Data Sharing and Analytics and the Identity-matching Services Bill 2019 – what are the implications for directors?
Introduction: The Department of Home Affairs, the Australian Border Force, Data Matching and the Identity-matching Services Bill 2019 allows unprecedented levels of integrated data collection, sharing and analysis capabilities.
It is no longer a simple process of applying for a visa or becoming an approved sponsor, but rather a whole of enterprise risk management system, which enlivens director’s liability and requires better governance and risk oversight.
Department of Home Affairs
The Home Affairs’ Portfolio includes the Department of Home Affairs, the Australian Border Force, the Australian Federal Police, the Australian Criminal Intelligence Commission and the Australian Security Intelligence Organisation, and the Australian Transaction Reports and Analysis Centre (AUSTRAC).
The Home Affairs’ Portfolio supports a federation of independent security and law enforcement agencies, including the Australian Border Force, which while established in the Department of Home Affairs, is operationally independent.
The Department of Home Affairs includes the former Department of Immigration and Border Protection and is responsible for the management of Australia’s borders and Migration Program.
Australian Border Force
The Australian Border Force is Australia’s front-line border law enforcement agency and Australia’s custom service.
The Australian Border Force has a significant range of responsibilities for Compliance and Regulation, including sponsorship monitoring and compliance with sponsorship obligations.
In the case of sponsor monitoring, this is undertaken by officers of the Sponsor Monitoring Unit who are sworn, non-uniformed officers of the Australian Border Force, Immigration Compliance Branch.
Data Matching Program to Enhance Compliance in the Temporary Skilled Visa Program with the ATO
The Department of Home Affairs continues to advance its digital processing model including lodgement, assessment and decision-making on visa applications, all of which are lodged online and allow for an integrated approach to information and data sharing, and predictive analytics.
Data matching is increasingly used by Commonwealth and state agencies to effectively detect and deal with compliance risks through the use of risk detection models and to improve decisions, services and compliance.
The Data Matching Program to Enhance Compliance in the Temporary Skilled Visa Program came into effect in January 2019. It allows the Department of Home Affairs and the Australian Border Force to exchange extensive data with the ATO to “effectively detect and deal with compliance risks in the temporary skilled visa program”.
The particular focus of the Data Matching Program to Enhance Compliance in the Temporary Skilled Visa Program is to identify:
- Temporary skilled visa holders who are not working in the occupation in which, or for the employer by whom, they were sponsored
- Sponsors who are breaching their sponsorship obligation, including by incorrectly paying temporary skilled visa holders.
Significant data is matched including relating to identity, visa, citizenship, travel documents, visa grants, migration agents’ details, employer/Sponsor data, sponsorship approval, nomination approvals, nominated base salary and total remuneration, postcode of work location, occupation code of worker, and such like.
The ATO provides to the Department of Home Affairs the tax file numbers (TFN) of temporary and permanent skilled visa holders and sponsoring employers including:
- Income details from Income Tax Returns and Payment Summaries
- Employment details from TFN Declarations, Income Tax Returns and Payment Summaries
- ABNs for all employers who issued the visa holder a payment summary, or who the visa holder has declared on their TFN Declaration or Income Tax Return
- Related data from Single Touch Payroll.
Data matching will enable the identification of instances:
- Where ATO data shows that income declared to the ATO is less than what the approved sponsor was to pay to a visa holder
- Where ATO data shows that a visa holder has received income from multiple employers
- Where the visa holder may be working in an occupation other than an approved occupation.
Integration of data to fully exploit information and identify non-compliance is part of an increasingly robust regulatory framework, which allows for large-scale data analytics.
This significant level of regulatory scrutiny heightens directors’ responsibilities in the migration area, with the Enhanced Integrity Act allowing the Minister of Home Affairs to publish the business or trading names of businesses that failed to meet applicable Sponsorship Obligations.
The Department will publish an analogous level of detail as is currently published by the Fair Work Ombudsman (FWO) including business names, Australian Business Numbers and specific details of their adverse compliance outcome.
The public disclosure of Sponsors’ adverse compliance outcomes is seen to support public confidence in the integrity of the skilled migration programs by demonstrating that action will be taken in respect of Sponsors that breach their legal requirements.
