Nomination for the Australian Privacy Foundation ‘Big Brother Awards’ 2009 
BBA 2009 FINALIST 

Criteria for a BBA 2009 Award
The nominee must  be:
•	in or associated with Australia
•	responsible for a truly outstanding abuse (or defence) of privacy.
As appropriate for the particular Award Category the nominee should be a public or private sector individual or organization, a government program or initiative,  a private sector business activity.
The deed for which they are nominated should have at least partially been put into practice – they lose points for just planning or announcing something!  Further details about BBA2009 are available at http://www.privacy.org.au/bba/.

A.	Name of Nominee 

The Biometrics Institute 

B.	Award Category - Privacy Abuser for an “Orwell” Award 

Worst Corporate Invader – for a corporation that has shown a blatant disregard for privacy.

C.	Description
Award is for misleading and deceptive conduct in relation to its Privacy Code.

The Biometrics Institute ‘owns’ one of the few Codes of Practice registered under Part IIIAA of the Privacy Act 1988.

Registered Codes have the effect of substituting for the ‘default’ National Privacy Principles (NPPs).  For organisations that are bound by a Code, their compliance is assessed against the Code provisions rather than the NPPs.  To approve a Code, the Privacy Commissioner must be satisfied that it incorporates all of the NPPs or sets out obligations that, overall, are at least the equivalent of the NPPs. The Privacy Commissioner approved and registered the Biometrics Industry Privacy Code in September 2006. The Code includes all of the NPPs but also has some additional principles, which were welcomed at the time as potentially significant additional privacy protections.

As of 9 October 2009, the Biometrics Institute website shows the Code as having 5 ‘subscribers’ all of which are ‘service provider’ members of the Institute. The Institute claims to have more than 100 members – including many large government and private sector users, and many suppliers, of biometric technologies.  None of these members have to our knowledge ever subscribed to the Institute’s privacy code in the three years of its existence.

While subscribing to the Code would have no legal effect for government agencies, which are typically subject to different privacy principles, and never to the NPPs, there is no reason why a government agency could not voluntarily agree to follow the Code provisions, and the Institute website encourages this, as well as suggesting that agencies could give preference to suppliers who are Code subscribers.

D. 	Evidence of the Actions and References

See http://www.biometricsinstitute.org/displaycommon.cfm?an=1&subarticlenbr=8 

E.  	Why the Nominee Deserves the Award:
Scope of the Impact
The misleading effect of the Biometrics Institute Privacy Code (see below) potentially affects every Australian, and also individuals in other countries affected by the activities of Institute members. Any of these individuals may be led to believe that the existence of the Code provides, in practice, some effective privacy safeguards over and above the statutory minimum. 
Seriousness of the Impact
The Biometrics Institute has routinely publicised its Privacy Code – on its website, in newsletters and at conferences. While we have no direct evidence of Institute members who are not Code subscribers referring to the Code, it is difficult to see that they would not benefit incidentally from any awareness of the Code, amongst potential users, public policy-makers and the public at large.

The continued promotion of the Privacy Code by the Institute, while it remains largely unadopted and unused, verges on false advertising or even deceptive and misleading conduct (in Trade Practices Act terms).

The impression given is that the Biometrics industry in Australia takes privacy protection seriously and has gone beyond the minimum requirements of the Privacy Act.  The reality is that the vast majority of users and suppliers of biometric technology have no obligations beyond those minimum legal requirements.  For those that are members of the Institute but who have not subscribed to the Code, they are obtaining an unwarranted benefit ‘by association’ with any public impression the existence of the Code may give.

F. 	Other Comments
This nomination form was emailed to the Biometrics Institute for comment on 19 October for comment by 31 October 2009. No response was received from Biometrics Institute by the Coordinator of BBA2009 by 1 November 2009.