Bill 2007

CHAIR —Welcome. DOTARS has lodged a submission with the committee, which we have numbered 13, and the Attorney-General’s Department has lodged two submissions, which we have numbered 15 and 15A. Do you need to make any amendments or alterations to those submissions?

Ms Kelly —No.

Ms Johnson —No.

CHAIR —I remind senators that the Senate has resolved that an officer of a department of the Commonwealth shall not be asked to give opinions on matters of policy and shall be given a reasonable opportunity to refer questions asked of the officer to superior officers or to a minister. This resolution prohibits only questions which ask for opinions on matters of policy and does not preclude questions asking for explanations of policies or factual questions about when and how policies were adopted.

Officers of the departments are also reminded that any claim that it would be contrary to the public interest to answer a question is one which must be made by a minister and should be accompanied by a statement setting out the basis for the claim.

I invite you to make brief opening statements, if that is your inclination. At the conclusion of those, we will go to questions from members of the committee.

Ms Kelly —There is no opening statement from the Attorney-General’s Department.

CHAIR —DOTARS?

Ms Johnson —Yes, we have an opening statement. The Department of Transport and Regional Services is fully supportive of the AusCheck Bill and the establishment of AusCheck as a central vetting agency within the Attorney-General’s Department. The establishment of AusCheck is a key component of the government’s transport security framework and responds to the strong public concern about criminal activity in Australian airports and ports. Further, it is consistent with the recommendations from the report of Sir John Wheeler on airport security and policing arrangements for background checking processes for aviation security identification cards to be further strengthened and centralised in the Attorney-General’s Department.

The rapid expansion of the ASIC regime and its distributed administration by some 190 issuing authorities increase the risk of a card being issued to an ineligible person. As an interim measure, a background checking unit was established in the department to process background checks for the maritime identification card and, in March 2006, the responsibility of the BCU was expanded to include background checks for ASICs. Prior to March 2006, the background checks were the responsibility of the various ASIC issuing bodies. AusCheck will facilitate verification of proof of identity documents in the future, provide an opportunity to develop appropriate and consistent technological solutions for data checking to overcome problems with the current system, allow a single national database to be maintained on all applicants and cardholders and improve the ability of government to respond to security alerts involving an individual in the industry. Establishing AusCheck will help to ensure a nationally consistent approach for conducting security checks and assist in maintaining public and industry confidence in background checking.

AusCheck will coordinate and perform criminal history checks, ASIO checks, document verification checks and Department of Immigration and Citizenship work rights and citizenship checks. All interfaces with AusCheck’s checking partners, such as the AFP, CrimTrac, ASIO and the Department of Immigration and Citizenship will be electronic. This will lead to a speedier turnaround on the majority of applications and, once operational from 1 July 2007, it is intended that AusCheck will operate on a cost recovery basis.

Comments made during the second reading of the AusCheck bill made reference to lost and stolen ASICs. The Attorney-General advised that:

... the commencement of AusCheck and its centralisation of background checking should improve the ability to monitor cards.

It should be noted that the ASIC has significant security features and has not been successfully counterfeited since it introduction in 1986. The security features would make it extremely difficult for a person other than the holder to use it.

I would like to add that the ASICs do not confer access rights to secure areas of airports. Access to secure areas of airports remains at the discretion of the airport operator, according to the individual airport’s transport security program. ASIC holders do not have automatic right of entry to these areas; rather, the ASIC is only evidence that a holder has met certain eligibility criteria. While even one missing ASIC is of concern, it should be noted that the unaccounted for ASICs represent only a small percentage of the total ASIC pool.

It is important to note that DOTARS will continue to be responsible for the regulatory framework governing the management of the ASICs and MSICs. That is, DOTARS will be responsible for aviation and maritime security identity policy, including the management of future changes to the eligibility criteria, security features in the card and proof of identity requirements and industry performance against regulatory requirements. DOTARS will continue to consult with industry on future changes to the ASIC regime and DOTARS will work closely with AusCheck on policy issues associated with the processing of ASICs and MSICs.

CHAIR —Thank you, Ms Johnson. We will go to questions.

Senator LUDWIG —You have probably been asked this a million times, but I thought I would just check again. What is the total number of ASIC cards and MSIC cards that have been issued to date?

Ms Johnson —The total number of ASIC cards is 92,606 and I will get Mr Kilner to respond to the MSIC card number.

Mr Kilner —There have been 79,000 applications for MSICs and at this time 72,000 cards have been issued.

