Privacy part A - Collection, use and disclosure of information

We only collect personal information for purposes reasonably necessary for, or directly related to the Department’s functions or activities, pursuant to the Administrative Arrangements Orders and portfolio legislation, including but not limited to the Customs Act 1901, the Migration Act 1958 and the Citizenship Act 2007.

Personal information (including sensitive information) will only be used or disclosed for the purpose for which it was collected unless the law requires or permits use or disclosure for another purpose or permission is given by the individual to use or disclose the information for another purpose.

Online, all interactions between the clients and us are protected by an industry standard 128-bit SSL encryption technology. Firewall technology is employed to help to protect our internal systems and personal information against intrusion from the internet.

Personal information is stored in compliance with Australian Government security requirements. All access is audited and monitored by us and employees are trained on security rules and privacy issues.

If clients are concerned about the inherent risks associated with transmission of information over the internet, we can communicate with them through other avenues.

How we collect information

Our usual practice is to collect personal information directly from the individual or their authorised representative, including through interviews, application forms and other official forms. We often also collect personal information from other sources. These include third parties or a publicly available source. Third parties include other Australian government agencies, law enforcement agencies, foreign governments, sponsors, medical practitioners, organisations that a person has nominated, education providers, employers, and members of the public who contact us with information.

What we collect and the purpose of collection

Our primary purpose when collecting personal information is to carry out our functions or activities or border management. We manage the following programmes:

  • visa and migration
  • customs and excise
  • Certain Australian laws including taxation, health, quarantine, commerce, criminal, intellectual property and community protection laws
  • refugee and humanitarian assistance
  • border management
  • visa compliance and immigration status resolution
  • immigration detention, removal or transfer to a regional processing country
  • citizenship.

We also conduct the following administrative activities:

  • processing freedom of information (FOI) and privacy requests
  • personnel information – staffing related matters
  • complaint handling procedures
  • maintaining our website.

Set out below are the kinds of information we collect, hold and the purpose for the collection.

Visa and migration

In order to process visa claims and migration applications we collect a wide variety of personal information. The type of information collected will vary depending on the type of visa sought. In general the collection of personal information includes:

  • name, date of birth, gender, country of residence or citizenship, country of birth, passport number, passport expiry date, visa grant details, contact details (address, email address, telephone numbers), employment status, occupation/career history, qualifications, English proficiency, enrolment details, family details, health details, medical reports, x-ray images, criminal history, personal identifiers, copies of any identity documents, financial details, information for the purpose of determining age.

Customs and excise

Certain Australian laws including taxation, health, quarantine, commerce, criminal, intellectual property and community protection laws

Refugee and humanitarian assistance

The refugee and humanitarian programme facilitates the humanitarian programme outside Australia and protection programme in Australia. Both require the collection of the following types of information:

  • name, date of birth, gender, country of residence, citizenship, country of birth, ethnicity, religion, main language, family history, reading proficiency, English proficiency, occupation /career history, years of schooling, years of further education, background, months in refugee camp, medical alert, torture/trauma issues, protection claims, interpreter requirements, criminal history, personal identifiers, copies of any identity documents.

Border management

The border management programme facilitates the entry of genuine travellers to Australia while preventing entry of those likely to threaten Australia’s national interests such as explaining the need for identity, health, character and security checks. We also facilitate the transfer of goods over the Australian border. As part of this programme we record the arrivals and departures of travellers and goods to and from Australia. Movement records collect the following:

  • name, date of birth, gender and relationship status, country of birth, departure and/or arrival date, travel document number and country, port code, flight/vessel details, visa subclass and expiry date.

In addition, the border management programme collects personal identifiers – facial images and fingerprints – from people entering and leaving Australia, people in immigration detention, including illegal maritime arrivals and foreign fishers, applicants for entry into Australia and people who apply for a protection visa in Australia.

Visa compliance and immigration status resolution

Visa compliance and immigration status resolution programme is responsible for the detection and location of persons who have no lawful authority to be in Australia or people in breach of their visa condition(s). The programme is responsible for the cancellation or refusal of visas to non-citizens who might be of concern to the public for reasons such as their involvement in serious criminal activity. In general the collection of personal information includes:

  • information and intelligence from other government agencies, organisations and foreign governments
  • allegations
  • employment information
  • information obtained through warrants
  • foreign immigration intelligence
  • personal identifiers such as fingerprint images and facial images
  • surveillance reports
  • interview reports from third parties.

