Allens: Biotech News

Allens Biotech News is a fortnightly news service to keep you on top of developments in this fast-moving industry.

Feature article: Privacy Commissioner's biometrics recommendations in response to ALRC privacy review
Company News
BioTip: Provisional patent applications
Events

Feature article: Privacy Commissioner's biometrics recommendations in response to ALRC privacy review

In brief: Partner Peter Jones and Law Graduate Valeska Bloch provide an outline of the Privacy Commissioner's recent recommendations on biometrics in response to the Australian Law Reform Commission Review of Privacy.

Introduction
Why are biometrics a privacy concern?
Recommendations relating to biometrics
Conclusions

Introduction

The development of new biometric technologies, the increasing frequency of identity fraud and discussions about a national identity card have emphasised the need to rethink our approach to privacy, which was developed almost 30 years ago.¹

A review of Australia's privacy law is being conducted by the Australian Law Reform Commission (the ALRC). The Office of the Privacy Commissioner has recently responded to the 142 questions posed by the ALRC in Issues Paper 31 by putting forward a submission (the submission) for the ALRC's consideration.

The submission emphasises the need for national consistency in privacy legislation, arguing that this would reduce compliance difficulties and help individuals to understand and exercise their privacy rights. It also recommends further research into the development of a tort of privacy. However, one of the newer areas raised in the submission is biometrics. A central theme of the submission is the need for strict privacy protections for biometric information, having regard to its sensitivity and the increasing ease with which it can be obtained.

The Privacy Act 1988 (Cth) regulates the collection, handling and disclosure of individuals' personal information by government agencies, all large private sector organisations, health service providers and some small businesses.

Return to top

Why are biometrics a privacy concern

'Biometric technology records unique physical human traits for the purposes of later recognition, identification or authentication of an individual.'² When the current privacy principles were developed, biometric technology was largely limited to ink fingerprints. Today, however, biometric technology has greatly enhanced capabilities, including voice, iris and facial recognition and DNA identification. Furthermore, other new technologies have facilitated the ease with which personal information can be disseminated, stored and accessed.

The submission identifies the following risks with the use of biometric identifiers:

the enhanced capacity for data linking and function creep associated with the use of unique identifiers ('function creep' is what occurs when a procedure designed for a specific purpose ends up serving another purpose);
the difficulty of re-securing biometric information once its security has been breached (eg it is possible to issue a customer with a replacement credit card if security has been breached, however it is not possible to do the same for a biometric indicator);
the capacity for covert collection and monitoring of biometrics (eg facial recognition technology may be utilised without the subject's knowledge);
revealing more information than is necessary for a transaction (eg iris recognition and retinal scans may also reveal health information, which is recognised as being more sensitive); and
the commonly presumed accuracy of biometric technologies, particularly where individuals are incorrectly identified

Return to top

Recommendations relating to biometrics

As a result of these risks, the submission makes the following recommendations:

biometric information should be included within the definition of 'sensitive information' under section 6 of the Privacy Act. The submission notes that care would be required to ensure that a distinction is drawn between 'raw' biometric information (such as a photograph of someone) and information that is collected expressly in the form of biometric data for the purpose of generating a digital representation that would identify an individual;³
all organisations, including small businesses, that handle biometric information should be covered by the Privacy Act, to limit how they handle that information in a manner similar to the treatment of health information; and
the definition of 'identifier' should be clarified to include 'a number, symbol or other particular' assigned to an individual to uniquely identify the individual for the purposes of the organisation's operations. Currently, 'identifier' is defined in the Privacy Act to include:

a number assigned by an organisation to an individual to identify uniquely the individual for the purposes of the organisation's operations. However, an individual's name or ABN [...] is not an identifier.⁴

Return to top

Conclusions

The extension of the Privacy Act to specifically protect biometric information is a logical follow-up to the 2006 reforms regarding the inclusion of genetic information and recognises the potential for abuse of biometric identifiers. The higher standard of protection afforded to sensitive information is to be welcomed for biometric information, but cannot be accorded to biometric information without legislative amendment.

Footnotes

Australian Government Officer of the Privacy Commissioner, Submission to the Australian Law Reform Commission's Review of Privacy – Issues Paper 31, February 2007, p6.
Submission to the Australian Law Reform Commission's Review of Privacy – Issues Paper 31, p422.
Submission to the Australian Law Reform Commission's Review of Privacy – Issues Paper 31, p424.
Privacy Act 1988 (Cth), NPP 7.3, Schedule 3.

Return to top

Company news

In brief: Regular news from the biotech industry.

Acrux US licensee VIVUS sub-licenses EvaMist rights to KV Pharmaceutical
Dendreon prostate cancer drug Provenge positively reviewed by FDA Advisory Committee
Merck & Co type 2 diabetes drug Janumet approved by FDA
Mesoblast apply to FDA to begin a revolutionary trial of stem cell therapy in heart attack patients
pSivida signs Collaborative Research and Licensing Agreement with Pfizer
Purdue Pharma L.P. announces agreement to end OxyContin® patent lawsuit with IMPAX laboratories
Roche acquires BioVeris to expand immunochemistry business
Roche acquires gene sequencer 454 Life Sciences
Stem Cell Sciences closes share offer early

Acrux US licensee VIVUS sub-licenses EvaMist rights to KV Pharmaceutical

2 April – Australian biotech company Acrux reported that its US licensee VIVUS has executed an agreement to sub-license its rights and assets related to Acrux's Estradiol MDTS® (EvaMist™ in the US) to KV Pharmaceutical Company. EvaMist is a small hand held spray designed to deliver a preset dose of estradiol via the skin. KV Pharmaceutical will be responsible for the manufacturing, selling, marketing and regulatory requirements once the product is approved by the FDA. Under the agreement VIVUS is eligible to receive an upfront payment of US$10 million and an additional US$140 million upon the approval of the New Drug Application for EvaMist. Acrux Chairman Ross Dobinson commented 'With the transaction valued at more than US$150 million, this is strong independent validation of the value of our spray technology, applied to one product in a single market'. Acrux's rights under its license to VIVUS will remain unchanged by this transaction.