Skip to main content
Skip to secondary navigation
Menu
Australian Government - Office of the Australian Information Commissioner - Home

Exposure Draft - Extradition and Mutual Assistance in Criminal Matters Legislation Amendment Bill 2009; Submission to the Attorney-General''s Department (August 2009)

Key Recommendations

1. The Office of the Privacy Commissioner (the 'Office') welcomes the opportunity to comment on the exposure draft Extradition and Mutual Assistance in Criminal Matters Legislation Amendment Bill 2009 (the 'draft Bill') and related Explanatory Document.

2. The Office acknowledges the public interest in maintaining the safety and security of the Australian community through effective international crime cooperation arrangements. The following recommendations are intended to enhance community confidence in personal information handling under these arrangements:

  • i) Any uses or disclosures of personal information should be 'directly related' to a purpose of extraditing a person to or from Australia, or 'directly related' to a purpose of providing or obtaining mutual assistance in a criminal matter
  • ii) The Mutual Assistance in Criminal Matters Act 1987 (Cth) (the 'Mutual Assistance Act') could be amended to require an assessment of whether a foreign offence firstly has an equivalent offence under Australian law, and secondly whether the equivalent offence would be considered a 'serious offence' because the maximum penalty available for that offence meets a particular penalty threshold
  • iii) It may be appropriate to include a mechanism in international crime cooperation legislation managing the way an Australian government agency discloses personal information to a foreign country. The mechanism could establish administrative arrangements, undertakings, memorandums of understanding or other protocols for appropriate personal information handling practices by the foreign country for the information supplied by the agency
  • iv) Division 3, part 3, schedule 3 of the draft Bill could include a non-exhaustive list of the matters an authorised officer should take into account when deciding whether a disclosure of existing telecommunications material to a foreign law enforcement agency is 'appropriate in all the circumstances'
  • v) It may not be clear which foreign offences are intended to be covered by 'an offence involving terrorism' at item 171, part 5, schedule 3 of the draft Bill. The Office suggests it may be useful to explain in the Explanatory Document the types of foreign offences that 'terrorism' will cover.
  • vi) It may be appropriate to examine the extent to which enforcement agencies are authorised to disclose DNA information overseas under the Mutual Assistance Act without judicial oversight. This is particularly important given the privacy sensitivities associated with this information
  • vii) The Office suggests developing privacy guidelines to assist in managing the extradition and mutual assistance processes and
  • viii) Consideration could be given to conducting a Privacy Impact Assessment to help identify and address potential privacy issues associated with any proposed changes to international crime cooperation arrangements.

Office of the Privacy Commissioner

1. The Office of the Privacy Commissioner ('the Office') is an independent statutory body whose purpose is to promote and protect privacy in Australia. The Office has responsibilities under the Privacy Act 1988 (Cth) (the 'Privacy Act'). The Privacy Act contains eleven Information Privacy Principles ('IPPs') which apply to Australian and ACT Government agencies. It also includes ten National Privacy Principles ('NPPs') which generally apply to all businesses with an annual turnover of more than $3 million (and some small businesses).[1]

Background

2. The Office appreciates the opportunity to make comments to the Attorney-General's Department (the 'Department') on the exposure draft Extradition and Mutual Assistance in Criminal Matters Legislation Amendment Bill 2009 (the 'draft Bill') and related Explanatory Document.[2]

3. The Office notes that the Department would also welcome further or alternative ideas for reform as well as general comments on Australia's international crime cooperation arrangements.[3]

4. The Office has previously made comments to the Department on its review of Australia's mutual assistance and extradition legislation. In October 2006, the Office commented on a discussion paper released by the former Minister for Justice and Customs, Senator the Hon Chris Ellison, titled A Better Mutual Assistance System: A Review of Australia's Mutual Assistance Law and Practice.[4]

5. The Office appreciates that a number of its comments are reflected in the draft Bill. However, there are some key areas of the draft Bill and in Australia's international crime cooperation arrangements generally that affect personal information handling, which in the Office's view may warrant further consideration.

6. The Office's comments are based on the premise that generally the Australian community expects personal information to be handled in accordance with our own laws and accepted community norms. These norms may be different from the standards in some other countries, where personal information handling practices may reflect different cultural, religious and political values.