Senator LUDWIG —How long does it take for an MSIC card to be processed and issued?

Mr Kilner —That depends on whether or not the individual has a criminal history. In most cases where there is no record of a criminal history, the turnaround time can be about a week for the background check. It can take another week or two, depending on the issuing body, to produce and distribute the card. In general, we advise applicants and industry that they should allow about six weeks for the full process to take place.

For those people who have a criminal history, we are then relying on the state and territory jurisdictions to provide the necessary criminal history to the AFP so that the AFP can collate that criminal history. Therefore, those checks can take longer, depending of course on the number of jurisdictions involved and the particular record keeping used by those jurisdictions—whether it is electronic or other.

Senator LUDWIG —Could you take it on notice—unless you have already answered this somewhere else, in which case you can provide it to the committee a lot earlier—to provide the length of time the 7,000-odd that are still in the system have been in the system by month and number, so that the committee has an understanding of how old or how new, as the case may be, some of these applications are. Can you also tell us how many have been refused as well? That would be the same for ASIC. I think the tail has certainly shrunk, if my memory serves me correctly, but if you would not mind providing the same information of those that are currently in the system and awaiting approval or at least sending out by post or however you do it.

Mr Kilner —I can answer your second question straight away, but by month and by number will take some time. With regard to maritime security identity cards, as at 27 February a total of 46 applicants have been considered ineligible to be issued a maritime security identity card on the grounds that they have been convicted of a maritime security related offence. The majority of these have been drug related. Of those 46 applicants, 21 are still ineligible, not having applied to the secretary of DOTARS for review; 22 have been approved following application to the secretary for a review; and three have been approved after initially being refused—these applicants were approved after appealing to the secretary under regulation 608X of the maritime transport and offshore facilities security regulations.

Senator LUDWIG —The ASIC and MSIC cards which are currently or have been appealed to the AAT or other court process, if there are only a few of them, you can perhaps give me the case number or the name; but if there is none then obviously there is a zero return. I am happy for you to take that on notice for both MSIC and ASIC.

Mr Kilner —Zero for MSICs.

Ms Johnson —For ASICs there have been two appeals that were upheld and two that were withdrawn.

Senator LUDWIG —And the names of those?

Ms Johnson —I do not have them.

Senator LUDWIG —I would ask you to take that on notice, if it is available and depending on whether it is on the public record. This scheme will be operational by 1 July; is that the idea?

Ms Kelly —The scheme is currently operational, but AusCheck will be discharging its functions under the scheme from 1 July.

Senator LUDWIG —Does AusCheck develop a new database from that date or do they take over an existing database by DOTARS?

Ms Kelly —The bill provides for us to migrate the existing data onto the AusCheck database. We are still working through the details of how that might occur because the data has never been kept centrally before, so there are some significant data cleansing issues. Also there is some additional data being collected under the process from 1 July that obviously has not been part of the previous system. But the bill expressly authorises us to take historical data, because one of the key values of the central database will be to know at all times who has access to secure areas of air and seaports. So, if we do not have that historical data, the database will be of limited value until we have done a full renewal cycle, which will be five years.

Senator LUDWIG —Is the database up and running, or is it on track to be up and running by 1 July?

Ms Kelly —It is still being constructed, but it is on track to be up and running by 1 July.

Senator LUDWIG —What is the total cost of the database?

Ms Kelly —It is in the vicinity of $6 million, when you take into account the range of contractors, the hardware and the specific application development.

Senator LUDWIG —What sort of information will be held? It will not be a document verification service from 1 July, will it?

Ms Kelly —The document verification service certainly will not be available from 1 July. It is our understanding that it will be available some time in the next year, but we are obviously in the hands of the document verification service people on that issue. It is probably unlikely that we will have it on 1 July or indeed before the completion of the first year of operation.

Senator LUDWIG —The second reading speech said the government also decided that AusCheck will use the proposed national documentation verification service to assist in determining the bona fides of applicants. Can you tell me the date from which that will happen?

Ms Kelly —We are in the hands of the document verification service people in relation to that and we understand that it will be some time next year at the earliest.

Senator LUDWIG —2008.

Ms Kelly —And that would not be a full documentation verification service. As I think was established in estimates, the full documentation verification service will not be fully operational until 2010.

Senator LUDWIG —That was my recollection too. In any event, it will not be the sole means by which you will obtain information; that is not the design?