Immigration detention, removal or transfer to a regional processing country

This includes service providers and foreign authorities in support of offshore processing, such as law enforcement, the provision of welfare services and settlement. The collection of personal information for immigration detention, removal or transfer to a regional processing country includes:

  • name, date of birth, gender and relationship status, country of birth, ethnicity, religion, main language, family history, reading proficiency, English proficiency, occupation, years of schooling, years of further education, background, medical alert, torture/trauma issues, interpreter requirements, criminal history, personal identifiers, copies of any identity documents, security assessment, care plan notes, incidents and visitor information, information for the purpose of determining age.


Assessment of citizenship applications requires the collection of the following information:

  • name, date of birth, gender, address, permanent residence date, arrival date, previous citizenship, previous country of residence, family history, employment history, character details including criminal convictions, court proceedings, charges and confinement in prison or mental health institutions, citizenship testing results and history of dealings with the department including migration history and in some cases a medical report or certificate.

Administrative activities

Requests under the Freedom of Information Act 1982 (FOI Act) and the Privacy Act
The collection of personal information includes name, contact details such as address, telephone number, email address/es, details of the request, personal identification details for personal information access requests.

Complaint handling procedures
This includes complaints lodged with the Ombudsman’s Office, Office of the Australian Information Commissioner, Australian Human Rights Commissioner and complaints lodged with our Global Feedback Unit. The collection of personal information includes details of the complaint and personal information relevant to investigating the complaint.

Personnel information
Staffing related matters including details for staff administration, including for processing salaries, information about security clearances, performance management, Code of Conduct investigations and injury management. This includes ongoing staff, non-ongoing staff, contractors and consultants. The collection of personal information includes: name, date of birth, address, contact telephone numbers, tax file number, next of kin, information related to security clearance, staff development, training details, medical information, compensation details, salary/payment details and details of accounts with financial institutions.

Maintaining our website
We operate our webs​ite with outsourced technical assistance.

A record of each visit to the site is logged. Information is recorded for statistical purposes and is used by us to monitor the use of the site, discover what information is most and least used and to make the site more useful to users.

The information we log when users access our website includes:

  • the person’s IP or server address
  • the date and time of the visit to the site
  • the pages accessed
  • the person’s operating system
  • the person’s web browser version and type
  • the time taken to transmit information to the person
  • the previous internet address from which the person came directly to this website.

This information is analysed to show broken links on our website, bottlenecks, and other site problems. We use this information to maintain the site for efficient use.

No attempt is made to identify the person through browsing activities except in the event of an investigation into the improper use of our internet facility or alleged interference with privacy, or where an enforcement body exercises a warrant to inspect the Internet Service Provider's logs.

Use of personal information

We will use personal information for the purposes for which it was collected, and for secondary purposes where permitted by law or where permission is given by the individual.

Personal information is frequently used for a secondary purpose where enforcement-related activities are being conducted or in circumstances where a person would reasonably expect us to use the information and the secondary purpose is either directly related to the primary purpose (for sensitive information) or related to the primary purpose (for other personal information). For example, the information provided for the primary purpose of processing one visa or citizenship application can be used for the secondary purpose of subsequent applications (including under the FOI and Privacy Acts).

Disclosure of personal information and the purpose of disclosure

The Privacy Act allows us to disclose personal information for the primary purpose for which it was collected. Personal information may be disclosed for a secondary purpose in certain circumstances. Generally, this is where a person would reasonably expect us to disclose the personal information for the secondary purpose, and the secondary purpose is either directly related to the primary purpose (for sensitive information) or related to the primary purpose (for other personal information).

Usual disclosures to other Government Agencies

Usual disclosures to other government agencies include disclosure to confirm identity, verify the authenticity of documents provided, undertake data matching, or to manage compliance obligations.

Other Australian government agencies also have power under Australian law to obtain certain personal information from us for the purpose of administering their portfolio legislation. Government agencies that we exchange information with include but are not limited to:

  • Department of Human Services
  • Department of Social Services
  • Department of Industry
  • Child Support Agency
  • Medicare Australia
  • Department of Education
  • Department of Employment 
  • Department of Veteran’s Affairs
  • Australian Tax Office
  • Department of Foreign Affairs and Trade
  • Australian Electoral Commission.

Disclosure to nominated representatives

Where a person has nominated a third party, such as a family member, migration agent, travel agent, airlines, Ombudsman, Member of Parliament, or solicitor to be their representative personal information will be disclosed to those third parties.

Review, audit and investigation bodies

If a person applies for merits or judicial review of a decision, we will provide relevant personal information to the tribunal or court conducting the review.

