Privacy Act 1988 Part VI - Temporary Public Interest Determination No. 2010-1
To allow collation of victims of crime statistics involving student visa holders for research purposes
Effective:  7 May 2010 to 6 May 2011 inclusive
Under section 80A(2) of the Privacy Act 1988 (Cth)  I, Karen Curtis, Australian Privacy  Commissioner, determine that I am satisfied of the following:
a)      The Australian Government has requested the Australian Institute of Criminology to conduct research and provide a report on the victimisation rate for student visa holders from the top five source countries since 1 July 2004 (the People’s Republic of China, India, the Republic of Korea, Malaysia and the United States of America).
b)     For the purposes of this research the Department of Immigration and Citizenship (the Department) must disclose limited personal information about those student visa holders to police jurisdictions in each state and territory and to the Australian Institute of Criminology.
c)      This one off set of disclosures by the Department may breach Information Privacy Principle 11 in section 14 of the Privacy Act 1988.
d)     Noting the strict arrangements being put in place, the public interest in the disclosures by the Department for the sole purpose of the Australian Institute of Criminology research project into victimisation rates of certain student visa holders, outweighs to a substantial degree the public interest in adhering to Information Privacy Principle 11 in this case.
e)      The application requires an urgent decision.
Accordingly, by virtue of section 80B(1) the Department is taken not to contravene section 16 of the Privacy Act 1988 if, during the period from 7 May 2010 to 6 May 2011 inclusive, the Department makes the disclosures in accordance with the conditions set out in Attachment A.  My reasons for making this determination are in Attachment B.
 
 
Karen Curtis
Australian Privacy Commissioner
5 May 2010                                                                                                               
Attachment A
Conditions
In relation to the release of personal information to each police jurisdiction
1. The Department of Immigration and Citizenship (the Department) will not release any personal information to a police jurisdiction under this Determination until it has a signed letter from the relevant Police Commissioner agreeing, at a minimum, to the following conditions: 
a)      The provision of personal information held by the Department relating to student visa holders and former student visa holders is a once only arrangement solely for the purposes of assisting the Australian Institute of Criminology (AIC) research on the victimisation rate for student visa holders from the top five source countries since 1 July 2004.
b)     The extraction of personal information will occur at the Department’s national office, 6 Chan Street Belconnen ACT.
c)      The Department will provide the relevant police jurisdiction with an electronic file which includes the student visa holders’ (or former student visa holders’) Person Identification, family name, given names and date of birth.
d)      The Department will deliver this electronic file by bonded courier to the relevant police jurisdiction.
e)      The relevant police jurisdiction will provide written notification to the Department on receipt.
f)       The relevant police jurisdiction is to use the personal information provided by the Department solely for the purpose of undertaking a one off data matching exercise against the details of victims of crime in incidents recorded by police between 1 July 2004 and the date of the data match.
g)     The relevant police jurisdiction is to ensure the security and privacy of the personal information provided in relation to this arrangement is protected by password at all times.
h)     The disclosure of personal information by the Department under this arrangement is subject to Commonwealth legislation and guidelines that govern the protection of information, secrecy obligations and general conduct. These include, but are not limited to:
·        the Privacy Act 1988 (the Privacy Act)
·        the Crimes Act 1914
·        the Public Service Act 1999
·        the APS Values and Code of Conduct and
·        the Australian Government Protective Security Manual.
i)        The relevant police jurisdiction acknowledges the Privacy Act applies in respect of the provision of data under this arrangement.
j)        The relevant police jurisdiction will not intend to do any act or engage in any practice that would breach the privacy and secrecy provision under which the relevant police jurisdiction operates.
k)     The relevant police jurisdiction ensures that there is no merging, matching, exchange or any other forms of interaction between personal information obtained during the course of providing services under this arrangement and other data sets, or other information held by the police jurisdiction.
l)        The relevant police jurisdiction ensures that any employee of the service who is required to deal with personal information for the purposes of this arrangement be aware of the obligations set out in these conditions and undertakes to comply with these obligations.