Ms Kelly —No, and the obligation to verify identity remains with the issuing bodies. They sight the identity and go through their own processes of authentication of the identity, and that obligation remains with them. When the document verification service becomes available either partially or completely, that will be an enhancement to that process in the sense that there will be an additional process to check whether the proof of identity material that they sight is validly issued identity documentation. But the issuing body will retain the responsibility to verify identity.

Senator LUDWIG —In terms of how the information will be stored, it seems that a lot of that will be by regulation in terms of the type. This is, as I understand it, a framework legislation. When will the regulations be available?

Ms Kelly —We are in the hands of the office of legislative drafting. We have provided some preliminary drafting instructions. Obviously the form of the bill will determine the outcome of those regulations as well, but as yet we do not have a draft from the office of legislative drafting.

Senator LUDWIG —Is there a timetable to obtain a draft?

Ms Kelly —They provide an indicative timetable of eight weeks from the time of delivery of instructions. On that timetable, I think we have approximately another month to go.

Senator LUDWIG —When they are available, can you make those available to the committee, or is there a reason that you could not make a draft available to the committee?

Ms Kelly —I am not aware of any reason. We will certainly be consulting fully with our stakeholders on the development of those regulations. The content of these schemes is already fully set out under the DOTARS regulations, under the aviation and maritime acts. Our regulations will merely set out the application information and also how we relate to the individual applicant in our component of the process. So the full details of the scheme will still remain under the maritime and aviation transport security legislation regulations.

Senator LUDWIG —What information—hard documentation—will the Attorney-General’s Department keep under this scheme?

Ms Kelly —To whom?

Senator LUDWIG —Of the person who is being checked. You will have a database, but will you keep any hard data, any paper data?

Ms Kelly —No, it will be an entirely electronic system.

Senator LUDWIG —So that primary information will be held by either DOTARS or—

Ms Kelly —What do you mean by ‘primary information’?

Senator LUDWIG —The application form or the verification to check if there is a paper check.

Ms Kelly —There is no paper application form under the AusCheck system. Our applications are received from issuing bodies, who are our applicants. They may receive application forms from the individuals who are the subject of the background check, but all applications to us will be made electronically, so there will be no paper record stored by AusCheck, with the exception of appeals. In the event that a decision is appealed, there may be a file created in relation to an appeal process.

Senator LUDWIG —Where will that be kept?

Ms Kelly —Within the AusCheck offices.

Senator LUDWIG —Will the regulations set out how that file is kept?

Ms Kelly —That file will be managed in accordance with the Archives Act procedures and the records management procedures that govern other records within the office.

Senator LUDWIG —That will also determine who has access to that file?

Ms Kelly —That will determine who has access to that file. It will obviously be subject to the Privacy Act in relation to an individual whose personal information is stored on that file.

Senator LUDWIG —The Privacy Commissioner has indicated a couple of matters. Have you had an opportunity to look at the Privacy Commissioner’s submission?

Ms Kelly —I have.

Senator LUDWIG —They make a couple of suggestions. Are you able to say whether the Attorney-General is minded to narrow—my words—section 8(1)(a) and (b)? In the Privacy Commissioner’s submission, it says:

Section 8(1)(a) and (b) addresses the establishment of a background checking scheme …

And so on and so forth. It also says:

The Office notes the particularly broad scope of the “other purposes” that the AusCheck scheme may be used for, some of which would not require further primary legislation.

It goes on to say:

… the AusCheck scheme should be able to be undertaken only after primary legislation has been enacted, either through amendments to the AusCheck legislation or through other new or amended primary legislation.

Are you able to say whether or not that is being looked at by the Attorney-General’s Department—whether or not you intend to pick up the suggestion by the Privacy Commissioner?

Ms Kelly —It might be useful to explain in response to that the background in relation to the decision to establish AusCheck. When government directed that AusCheck be established, it was in the context of a direction that a scheme be established to centralise the aviation and maritime schemes but also that the Commonwealth was conscious that a significant amount of background checking occurred within the Commonwealth and there might be opportunities to minimise duplication and improve efficiencies by creating a framework within AusCheck that could subsequently, after the aviation and maritime schemes had been settled, move on and look at other opportunities for background checking that was occurring within the Commonwealth. So the bill really reflects that direction from government to create a vehicle for centralising background checking and the coordination of background checking for aviation and maritime identification cards but also with the ability to at a later point expand into increasing efficiencies and minimising duplication in other areas of background checking in which the Commonwealth is involved.

Senator LUDWIG —Like what?