Interaction with privacy laws

7. Information Privacy Principles ('IPPs') 10.1 and 11.1 in section 14 of the Privacy Act regulate how agencies use and disclose personal information. Generally an agency may not use an individual's personal information for a purpose other than the purpose for which the information was obtained, or disclose the information to another person, body or agency without the individual's consent. This reflects individuals' legitimate interest in controlling the use and dissemination of information about them.

8. IPPs 10.1 and 11.1 are subject to certain exceptions. These include where the use or disclosure is 'required or authorised by or under law'.[5] This exception is mostly intended to cover situations where 'a law unambiguously requires or authorises the use or disclosure of personal information'.[6]

9. Part 2, schedule 1 of the draft Bill would:

  • i) insert section 54A into the Extradition Act 1988 (Cth) (the 'Extradition Act') which states that 'the collection, use or disclosure of personal information about an individual is taken to be authorised by law for the purposes of the Privacy Act 1988 if the collection, use or disclosure is reasonably necessary for the purposes of, or for purposes relating to, the extradition of one or more persons to or from Australia, including making, or considering whether to make an extradition request'[7]
  • ii) insert section 43D into the Mutual Assistance in Criminal Matters Act 1987 (Cth) (the 'Mutual Assistance Act') which states that 'the collection, use or disclosure of personal information about an individual is taken to be authorised by law for the purposes of the Privacy Act 1988 if the collection, use or disclosure is reasonably necessary for the purposes of, or for purposes relating to: (a) the provision, or proposed provision, by Australia to a foreign country of international assistance in criminal matters; or (b) the obtaining, or proposed obtaining, by Australia from a foreign country of international assistance in criminal matters'[8] and
  • iii) make corresponding amendments to section 336E(2)(ga) of the Migration Act 1958 (Cth).[9]

10. According to the Explanatory Document, these provisions would clarify the application of the Privacy Act to extradition and mutual assistance processes.[10]

11. The effect of these provisions is that the privacy protections in IPPs 10.1 and 11.1 generally would not apply to any use or disclosure related to the extradition and mutual assistance process, as these would be 'authorised by law'.[11] The Office understands that this is intended to include international assistance in criminal matters that is provided outside the scope of the Mutual Assistance Act.

12. The Office recognises that there is a legitimate public interest in ensuring that Australian Government agencies may use and disclose material which may contain an individual's personal information for extradition and mutual assistance purposes. However, the Office considers that part 2, schedule 1 could authorise the use and disclosure of personal information (including sensitive information as defined in the Privacy Act[12]) in a very broad range of circumstances, the scope of which may be unclear. This could result in the disclosure of personal information overseas without the protections in IPP 11 and possibly without legislative or administrative oversight.

13. The Office notes that in 2006 it supported the suggestion that uses or disclosures of personal information for mutual assistance in criminal matters should be defined narrowly against specific criteria.[13]

14. The Office now suggests that if it would be impracticable to identify specific criteria, any uses or disclosures of personal information under the Extradition Act or the Mutual Assistance Act should be:

  • i) 'directly related' to a purpose of extraditing a person to or from Australia or
  • ii) 'directly related' to a purpose of providing or obtaining mutual assistance in a criminal matter,

and that these descriptors be included in the new provisions.

15. The Office also believes it may be appropriate to include an administrative oversight mechanism in the Mutual Assistance Act for review of proposed disclosures of personal information that fall outside the scope of the Mutual Assistance Act. This review mechanism would provide a consistent and transparent approach to assessing whether a proposed disclosure is 'directly related' to the purpose of providing or obtaining mutual assistance in a criminal matter.

Assistance thresholds

Dual criminality

16. Section 8(2)(a) of the Mutual Assistance Act provides that the Attorney-General may refuse a foreign country's request for assistance where 'the request relates to the prosecution or punishment of a person in respect of an act or omission that, if it had occurred in Australia, would not have constituted an offence against Australian law'.

17. The Office notes that if there is no equivalent offence under Australian law, the foreign offence may reflect particular cultural, religious or political views in another country that may not generally be acceptable to the Australian community. If the Attorney-General assists in these circumstances, this may facilitate personal information flows overseas related to offences that the Australian community may not consider warrant Australia's assistance.

18. The Office therefore suggests that under this discretionary power there be clear and transparent criteria as to how the discretion would be exercised. In the Office's view this will influence the degree of confidence individuals and the Australian community retain in how personal information is handled in the context of mutual assistance.