We disclose information to investigation bodies such as:

  • Commonwealth and Immigration Ombudsman
  • Office of the Australian Information Commissioner
  • Australian National Audit Office
  • Australian Human Rights Commission
  • Fair Work Ombudsman
  • Fair Work Commission.

Disclosures to licensing authorities

We may disclose information to licensing authorities about migration status and work entitlements. This information will be used to assess suitability to hold a professional licence.

Authorised disclosure of personal information

We have authority under Part 4A of the Migration Act 1958 (Migration Act) and section 43 of the Citizenship Act 2007 (Citizenship Act) to disclose personal information including personal identifiers in a range of circumstances. Examples include:

  • to verify citizenship or visa status
  • for the enforcement of criminal law
  • exchanging identifying information under an arrangement with an Australian government agency
  • making relevant information available to a court, tribunal, or investigating body
  • where required by Australian law.

The department also has authority under the Citizenship Act to disclose personal identifiers for the purposes of citizenship or migration legislation.

Part 4A of the Migration Act also authorises the department to disclose personal information (including personal identifiers) in the following circumstances:

  • data matching to:
  • identify, or authenticate the identity of a person
  • facilitate processing people entering or departing from Australia
  • identify non-citizens who have a criminal history, are of character concern or are of national security concern
  • combat document and identity fraud in immigration matters
  • assist processing protection claims
  • to identify or locate a person
  • to prescribed investigatory bodies such as the Australian National Audit Office and the Australian Human Rights Commission
  • to make arrangements with foreign governments for removal from Australia or for the purposes of extradition of a person to and from Australia
  • to make the information available to specified foreign governments, law enforcement or border control bodies of foreign governments, or specified international organisations for the purposes of managing migration issues
  • for obtaining or giving assistance in international criminal matters.

In relation to worker visas, we are authorised to disclose certain personal information about sponsors or visa holders to the corresponding visa holder or sponsor.

Disclosure of Movement Records

Arrival and departure records of travellers to and from Australia are stored in a movement records database and may be disclosed for the purposes of:

  • the Migration Act 1958
  • the Family Law Act 1975
  • customs or excise laws
  • quarantine or health laws
  • law enforcement
  • the Education Services for Overseas Students Act 2000
  • prescribed Commonwealth, state or territory legislation, such as administration of first home owners programmes or children and/or welfare programmes.

Disclosure under the Privacy Act for law enforcement

We are authorised to disclose information to law enforcement bodies and intelligence bodies for the purpose of enforcing the criminal law, laws imposing a pecuniary penalty or for the purpose of protecting public revenue. Usual disclosures include to:

  • Australian and overseas law enforcement bodies to assess character issues
  • Australian and overseas law enforcement bodies and intelligence agencies or commissions, National Common Police Services, Interpol, regulatory commissions, parliamentary commissions of inquiry, international tribunals and overseas immigration authorities, to identify or investigate immigration fraud, national security issues, or suspected involvement in international crimes such as war crimes, crimes against humanity or genocide
  • the Australian Federal Police, under information-sharing agreements
  • the Australian Taxation Office, Centrelink and other Commonwealth or state and territory agencies, to assist the enforcement of immigration or visa conditions
  • the Australian Taxation Office and Australian police forces to locate unlawful non-citizens
  • the Director of Public Prosecutions prosecuting migration or citizenship offences
  • foreign governments for the removal of an unlawful non-citizen or transfer to a Regional Processing Country
  • registered educational institutions, employers, sponsored persons, sponsors and labour suppliers to monitor compliance with visa conditions and sponsorship obligations, and notify instances of sanctions imposition.


Contact details may be provided to Australian law enforcement bodies or emergency services in the event of an emergency, serious injury or death.

Other disclosures associated with programme management

Assurance of support

Information relating to people providing assurance of support will be disclosed to Centrelink to facilitate release of bonds paid or identification and recovery of debts incurred.

Employment, labour supply and business skills

We may disclose information about people’s migration status, work entitlements and the type and visa period of effect to employers, labour suppliers and third parties who use clients services through a labour supply arrangement. For example, when a person applies for work, we may disclose to the employer or labour supplier information about their eligibility to work.

We may also disclose information to state and territory economic development departments and agencies that help business skills migrants access government business information and services.

Training and education

Personal information may be disclosed to:

  • the Department of Foreign Affairs and Trade, Department of Industry and Department of Education to assist those seeking to undertake training or to study in Australia
  • the Department of Employment to determine any impact of a proposed workplace component on the Australian labour market
  • the Department of Education and delegated authorities to assess overseas qualifications for some classes of visas
  • educational institutions that provide English-language tuition under the Adult Migrant English Programme
  • the Australian Skills Quality Authority for the purpose of monitoring registered training organisations.