Ms Kelly —There are no specific plans in relation to the use of AusCheck, but the Commonwealth is involved in a range of background checking. There are obviously the aviation and maritime schemes that are dealt with specifically here that are established under regulation, and the obligation to obtain the background check is established under the regulations in both of those cases. There is a scheme that was established in January in relation to people working with persons in aged-care facilities. The Commonwealth is also involved in background checking in the exercise of its executive power in relation to security clearances of employees. Also its employees are actually subject to a range of background checking regimes in that they interact with state and territory functions, so its employees are involved in obtaining checks for working with children in the range of background checking schemes that are conducted by various states on that issue.

The Commonwealth was also involved in the establishment of the ammonium nitrate background-checking regime. That was done under state and territory legislation but the Commonwealth was involved in its establishment. So there are a variety of areas in which the Commonwealth is involved, in different ways, and, whilst AusCheck was directed initially to look at the aviation and maritime schemes, it was very much with a view to providing a vehicle to later look at other opportunities when those activities are settled.

Senator LUDWIG —In all you list about 17 purposes in proposed section 8(2), but what could not be added? I will reverse it. You seem to have a broad number that go from national security to defence, money appropriation for the purpose of the Commonwealth, the collection of statistics, trade and commerce, provision of allowance and pensions and child endowment, notwithstanding the other matters in respect of which the parliament has the power to make laws for. Could it arguably cover Medicare and Centrelink?

Ms Kelly —It is a list of Commonwealth powers in relevant areas.

Senator LUDWIG —I know what it is.

Ms Kelly —One of the things that is perhaps important to point out is that, in order to operate in the area of national security, the Commonwealth relies on a package of constitutional powers. There is no one head of power that supports all of its activities on national security. Most of the areas in which the Commonwealth operates require a package of constitutional powers in order to support that activity. Whilst the list looks long, it is often—particularly in the national security area—a combination of powers that are required.

Senator LUDWIG —That is interesting, but the question was: could it arguably cover Medicare and Centrelink?

Ms Kelly —If the particular activity that you are referring to falls under one of the heads of power that are listed in proposed subsection 2 and it is an activity that could be conducted under those powers, then it could.

Senator LUDWIG —So we can establish that, under proposed section 8(2), it could include purposes which could arguably cover Medicare and Centrelink in that list?

Ms Kelly —To the extent that it is permitted under proposed section 8(2), that is correct.

Senator LUDWIG —What could not be covered in those? Do you have any examples of what you cannot cover? What I am trying to understand is the breadth. There are certainly arguments in the submissions that this is a very broad framework and in any framework there is usually a start and a finish, or at least a limit.

Ms Kelly —The limit is the limit of Commonwealth power. What the bill purports is that, where the Commonwealth is involved in background checking, AusCheck can be involved in background checking. Where the Commonwealth cannot be involved in background checking, then AusCheck cannot be involved in background checking. That is the limit.

Senator LUDWIG —There is no activity of the Commonwealth that cannot be added.

Ms Kelly —If it is within Commonwealth constitutional power and it is listed in subclause 8(2), then it is a purpose for which we could become involved.

Senator LUDWIG —So once this scheme is in place, the government could add a scheme for AusCheck for, say, applying for Centrelink services.

Ms Kelly —The government could do that if it was within its power, with or without the AusCheck bill.

Senator LUDWIG —Under this AusCheck system, could it, by regulation, apply for Centrelink services?

Ms Kelly —That is not a scenario that we have envisaged but, if it was within the power under clause 8(2), it could be done.

Senator LUDWIG —So there would not be anything to prevent the bill’s application to the proposed access card from being brought under the AusCheck scheme either?

Ms Kelly —I am not aware of any similarities or linkages between this bill and the access card scheme.

Senator LUDWIG —By regulation you can then require any government service—on national security, money appropriation or collection of statistics—to complete the relative forms and to then do background checks to provide—

Ms Kelly —I am not aware of any proposal for the access card registration procedure to involve any element of background checking. As I understand it, it is an identity verification procedure.

Senator LUDWIG —But the question is that it does not rule it out either. It could permit it by regulation. You have already said as much, I suspect, but I am just using that as an example.

Ms Kelly —If it is within Commonwealth power then certainly clause 8(2) provides the purpose for which regulations can be prescribed.

Senator LUDWIG —As I understand the way the scheme will work, it will be by an application via a website. Has the application been developed yet that will demonstrate what information will be required?

Ms Kelly —Substantially, yes.

Senator LUDWIG —Is that available to the committee?

Ms Kelly —We can certainly tell you the information that we will be requiring on the application form in relation to each individual. It is not in hard copy form; it is a web page.