Comparable penalties

19. The Office notes that generally Australia will not provide assistance to a foreign country under the Extradition Act or the Mutual Assistance Act (and under certain provisions in the draft Bill) unless the maximum penalty for the relevant offence meets a particular penalty threshold.[14]

20. The Office understands that these thresholds relate to the maximum penalty available under the relevant foreign law. However, this may not reflect the Australian community's standards about whether an offence is serious. For example, a foreign country may request that information about a person be sent overseas to assist in the investigation of a public indecency offence which is punishable by a significant term of imprisonment, while an equivalent offence may not be considered serious under Australian law.

21. In the Office's opinion, it may be preferable for an assessment to be made about whether the equivalent offence under Australian law would be considered a 'serious offence' because the maximum penalty available for that offence meets a particular penalty threshold.[15]

Personal information handling overseas

22. The Office notes that some of the provisions in the draft Bill purport to regulate the way a foreign country handles certain information provided under the Mutual Assistance Act and the Telecommunications (Interception and Access) Act 1979 (Cth).[16] For example, division 2, part 3, schedule 3 of the draft Bill would amend the Mutual Assistance Act to require foreign countries that have requested surveillance devices to give appropriate undertakings in relation to:

  • i) 'ensuring the information obtained as a result of the use of the surveillance device will only be used for the purpose for which it is communicated to the requesting country
  • ii) the destruction of a document or other thing containing information obtained as a result of the use of the surveillance device and
  • iii) any other matter the Attorney-General considers appropriate'.[17]

23. However, other provisions in the draft Bill which permit information to be disclosed to foreign countries provide for more limited or no undertakings.[18]

24. Given the sensitive nature of information that may be transferred to a foreign country under the Mutual Assistance Act, the Office believes that it may be appropriate to include a mechanism in the Mutual Assistance Act to ensure that the relevant transferring agency establishes administrative arrangements, undertakings, memorandums of understanding or other protocols regarding appropriate personal information handling practices in the foreign country. Such arrangements should be publicly available and include easily accessible complaint handling and accountability mechanisms.

25. While the Office acknowledges that agencies do not currently need to comply with the transborder data flow principle in NPP 9[19], these arrangements would generally be consistent with the spirit of the Privacy Act. In particular, it is fundamental to IPP 11.3 that bodies or agencies to whom personal information is lawfully disclosed should not use or disclose the information for a purpose other than the purpose for which it was disclosed to them. The Australian Law Reform Commission has also recommended that a privacy principle similar to NPP 9 should apply to agencies.[20]

26. As well as the issues of use and destruction identified at paragraph 22 the Office suggests that limitations on disclosure and security of personal information also form part of any arrangements with foreign agencies.

Existing telecommunications material

27. The draft Bill would amend the Telecommunications (Interception and Access) Act 1979 (Cth) so that an authorised law enforcement officer could authorise a telecommunications carrier to disclose existing telecommunications data (such as subscriber details and call charge records) to the enforcement agency, where the officer believes the disclosure is reasonably necessary to enforce a foreign criminal law. This information could then be disclosed directly to a foreign law enforcement agency, providing the authorised officer is satisfied that the disclosure is reasonably necessary to enforce a criminal law of a foreign country and the disclosure is appropriate in all the circumstances.[21]

28. The existing telecommunications data could be disclosed overseas even if the offence to which it relates is not a 'serious offence'. Also, the disclosure would not be subject to judicial oversight. While existing telecommunications data could be disclosed within Australia in similar circumstances for an offence under a domestic criminal law, the Office notes that this would be subject to established oversight and accountability mechanisms in Australia.

29. The Office would suggest that it may enhance the oversight process if the Telecommunications (Interception and Access) Act included a non-exhaustive list of the matters the authorised officer should take into account when deciding whether a disclosure is 'appropriate in all the circumstances'. These matters may include:

  • i) the potential impact on an individual's privacy and Australia's security and other national interests[22]
  • ii) the nature of the specified documents or specified information
  • iii) the gravity of the alleged offence and
  • iv) how much these documents would be likely to assist in connection with the investigation.[23]

Proceeds of crime

30. Generally under section 34Y(1) of the Mutual Assistance Act an authorised officer may apply for a monitoring order under the Proceeds of Crime Act 2002 (Cth) in relation to a foreign serious offence, providing the offence meets certain criteria. Part 5, schedule 3 of the draft Bill would insert some additional criteria in section 34Y(1), including where the foreign offence involves terrorism.