m)   The electronic file is securely stored inside a B class security cabinet (or equivalent) whilst in possession and control of the relevant police jurisdiction.
n)     The relevant police jurisdiction will provide the matched data to the AIC de-identified, in the form of the Person ID with detail of the police recorded incident.
o)      Upon completion of the data matching exercise, as advised by the AIC, the relevant police jurisdiction will destroy the hard copy and delete all digital copies of the Department’s data file in their possession that relate to this arrangement, unless advised otherwise.
p)     The relevant police jurisdiction will provide written notification to the Department upon deletion of all such files.
q)     The relevant police jurisdiction agrees to immediately notify the Department if the service becomes aware of a breach or possible breach of any of the obligations contained in these conditions.
 
 
In relation to the release of information to the Australian Institute of Criminology (AIC)
The Department will provide the AIC with personal information which has been de-identified, by removing individuals’ names and dates of birth, but leaving the Person ID.  The AIC has no means by which to re-identify any individual from the records provided as the AIC will not have access to the names and dates of birth of individuals at any point in the process.
The AIC will merge this de-identified information with the de-identified information provided by the police jurisdictions.  Once the AIC has prepared the final dataset for analysis, prepared the relevant reports to government and finalised all follow up analyses, the data will be permanently de-identified through removal of the Person ID. Notification that the final dataset has been permanently de-identified will be provided to the Department by the Director of the AIC.
Notice
The Department will publish a notice about the research and provide affected students with an ability to opt-out of the disclosure of their information.  The notice, with information about opting out, will be published on the Department’s website and on Australian Embassy or High Commission websites in the People’s Republic of China, India, the Republic of Korea, Malaysia and the United States of America. 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Attachment B
Statement of Reasons for Temporary Public Interest Determination 2010-1
The application
On 23 April 2010, the Department of Immigration and Citizenship (the Department) applied under section 73 of the Privacy Act 1988 (Cth) (the Privacy Act) for a public interest determination (PID) to be issued under section 72 of the Privacy Act. 
The Department has requested a determination to exempt it from complying with Information Privacy Principle (IPP) 11 in limited and specified circumstances. The Department has indicated that the application requires urgent consideration.
The application concerns the once only disclosure of a limited set of specific personal information about student visa holders to all police jurisdictions in Australia and the Australian Institute of Criminology (AIC). The information disclosed by the Department will be used by the AIC to compile a report on the victimisation rate for student visa holders from the top five source countries (the People’s Republic of China, India, the Republic of Korea, Malaysia and the United States of America) who have studied in Australia since 1 July 2004.
The AIC research cannot be undertaken by investigation of police data alone.  To enable police jurisdictions to identify police recorded incidents which involved student visa holders since 1 July 2004, the Department will disclose a limited set of specific personal information from its visa holder records to Australian police jurisdictions.  This information will include the unique Person Identification number (Person ID) allocated to each student visa holder by the Department.  The police jurisdictions will data match the information provided by the Department to police recorded incidents.  The result of the data matching will be de-identified and then provided to the AIC.
The Department will also provide the AIC with additional de-identified information including the Person ID for each student visa holder.  The Person ID will enable the AIC to match the data provided by police jurisdictions to the information held by the AIC. The AIC will be unable to re-identify any individual from the information provided to it, as the AIC will not have access to the individuals’ names and dates of birth at any point in the process. The statistical information generated by the AIC’s research will not contain any personal information and matched information will not be provided to the Department at any stage.
 
Issues raised by the applicant
The Department submitted that the international education sector is Australia’s third largest national export and plays a critical role in fostering stronger international links and developing diverse skills in Australia and overseas. However, recent attacks on some student visa holders in Australia, including Indian students, have damaged Australia’s standing and reputation in India. More broadly it has been claimed that Australia’s international standing and Australia’s international education sector risks being damaged by perceptions that Australia is unsafe for international students.
The Australian Government is keen to ensure that our community is a safe environment for everyone, including international students. Australian governments at all levels are treating the attacks seriously and taking steps to address these attacks and related issues.