Senator LUDWIG —You can print the web page out though.

Ms Kelly —Yes.

Senator LUDWIG —Do you have that?

Ms Kelly —Not here. It is the various categories of identification information. The thing that is different from the current system is some additional information on address history. The last 10 years of address history is the additional proof of identity requirement that we will be introducing. Other than that, the information is the same as is currently collected.

Senator LUDWIG —In terms of the sample ASIC that has been provided—that is the application from CASA—which aspects of the form will be part of the AusCheck system? Are you going to retain all of those?

Ms Kelly —We have not been through the process of comparing the CASA form. I understand that there may be additional information that many issuing bodies obtain from individuals for whom they are making an application, but we will only require the information that is currently required under the DOTARS regulations, with the addition of that address history.

Senator LUDWIG —Will there be any restrictions placed on the information in any of the fields?

Ms Kelly —Could you explain what you mean?

Senator LUDWIG —Who will have access ultimately to the AusCheck database as well?

Ms Kelly —Any issuing body that lodges an application to us will be able to access that application information. So the individual issuing body that provides the information will be able to access that information. All issuing bodies will be able to use our card verification facility whereby they can determine whether a card presented to them is a validly issued card from the AusCheck database. That search will only reveal to them the information on the face of the card. They will not be able to look behind and receive any of the background information or proof of identity or identifying information in relation to the individual; merely that the card is a valid card and the details that are presented on the card that is before them.

Senator LUDWIG —But all issuing authorities will have access to at least the information that is provided on the form.

Ms Kelly —Only for their own applications. So for their own applications they will have access to that information. They will not have access to that information for applications made by other issuing bodies.

Senator LUDWIG —But will they have access to the additional information that you will require?

Ms Kelly —Only the issuing body that has made that application and provided it to us will have access to it.

Senator LUDWIG —But you have indicated that there is also information such as residency periods that will be added. So who will have access to that information?

Ms Kelly —That information will not be available in the card verification facility. That information, to the extent that it is made available to persons other than issuing bodies, is governed by the disclosure provision, clauses 13 and 14.

Senator LUDWIG —Who can it be disclosed to?

Ms Kelly —To persons who bring themselves within 14(2).

Senator LUDWIG —Who could that be? I was looking for a hint.

Ms Kelly —I think the obvious persons that the bill was drafted around, having their needs in mind and the direction from government in mind, would be the AFP and the Australian Crime Commission.

Senator LUDWIG —And ASIO?

Ms Kelly —ASIO would use their own powers under the ASIO Act, so they would not need to rely upon those powers.

Senator LUDWIG —Would the AFP have unfettered access to the AusCheck database?

Ms Kelly —They would have access in accordance with subclause (2) there. They would also have their rights under IPP10 and 11 relating to their functions as a law enforcement agency.

Senator LUDWIG —They would not require a warrant or a subpoena to obtain information?

Ms Kelly —Provided that it was in accordance with subclause (2).

Senator LUDWIG —What limit is there in subclause (2):

(b)   may be used or disclosed for the following purposes:

(i)    carrying out a subsequent background check in relation to the individual …

(ii)   responding to an incident that poses a threat to national security;

(iii)  the collection, correlation, analysis or dissemination of criminal intelligence or security intelligence.

I am not sure that they do anything other than that. They might play sport on a Sunday, but—

Ms Kelly —The AFP probably would not qualify under (i) because they are not carrying out background checks. So I would imagine it would be either (ii) or (iii).

Senator LUDWIG —They might do it for their own employees.

Ms Kelly —I do not quite get the connection between that and information that we might have.

Senator LUDWIG —They might employ people who were pilots.

Ms Kelly —In any event, if they can bring themselves within subclause (ii), and the limits are set out there; namely:

(ii)   responding to an incident—

or—

(iii)  the collection, correlation, analysis or dissemination of criminal intelligence or security intelligence.

Senator LUDWIG —Are there limits to that or is it as broad as it looks? Can you explain what that means to me in plain English.

Ms Kelly —It relates to the activities of those agencies. I think it is the ordinary English meaning of the words as they appear in subparagraph (iii) that creates the limits.

Senator LUDWIG —What do you say ‘criminal intelligence’ is? This is a question that I have often asked CrimTrac. If you look at their database, they share information—particularly criminal history but also a range of information between states. Each state provides them with information, as I understand it. So what do you say criminal intelligence is?