It is no longer a simple process of applying for Sponsorship, Nomination and/or Visa application approval. Directors must ensure that they understand, mitigate and manage risk as a whole of enterprise risk management system and corporate culture, which ensures better governance and risk oversight.
The implications for director liability under the Enhanced Integrity Act are significant and the consequences of ‘naming and shaming’ will impact adversely not only on the business but also its directors and high managerial agents.
Identity-matching Services Bill 2019
The unprecedented commitment to protecting and managing Australia’s borders and meeting Australia’s economic needs requires agile and dynamic systems and processes, which are responsive but also anticipatory to enable the seamless sharing of critical information.
This includes reforms in border processing, biometric systems, the building of new capabilities for visa and citizenship processing which deliver regulatory compliance systems and support improved risk.
The sharing of information and data across government agencies, including the Home Affairs’ Portfolio, the Department of Home Affairs, the Australian Border Force and the ATO is part of an ‘intelligence-led and technologically enabled’ regulatory approach, which employs sophisticated risk assessments with the aim of delivering compliance and enforcement outcomes.
The Identity-matching Services Bill 2019 (the Bill) aims to facilitate the secure, automated and accountable exchange of identity information between Commonwealth and state and territory governments.
In accordance with the objectives of the Intergovernmental Agreement on Identity-matching Services, the Bill will authorise the Department of Home Affairs to collect, use, and disclose identification information in order to operate the technical systems that will facilitate the identity-matching services.
The Bill will support the collection, use and disclosure of facial images and related identity information, including passports, visa and citizenship images between Commonwealth and all states and territories for purposes including:
- Preventing identity crime
- General law enforcement
- National security
- Protective security
- Community safety
- Road safety
- Identity verification.
The Bill once it becomes law, will result in an identity-matching service which will be delivered via the inter-operability hub that the Department of Home Affairs will operate. The inter-operability hub will facilitate data-sharing between agencies on a query and response basis, with the aim to facilitate the secure, automated and accountable exchange of identity information between Commonwealth and state and territory governments.
The Bill proposes that driver licence images will be made available by the establishment of a National Driver Licence Facial Recognition Solution, hosted by the Commonwealth on behalf of the states and territories.
The National Driver Licence Facial Recognition Solution will consist of a federated database of identification information contained in government identification documents, including initially driver licences issued by state and territory authorities, and a facial recognition system for biometric comparison of facial images against facial images in the database.
The Identity-matching Services will also check the person’s photo against the passport or driver’s licence image and such like.
The Department of Home Affairs already gathers extensive information and documents (including with the use of personal identifiers or biometrics).
The Bill is another example of data matching and a whole of government approach to minimising the harms caused by identity crime and improve Australia’s national security, law enforcement, community safety and road safety capabilities.
Corporate culture and the liability of directors
The government continues to implement measures to strengthen the integrity of Australia’s national security and temporary and permanent employer sponsored skilled migration programs.
The gathering and sharing of information, including by the Department of Home Affairs using its online digital processes and data matching and analytics, is part of an increasingly stringent and robust regulatory framework.
Enhanced data matching through TFN sharing and sponsor monitoring, aims to identify sponsors that breach their obligations such as for example, underpaying visa holders, and otherwise contravening the Migration Act 1958.
The sharing of information between the Department of Home Affairs and the ATO will assist the Department of Home Affairs and the Australian Border Force to undertake more streamlined, targeted, and effective compliance activities.
The publication of the name of the business, the Australian Business Number and the particulars of sponsorship breach, means that personal information will be published at an analogous level of detail as is currently published by the FWO.
The limitation on the right of privacy is justified on the basis that it is in the public interest to be aware of the Department of Home Affairs’ compliance activities in this area.
The identity-matching service which will be delivered by the Department of Home Affairs will facilitate the exchange of identity information between Commonwealth and state and territory governments, in the community’s interest to minimise identity crime and maintain law enforcement and community safety capabilities.
Data collection, sharing and analysis requires an overall enterprise risk management system across the entire visa spectrum, pre and post-lodgement and approval, noting that everything that is lodged with the Department of Home Affairs enables automated analysis and enlivens risk.
With data as the new ‘oil’, it is not a simple matter of just getting a visa approved.
Boards and directors face a range of contemporary and evolving challenges associated with data, governance and management.