31. While the Office considers that this extension is important, it notes that 'terrorism' does not appear to be defined in the draft Bill or the Mutual Assistance Act. It may be useful to include in the Explanatory Document the kinds of offences that are considered 'terrorism'.

32. The Office also notes that part 5, schedule 3 of the draft Bill would insert a new section 34ZG into the Mutual Assistance Act, so that the Attorney-General could authorise an application to be made under the Proceeds of Crime Act providing certain conditions are met. It also repeals sections 34X and 34ZA of the Mutual Assistance Act which currently relate to requests for monitoring orders and search warrants under the Proceeds of Crime Act.

33. It is not clear to the Office why some of the preconditions to disclosure currently set out in sections 34ZA(1)(b)[24] and 34X(1)(b)[25] of the Mutual Assistance Act are not included in proposed section 34ZG. The Office suggests that consideration be given to including these preconditions in section 34ZG.

DNA data matching

34. A Better Mutual Assistance System: A Review of Australia's Mutual Assistance Law and Practice noted that Australia can provide DNA information which is lawfully in the possession of an Australian enforcement agency (such as the Australian Federal Police) to a foreign country under section 13A of the Mutual Assistance Act. [26] This does not require any judicial oversight process. The draft Bill does not amend this aspect of section 13A.

35. The Office reiterates its views made to the Department in October 2006 that it may be appropriate to examine the extent to which enforcement agencies are authorised to disclose DNA information overseas without judicial oversight. This is particularly important given the privacy sensitivities associated with DNA information.[27] For example, it may be appropriate to consider the extent to which such exchanges are or could be regulated by other legislative mechanisms such as a specific authorisation under law, or administrative mechanisms such as an authorisation by the Attorney-General.

Privacy guidance

36. In its submission to the Department in March 2006, the Office suggested developing privacy guidelines for the extradition and mutual assistance processes.[28] The Office considers that guidelines could assist those engaged in managing these processes (whether in Australia or offshore) by explaining the practical effect of the IPPs and ways to facilitate good privacy practice. For example, the privacy guidelines for extradition might explain steps to minimise the privacy impacts on individuals whose personal information is incidentally collected and used.

37. The Office suggests that the guidelines should be publicly available and include information about any complaint handling processes. This would enhance public confidence in personal information handling. The guidelines could be developed by agencies most directly involved in the extradition and mutual assistance processes, with appropriate consultation with the Office.

Privacy Impact Assessment

38. The Office suggests that a Privacy Impact Assessment ('PIA') be conducted to help identify and address potential privacy issues associated with any proposed changes to international crime cooperation arrangements. This would be particularly important if part 2, schedule 1 authorised the disclosure of personal information where mutual assistance was provided outside the scope of the Mutual Assistance Act.

39. A PIA allows agencies to identify and analyse privacy impacts during a project's design phase. A project that underestimates privacy impacts can place its overall success at risk. A PIA would help identify the various information flows relating to the proposed reforms, how privacy regulation might apply to them, the privacy risks that may arise and how these risks could be addressed.

40. The Office's Privacy Impact Assessment Guide provides Australian Government and ACT Government agencies with an introduction to the PIA process[29]. The Guide describes the purpose and general features of a PIA.


[1] Information relating to the operation of the Privacy Act can be found on the Office's website at http://www.privacy.gov.au/

[2] See http://www.ag.gov.au/www/agd/agd.nsf/Page/Extraditionandmutualassistance_Extraditionandmutualassistancereview_Extraditionandmutualassistancereview 

[3] See http://www.ag.gov.au/www/agd/agd.nsf/Page/Extraditionandmutualassistance_Extraditionandmutualassistancereview_Extraditionandmutualassistancereview

[4] See http://www.privacy.gov.au/materials/types/submissions/view/6662

As well, in March 2006, the Office provided comments to the Department on a discussion paper also released by the former Minister for Justice and Customs, titled A New Extradition System: A Review of Australia's Extradition Law and Practice- December 2005:  See http://www.privacy.gov.au/materials/types/submissions/view/6680

[5] See IPP 10.1(c) and IPP 11.1(d) of the Privacy Act 1988 (Cth).