Ms Kelly —I think the meaning of the term ‘criminal intelligence’ is known in relation to law enforcement and intelligence agencies. AusCheck would have no role in the assessment of criminal intelligence. For a definition of criminal intelligence and what that entails it is probably best to go to a law enforcement or intelligence agency. That information will be provided by agencies in accordance with the clause as it is set out.

Senator LUDWIG —But, if the Australian Federal Police say that they would like to look at it for the purpose of criminal intelligence, don’t you have to determine whether it is for the purpose of criminal intelligence and whether you will allow them access, or do I just use the magic phrase and get access to your database?

Ms Kelly —We are still in the process of establishing the procedures in relation to access to our database. One of the options would be to create guidelines which would have the content of what was required before access could be achieved. That is something that we are still considering, but certainly the sorts of things that we would consider would be the sort of detail that would be required. We will take expert advice on that from those involved in criminal intelligence in order to assist us in that process.

Senator LUDWIG —But I come back to the question: if I am the Australian Federal Police, which I am not, and I ask for information from your database based on this legislation, which says ‘criminal intelligence’, and I claim that it is criminal intelligence, are you in a position to say no, no matter what your guidelines say?

Ms Kelly —It would be a question of being satisfied that the request was in accordance with the clause.

Senator LUDWIG —Where does it say ‘satisfied’ in clause 14?

Ms Kelly —In order to act under the legislation, we would have to be satisfied that—

Senator LUDWIG —Why?

Ms Kelly —The provision—

Senator LUDWIG —Who has to be satisfied? It says:

(1)   The Secretary may establish and maintain a database …

(2)   AusCheck scheme personal information about an individual:

(a)   may be included in the AusCheck database; and

(b)   may be used or disclosed for the following purposes:

Ms Kelly —It would then be a question of an unlawful use or disclosure if it were not disclosed in accordance with those purposes, and that would be an offence under the act.

Senator LUDWIG —But what if the Australian Federal Police say it is for criminal intelligence?

Ms Kelly —As I said, we have not yet fully established the procedures for access.

Senator LUDWIG —I am not suggesting that it would not be for criminal intelligence; I am just saying that they have only to use the phrase.

Ms Kelly —As I said, we have not fully established the procedures for access to our database and they are matters that we will be considering as we proceed along the implementation process.

Senator LUDWIG —I am sorry, Chair, I have been a little longer than I thought I would be. I can pause here if others want to ask questions.

CHAIR —We will go to Senator Trood for a period and then we will come back to you, Senator Ludwig.

Senator TROOD —Is this expected to speed up the process of making these checks or is it likely to be the same?

Ms Kelly —We do expect to speed up the process. We have re-engineered the process of obtaining the background checking information to achieve that. We have told our issuing body clients that, for background checks involving Australian citizens with no actual or potential criminal history, we will do a five-business-day turnaround. We hope to do much better than that, but we feel very confident about a five-business-day turnaround. Seventy per cent to 80 per cent of checks will be done in that time frame. That provides a great advantage to our clients, who get that sort of time frame on some occasions but not on a consistent basis.

Senator TROOD —The bill provides for cost recovery. I presume that is cost recovery from agencies, is it?

Ms Kelly —It is cost recovery from both AusCheck—the Attorney-General’s Department’s costs—and our checking partner costs, so that includes costs from CrimTrac and ASIO and potentially DIAC.

Senator TROOD —I would like to explore some of these matters that Senator Ludwig was raising with you in relation to these regulations, particularly the prospect of the regulations adding purposes. I understood your evidence, Ms Kelly, to be that this was a sort of contingency provision for the possibility that the services of AusCheck might be used for other purposes down the track. Can I take it from that that when these regulations appear they will not, as far as you know, add particular purposes at this stage? You said, ‘We don’t have anything in mind,’ I thought, or words to that effect.

Ms Kelly —They are certainly not on our agenda. It is also important to understand that the background checking that the Commonwealth is currently involved in is also established by way of regulation and through a variety of other means. But this method of establishing background-checking schemes is already the current precedent within the Commonwealth.

Senator TROOD —So there will not be additions at this juncture?

Ms Kelly —We do not have any intention at the present time to do that.

Senator TROOD —Will the regulations have some kind of review scheme incorporated within them?

Ms Kelly —That is correct. The reason why the review provision or any review provision was not included in the bill is that each scheme that AusCheck is involved in will have different points at which review is required. So, in relation to the ASIC and the MSIC schemes, they already have a significant number of points at which a decision may be reviewed by the AFP. All those rights remain. There will be additional points where we think that, in the AusCheck process for those two schemes, AAT review rights need to be provided for. Every time we do a scheme, we will look for the appropriate point. Review rights will be provided in all schemes; that is certainly the intention. It is just that it is not able to be predicted in advance exactly at what points those review rights should appropriately be provided. So the detail of those will be provided in the regulations as each scheme is set out there.