Developing a clear understanding of whether or not the nationality of victims is relevant to attacks on students is necessary in determining the nature of attacks and whether the actions taken by Government and law enforcement to the incidents were appropriate.  The research undertaken by the AIC is designed to inform government policy and the law enforcement responses to attacks on students.
The Department has requested that a PID be granted urgently to allow Australian Governments to draw on analysis by the AIC to respond in a timely and informed manner to attacks on international students in Australia. The Department submits that early identification of the nature of crimes against student visa holders is important to effectively address the risks to the Australian community, economy and Australia’s international standing.
Consultation Process
A temporary public interest determination may only be issued when the matter is of an urgent nature.
Targeted consultation has been undertaken by the Department. In particular, the Department advised that it has undertaken consultation with key stakeholders such as the Department of Foreign Affairs and Trade (DFAT), the Department of the Prime Minister and Cabinet, the AIC and, through the AIC, state and territory police jurisdictions.  The Department also asked DFAT to discuss the research proposal with the five source countries and seek their views about the Department disclosing information about their students for this purpose.  
DFAT consulted the Canberra-based diplomatic representatives of the five countries with current and former students affected by the proposed research. In response, the Republic of Korea Government informed the Australian Embassy that the Republic of Korea supported the AIC study because of its objective of informing Australian Government policy on reducing the risk of violence to foreign students. The Indian Government has publicly asked Australia for more data on crimes against international students.
The diplomatic representatives from the other three countries noted that they would consult their capitals and would advise the Australian Government if their governments had concerns about the data release.  However, also, on being informed about the proposed research, these representatives commented about the importance of the security of their students in Australia and that Australia has a good reputation for information security.
In addition the Department has consulted with two student groups who have previously expressed an interest in the issue of student safety, the Australian Federation of International Students and the National Union of Students (NUS). The Department advises that both groups were open to the concept of sharing information for this purpose. The NUS also indicated that they considered the objectives of the research to be in the public interest.
Reasons for the decision
Requirements of section 80A
The application was made under section 73 of the Privacy Act for a determination under section 72 of the Privacy Act. The Department requested that an urgent decision be made on this matter.
I have decided to deal with the application under section 80A of the Privacy Act because it raises matters requiring an urgent decision.
Under section 80A(1) of the Privacy Act, I am empowered to make a Temporary Public Interest Determination (TPID) where I am satisfied that each of the following apply:
a)      an act or practice of an agency that is the subject of the application for a public interest determination breaches, or may breach, an Information Privacy Principle (section 80A(1)(a)(i)) and
b)     the public interest in the agency doing the act or engaging in the practice outweighs to a substantial degree the public interest in adhering to that Information Privacy Principle (section 80A(1)(b)) and
c)      where the application raises issues that require an urgent decision (section 80A(1)(c)).
Under section 80B(1) of the Privacy Act, the effect of such a determination is that the agency is taken not to breach the specified Information Privacy Principle when doing an act, or engaging in a practice, which is described in the determination. IPP 11 is raised in the application as the Privacy Principle against which a determination is sought. 
Consideration given to IPP 11
IPP 11.1 provides that a record-keeper who has possession or control of a record that contains personal information shall not disclose the information to a person, body or agency (other than the individual concerned) unless certain specified circumstances, which are set out in paragraphs 11.1 (a) to (e), exist.
It is clear that disclosing personal information without the individual student visa holder’s consent would or may constitute a breach of IPP 11 unless an exception prescribed in that Principle applies.
I accept the Department’s view that it is impractical to gain consent in these circumstances as the Department does not hold current contact details of international students. In particular, the Department advised that contact information is collected for the purposes of processing student visas but is not maintained for the purposes of ongoing contact during the life of the visa and beyond. Further, from the circumstances set out in the application, it is unlikely that the Department could rely on any other exception.