[6] Explanatory Memorandum, Privacy Amendment (Private Sector) Bill 2000 (Cth), paragraph 358.

[7] See item 12, part 2, schedule 1 of the draft Bill.

[8] See item 14, part 2, schedule 1 of the draft Bill.

[9] See item 13, part 2, schedule 1 of the draft Bill.

[10] See paragraph 1.6 of the Explanatory Document.

[11] See IPPs 10.1(c) and IPP 11.1(d).  For more information on these exceptions see Guidelines to Information Privacy Principles 8 - 11 at http://www.privacy.gov.au/materials/types/guidelines

[12] See section 6 (1) of the Privacy Act 1988 (Cth).

[13] See A Better Mutual Assistance System: A Review of Australia's Mutual Assistance Law and Practice at p. 66 see https://www.ag.gov.au/www/agd/agd.nsf/Page/Extraditionandmutualassistance_Mutualassistance_Mutualassistancereviewpaper . The paper suggested limits such as:

  • i) The type of personal information that could be used or disclosed
  • ii) The agencies that would use or disclose the information
  • iii) The person, body or agency to which the information would be disclosed and
  • iv) The purpose for which the information could be used or disclosed.

[14] See for example division 1, part 3 of schedule 3 of the draft Bill; division 2, part 3, schedule 3 of the draft Bill and part 4, schedule 3 of the draft Bill.

[15] See paragraph 29 at http://www.privacy.gov.au/materials/types/submissions/view/6662

[16] See for example division 2, part 3, schedule 3 of the draft Bill and part 4, schedule 3 of the draft Bill. 

[17] Proposed section 15B of the Mutual Assistance Act in division 2, part 3,schedule 3 of the draft Bill.

[18] See for example part 2, schedule 3 of the draft Bill, division 1, part 3, schedule 3 of the draft Bill and division 3, part 3, schedule 3 of the draft Bill.

[19] NPP 9 generally provides that an organisation may transfer an individual's personal information to another in a foreign country providing one of the conditions listed in NPP 9 is met.  These include where the organisation reasonably believes that the recipient of the information is subject to a law, binding scheme or contract which effectively upholds principles for fair handling of the information that are substantially similar to the NPPs (see http://www.privacy.gov.au/materials/types/infosheets/view/6583#npp9)

[20] See Australia Law Reform Commission, Report 108 For Your Information: Australian Privacy Law and Practice, recommendation 31-2 at http://www.austlii.edu.au/au/other/alrc/publications/reports/108/

[21] See item 91, division 3, part 3, schedule 3 (proposed section 180A in the Telecommunications (Interception and Access) Act 1979 (Cth)) and paragraph 3.37 of the Explanatory Document. See also item 91, division 3, part 3, schedule 3 (proposed section 180B) and paragraph 3.38 of the Explanatory Document.

[22] See paragraph 3.37 of the Explanatory Document.

[23] These criteria are based on the matters an issuing authority needs to take into account under section 116 of the Telecommunications (Interception and Access) Act 1979 (Cth).

[24] Section 34ZA(1)(b) provides that if the proceeds or an instrument of the offence, or a property-tracking document in relation to the offence is reasonably suspected of being located in Australia, the Attorney-General may authorise an authorised officer of an enforcement agency to apply to a magistrate of a specified State or Territory for a search warrant under the Proceeds of Crime Act in relation to the proceeds or instrument. 

[25] Section 34X(1)(b) provides that if information about transactions conducted through an account with a financial institution in Australia is reasonably suspected of being relevant to the proceeding or investigation, the Attorney-General may authorise an authorised officer of an enforcement agency to apply to a judge of a specified court for a monitoring order under the Proceeds of Crime Act in respect of the offence for the purpose of obtaining the information requested by the foreign country.

[26] See issue 13 at https://www.ag.gov.au/www/agd/rwpattach.nsf/VAP/(03995EABC73F94816C2AF4AA2645824B)~Mutual+Assistance+Review+Discussion+Paper.pdf/$file/Mutual+Assistance+Review+Discussion+Paper.pdf

[27] See paragraphs 34 to 37 at http://www.privacy.gov.au/materials/types/submissions/view/6662

[28] See paragraphs 46 - 51 at http://www.privacy.gov.au/materials/types/submissions/view/6680

[29] See http://www.privacy.gov.au/materials/types/guidelines