Senator TROOD —Can you give the committee any intimation of the additional review points that might be included in the scheme?

Ms Kelly —There are certainly additional review points when AusCheck makes an assessment of the various components of the background check and then provides a response to the issuing body; that will be a point of review. That decision is also reviewable subsequently by the issuing body of their own motion, and there are also reviews later in the process in relation to the DOTARS involvement in reconsideration.

Senator TROOD —You heard, I think, the evidence about concerns about privacy. The office assured us that the privacy provisions that generally apply would apply to this piece of legislation. Could you just outline how you think they might apply to an individual here.

Ms Kelly —Certainly in terms of access to personal information, a person in relation to whom AusCheck has stored personal information will have all of the rights under the Privacy Act to access and correct information held in that way. Also, the Privacy Act applies to AusCheck, as I think Mr Solomon confirmed. The act actually seeks to clarify and expand and further explain the way the act applies by specifying the uses for which we propose to collect and disclose information. But certainly we are covered by the Privacy Act and the IPP regime.

Senator TROOD —Your view is that the Law Council’s concerns are overstated, perhaps?

Ms Kelly —It certainly was a clear direction that we are to manage information in accordance with the Privacy Act, and the bill actually embodies that.

Senator TROOD —This point, which is also in the Law Council’s submission, with regard to the reporting to parliament or some mechanism within the regulations that might provide us with some regular information about the number of checks that are undertaken, the number of rejections, perhaps the reasons for them—can you say anything on that subject? Is that likely to be part of the regulations as well?

Ms Kelly —AusCheck, as part of the Attorney-General’s Department, is subject to the annual reporting and portfolio budget statement process in relation to accountability. We had envisaged that information in relation to application numbers, processing times, refusals, AAT appeals would be routinely included in our annual report as part of those obligations.

Senator TROOD —I think that covers the issues that I want to raise.

CHAIR —Do you have any further questions, Senator Ludwig?

Senator LUDWIG —I do, thank you. In the definitions for the AusCheck scheme ‘personal information’ means personal information but (b) ‘relates to the administration of the AusCheck scheme’. What does that mean and what information might be included under that section?

Ms Kelly —I might have to take that on notice to explain that definition. It is not immediately obvious to me.

Senator LUDWIG —Me neither. While you are taking that on notice, my question really relates to how broad or how narrow it might be. So what are the restrictions? Perhaps you could provide some examples of that which relates to the administration of the AusCheck scheme itself and the types of personal information.

Ms Kelly —That is in relation to the (b) part of the definition?

Senator LUDWIG —Yes, the (b). Could it, for example, collect records on the usage of the ASIC card or the MSIC card itself under that provision? Of course, with a lot of these things people might keep a check on how it is used, where it is used and whether or not you can include that in the information that you require or keep.

Ms Kelly —It would depend on whether that related to the administration of the scheme.

Senator LUDWIG —I do not know, you see.

Ms Kelly —I mean, the scheme is about determining whether individuals are a suitable risk to have access to secure areas of airports and that would mean—

Senator LUDWIG —It does not only say that, does it? I did not mean to interrupt you, but I know that part of it. But it is also not limited—’such other matters as prescribed by regulation’.

Ms Kelly —We will take that on notice.

Senator LUDWIG —Of course, if I read 5(d) correctly—’such other matters’—does that mean you can amend the definition by regulation.

Ms Kelly —It would depend. We can amend the definition and that definition of course relates to AusCheck’s involvement in a scheme. If AusCheck were to be involved in a background checking scheme, however that was constituted, then we would want the definition to be amended of what a background check included in that subclause there.

Senator LUDWIG —A background check in relation to an individual is an assessment of information relating to one or more of the following:

(a)   the individual’s criminal history;

(b)   matters relevant to a security assessment of the individual;

and (c) deals with, in short, citizenship status. You can then use (d) to extend that to a range of others by regulation. Would you call that a Henry VIII clause where you can amend through the regulation the primary legislation and, in fact, an important one such as the definition?

Ms Kelly —I do not think that it is a Henry VIII clause. What it purports to do is provide a menu of components of a background check for which AusCheck can assist in providing a service. If, for example, DOTARS were to add an additional element to their background checking scheme for ASICs and MSICs, we would expect that to be fully reflected in either DOTARS legislation or regulations. But this provision would merely allow AusCheck to be involved in coordination of that scheme.

