Scott Morrison ensured asylum seeker data breach probe failed, court finds
|
Version 0 of 1. Former immigration minister Scott Morrison instructed his department to set up a process guaranteed to fail for handling a major data breach that disclosed the personal details of almost 10,000 asylum seekers, a landmark federal court decision has found. The ruling found the immigration department responded to a data breach disclosing the personal details of thousands of asylum seekers in a way that was “unfair to a significant degree” and had not provided procedural fairness to asylum seekers affected. Related: Immigration Department data lapse reveals asylum seekers' personal details The extraordinary comments by three federal court judges – in a unanimous decision – are highly critical of the immigration department and the instruction given by the minister. The case may have a profound impact on the future processing of thousands of asylum seekers affected by the data breach. It also raises concerns from any asylum seekers who may already have been removed from Australia or from offshore detention centres affected by the breach. In February 2014 Guardian Australia revealed that the names, date of birth, nationalities and other personal identifiers of almost 10,000 asylum seekers held in detention had been publicly disclosed by the immigration department on its website. The disclosure sparked fears the asylum seekers identities may have been revealed to their countries of origin, which could put them at risk of further persecution. The federal court case was one of many that have been steadily working through the courts since the breach arguing their protection claims needed to be reconsidered. It centred around two key asylum seeker plaintiffs affected by the breach, and a third that was not affected and was dismissed. In a joint ruling justices Steven Rares, Nye Perram and John Griffiths upheld the applications for judicial review, and found the immigration department had failed to provide procedural fairness. Their ruling was highly critical of the immigration department’s handling of the measures they later set up to respond to the breach. They said the “procedures were unfair to a significant degree” and ordered the department to pay the asylum seeker’s costs. The secretary of the immigration department had sent out letters to all affected asylum seekers outlining that they would be given an opportunity to raise concerns about the breach. A limited process was established by the department to quickly assess the potential impacts of the breach. Asylum seekers were only given two weeks to put their cases to the department. The department also declined to provide full information about the extent of possible disclosure in foreign countries. Related: Tim Wilson says Morrison response to asylum seeker data breach ‘undesirable’ The plaintiffs relied in part on a report commissioned by KPMG – which was also obtained by Guardian Australia under freedom of information laws – to highlight the potential disclosure of the data in countries such as China and Russia. The court ruled they were entitled to procedural fairness in the process surrounding the breach, following from the letters sent by the secretary. “The three letters from the department suggested that it would hear from [the applicant] ... prior to making a decision. They were sufficient to suggest to him that he was going to be given a fair hearing,” the judgment said. The judges were also scathing of the department’s suppression of information about the breach, and their refusal to release an unabridged version of the KPMG report. They pointed to the potential conflict at the heart of the immigration department’s conduct, with the department inviting asylum seekers affected by the breach to put forward a case to the very organisation that had engendered the privacy breach. “What we will say is this. The department is requiring affected individuals to make submissions to it about the consequence of its own wrongful actions in disclosing their information to third parties without revealing to them all that it knows about its own disclosures,” the judgement said. They continued to say the department “is conflicted in its role in assessing what the non-refoulement obligations are which arise from its own wrongful conduct ... at the very least, in a practical way, it undermines fairness to suggest that in such an unusual situation the department does not have to reveal the full circumstances so that the person affected can assess, with full information, whether some adverse impact occurred.” The review officers within the department were ordered to consider only that the asylum seekers’ personal details “may” have been accessed by the governments they were fleeing, and even the review officers were not entitled to view the full unabridged version of the KPMG report. The judges then went on to say the direction given by the immigration minister – who at the time was Scott Morrison – essentially set up the asylum seeker to fail. “Setting the bounds of the debate so that all that will be known is that the authorities in the receiving country ‘may’ have accessed the information means that this test will necessarily be failed.” This instruction erects a process guaranteeing the claim will fail. It is not fair. “[The applicant] will need to show that the information was accessed and by whom and why access by those people poses such a significant risk. Far from ameliorating the want of procedural fairness, this instruction erects a process guaranteeing the claim will fail. It is not fair.” The judges went on to grant one asylum seeker a final injunction, essentially saying they doubted the immigration minister’s promise the asylum seeker would not be removed should be accepted. “The processes adopted in ... [the applicant’s] case are sufficiently unfair as to raise in our minds a real question as to whether he can now be expected to trust, on the present evidence, the reliability of the department’s own assessment of what is fair,” they said. “This is particularly so where the department is, in effect, investigating itself despite the inherent conflict that this unusual process potentially generates. [The applicant] should not be required to run the risk that the department can navigate the perils thrown up by this conflict without further mishap.” Related: Factcheck: it took only three clicks to expose the asylum seekers' data The comments surrounding the process set up by the immigration department strongly suggest the department will need to revise how it has handled the data breach. Guardian Australia contacted the immigration department to query what steps would now be taken to assess asylum seekers affected by the breach, and to ask whether the department would appeal to the high court. The department has not yet responded. The serious data breach sparked an investigation by the privacy commissioner, who found the department had breached the privacy of the asylum seekers involved. Hundreds of complaints have been lodged with the Office of the Australian Information Commissioner surrounding the breach, which could cause the department have to pay hundreds of thousands in compensation. |