In recognition that seeking consent is not practicable, the Department has proposed it take measures to inform the majority of the target group. Whilst alerting students to the AIC research project may not meet the requirements for disclosure of information under IPP 11, I consider it to be an appropriate measure. Attachment A of my Determination requires that the Department notify students of the research project through their website and allow them sufficient time to opt-out of the disclosure of their personal information. This notice is also to be placed on Australian Embassy or High Commission websites in the People’s Republic of China, India, the Republic of Korea, Malaysia and the United States of America.
I am satisfied that the act or practice described in the application would or may constitute a breach of IPP 11, as required by section 80A(1)(a).
 
 
Does the public interest in allowing the applicant to breach IPP 11 outweigh to a substantial degree the public interest in adherence to the principle?
Generally, an individual has a right to be informed as to the handling of their personal information and to have some measure of control over how their information is disclosed.
When considering a potential interference with privacy, it is necessary to consider other matters that may compete with privacy such as the possibility of risks to the safety of members of the community.  In particular section 29 of the Privacy Act requires that I have due regard for the protection of important human rights and social interests that compete with privacy.[1] With this requirement in mind, I considered that it is in the interest of the broader Australian community, that Australia takes action against any perceived victimisation or crime involving discrimination against specific groups of people.
 
The Council of Australian Governments (COAG) has agreed to implement measures to improve the safety and wellbeing of international students and to ensure the ongoing quality and sustainability of the sector.[2] The AIC research will assist in informing the practical implementation of this policy objective of the Australian Governments.
There are public interest considerations in obtaining an accurate picture of the perceived victimisation of international students. Developing an understanding of whether or not the nationality of victims is relevant to attacks on students is necessary to determine the appropriateness of actions taken by governments and police jurisdictions in Australia. The community will benefit from the knowledge gained from the research through the implementation of better targeted responses to ensure public safety and community cohesion.
There are also public interest reasons in maintaining Australia’s international standing. Specifically, international education constitutes an important part of the Australian economy and is of significant export value. The industry also provides flow-on benefits to other parts of the economy, including non-economic benefits which are of benefit to the broader Australian community. The AIC research will assist in addressing the concerns of foreign governments over the safety of their nationals within Australia.
The Department advises that there is no other viable way in which the proposed research could be conducted without the disclosure of a limited set of personal information. Due to the way in which police data has been captured in the past, it is not possible for any police jurisdiction to provide accurate statistics on the nationality of victims in incidents involving student visa holders or former student visa holders.
Alternate courses of action considered included longitudinal studies on the role of nationality and race in crimes in Australia and changes to police data collection practices. While these options may assist in the provision of future data, they will not address the immediate issues raised about the safety of international students. I also considered that these alternate methods may give rise to separate privacy issues through the increased collection and retention of personal information.
Having regard to the conditions to be imposed on the disclosure set out in Attachment A of my Determination, I consider that the proposed disclosure of personal information will be strictly limited and controlled. In particular, I note that the provision of personal information will be a once only arrangement for the sole purpose of the AIC research project.
The use and disclosure of information provided to the police jurisdictions will be strictly controlled.  In particular, the information provided to the police jurisdictions is only to be matched against details of victims of crime and the police will not send matched information to the Department.  Further, upon completion of the exercise, all data provided to the police is to be deleted and the final dataset held by the AIC will be permanently de-identified. By introducing privacy safeguards and clearly specifying the purposes for which information can be used and disclosed, these conditions on the disclosure of information reduce the risk of harm and unintended consequences for individuals.
For these reasons, as required by section 80A(1)(b), I am satisfied that the public interest in allowing the Department to disclose information about certain student visa holders in the circumstances set out in Attachment A of my Determination substantially outweighs the public interest in adhering to IPP 11 in this case.
Does the application raise issues that require an urgent decision?
As required by section 80A(1)(c) I am satisfied that the matter is urgent and there is a requirement to issue a TPID.
Timely AIC research will assist in achieving the Australian Government’s objectives of obtaining a better understanding of the level and nature of crime against international students, and the underlying issues and perceptions about Australia.

[1] Section 29(a)
[2] Council of Australian Governments Meeting 19 and 20 April 2010, Canberra Communiqué,
page 12