Senator LUDWIG —’Such other matters as are prescribed by the regulations’—so could the individual’s criminal history or the passenger list from Customs be added?

Ms Kelly —I think there would have to be an assessment made in each case and we would have to know more about the particular information before we could answer that question.

Senator LUDWIG —But, if it could, why wouldn’t that be a Henry VIII clause if you have just added another database, such as the Immigration database—they are building a super database at the moment. Customs have a range of databases they have access to.

Ms Kelly —As I have said, this is actually intended to be something that would sanction AusCheck’s involvement in a scheme established elsewhere. So, to that extent, it is not a Henry VIII clause.

Senator LUDWIG —How am I reading that wrong? ‘Such other matters as are prescribed by the regulations.’ So you can prescribe such other matters—(a), (b) and (c). Am I reading that badly or is it that I do not get it?

Ms Kelly —Again, it would depend upon the matter and the particular legislative backing that the addition of that matter would require.

Senator LUDWIG —What matter?

Ms Kelly —But I can only say that, if DOTARS, for example, were to change the components of the ASIC and the MSIC background checks, the intention is that AusCheck’s involvement in that would be supported by amendment to that definition of ‘background check’.

Senator LUDWIG —By regulation?

Ms Kelly —Yes.

Senator LUDWIG —We might differ on what a Henry VIII clause is then. If ASIC, for some strange reason, wanted passenger information from Customs or wanted to access Immigration’s supercomputer, you would then, upon their request, add that in by regulation?

Ms Kelly —To the extent that there is a context and a framework established; there are already matters that are clearly there.

Senator LUDWIG —No, I do not know about the context or the framework. If they add that database in and they then request that you then prescribe it by regulation, on what grounds would you say no? Where do I look to see that you cannot or that you should not? If they, being the primary issuer of the card, say they require that information and request it—they might have been able to secure from Immigration a memorandum of understanding to get that information; they might already have it and want to use it legitimately for a background check—where does your gatekeeper role come in?

Ms Kelly —We obviously would have to be satisfied that it was a process that could be conducted under the AusCheck Bill. Certainly, in the way that the Attorney-General’s Department scrutinises all processes involving rights, we would obviously look at that process as well. We would also expect that any significant changes to any regulatory scheme in which we were involved or any new AusCheck scheme would be submitted to a privacy impact assessment process where all of those issues would be fully considered. Certainly it is intended that we have a privacy impact assessment to fully canvass all of those issues in any new scheme in which AusCheck is involved.

Senator LUDWIG —And I can find all those things you just talked about in this legislation?

Ms Kelly —No. That is a policy commitment.

Senator LUDWIG —I cannot find it in the framework. Will I find it in the regulations when I see them?

Ms Kelly —No.

Senator LUDWIG —No, I would not have thought so either. It is a commitment from you, Ms Kelly, is it?

Ms Kelly —That is the normal Attorney-General’s Department practice and it is what we are observing in relation to this bill and what we intend to observe in relation to any future AusCheck scheme.

Senator LUDWIG —So the type of personal information that can be kept on the database is under clause 4. Going back to (a) for a brief examination for a moment: ‘that is obtained under the AusCheck scheme’. Is that limited? What could you keep—blood type, address, age and medical history?

Ms Kelly —The type of information in relation to ASICs and MSICs is already specified under the DOTARS regs and, as I have said, we are adding additional information that is required for the purposes of conducting the background check.

Senator LUDWIG —We get a bit circuitous here, aren’t we? It could be any of those I mentioned depending on the scheme you add by regulation.

Ms Kelly —If it was required for the purpose of conducting the background check.

CHAIR —Senator Ludwig, we are scheduled to complete our hearing at this time.

Senator LUDWIG —I might put the reminder of my questions on notice.

CHAIR —Unless you do not have very many?

Senator LUDWIG —No, I have many. You might wish to also ask a question.

CHAIR —No, I think most of the areas that I would have pursued have been covered. I would note though that our reporting date is 14 March, so if we try to get those questions to the departments tomorrow—

Senator LUDWIG —Yes.

CHAIR —then we will seek your assistance, Ms Kelly and Ms Johnson, in returning any answers to the committee as soon as possible. If there are no further questions, I thank all of the witnesses who have given evidence to the committee this afternoon and declare this meeting adjourned.

Committee adjourned at 6.26 pm