Details of health information as assessed for visa applications may be disclosed to government health agencies and medical providers to assist in determining whether the health requirement is met for granting a visa, for consideration of whether the health requirement should be waived, or for management of public health risks.

Refugee and humanitarian entry and on-shore protection

We may provide personal information concerning asylum seekers and applicants for protection or humanitarian visas to the United Nations High Commissioner for Refugees (UNHCR) for the purpose of verifying identity, and humanitarian or protection claims.

We may also provide personal information to the International Organization for Migration to assist its delivery of services.


We may provide personal information concerning people in immigration detention to:

  • state and territory welfare agencies in relation to detention arrangements, care for unaccompanied minors or detainees with physical and mental health disabilities
  • state and territory correctional services to facilitate transfers and confirm immigration status
  • schools, medical practitioners and health and welfare services providers, or migration advisors providing services to detainees or assessing options to assist the detainee.

We may provide personal information concerning people in immigration detention to independent observers contracted to participate in interviews involving minors. These observers are bound by the same privacy obligations that bind us.

Welfare and protection of children

The personal information of children, and/or parents/guardians of children, may be disclosed to child welfare and protection agencies to:

  • organise and monitor care and welfare arrangements in immigration detention and/or in the community
  • investigate possible abuse or neglect
  • facilitate travel arrangements and documentation.

Information relating to children entering Australia for adoption may be disclosed to adoptive parents, prospective adoptive parents and state/territory welfare organisations responsible for inter-country adoption issues.

With regard to children in detention, information may be disclosed to education providers to enable those children to be enrolled in school programs.

Embassies, high commissions and consulates

If a person is granted a visa on departure grounds or does not have a lawful basis to remain in Australia, they are expected to depart. If a person does not hold or cannot obtain a valid travel document within a reasonable timeframe, it is our usual practice to apply for such a document on behalf of that person. This allows arrangements for the departure to be made.

We will only provide the minimum information required by the appropriate embassy, high commission or consulate to facilitate provision of a travel document. This might include name, details of current passport or other identity documents and contact details.


We may provide personal information other than personal identifiers to:

  • local government councils and other organisations for the purpose of conducting and hosting citizenship ceremonies
  • the Office of the Governor-General and the Department of Prime Minister and Cabinet to consider applications for Australian honours
  • Members of Parliament and local government councillors for the purposes of welcoming new citizens into the Australian community.

Research, evaluations and surveys

Personal information may be used for surveys of current and former clients. We periodically use the personal information collected from visa applicants and those acting on their behalf to conduct and analyse research, evaluation and surveys about the department’s programs and services, insofar as it adheres to the confidentiality and privacy clauses in our contracts. However, we do not disclose personal information to the public. For example, our publications do not reveal information that could identify individuals. Where surveys are conducted, we will inform clients of how data will be used. Where research is conducted by a contractor, the contract will include conditions regarding the use and disclosure of information.

Personal information may be disclosed to the Australian Bureau of Statistics to facilitate demographic research on new arrivals and analysis of various migration programmes and settlement outcomes.

Information relating to recent arrivals may be given to state and territory agencies or migrant service organisations to assist settlement planning or provide settlement services.

Disclosure of personal information to overseas recipients

We use contractors to collect, transmit and store data, including providers located outside Australia.

In some circumstances personal information is disclosed to recipients outside Australia. Often the recipient will be the person's country of usual residence or the country the person has departed from (unless the person is awaiting an assessment of claims to be a refugee). This will include disclosures to airlines or travel agents in respect of advanced passenger processing and electronic visa processing.

We exchange information with countries or international organisations that have information sharing agreements with Australia. These information exchanges might involve sharing personal identifiers.

If there is a match with personal identifiers, we may disclose biographical data, copies of travel and other identity documents or information from such documents, immigration status and immigration history (which might include any immigration fraud and offences) and any relevant criminal history information.

The purpose of such disclosure is to help confirm identity and determine if the person has presented to other agencies under the same identity and with similar claims.

The Migration Act imposes limits on the disclosure of identifying information of applicants for protection visas to foreign governments in respect of which the claim is made, unless:

  • the applicant has requested or agreed to return to the foreign country
  • the person’s application has been refused and finally determined.

Disclosures associated with administrative activities

Personnel information – staffing-related matters

Code of Conduct Investigations
We might be required to disclose information, including personal information, related to a Code of Conduct investigation to people within our department and/or to third parties, including the complainant. Information related to a Code of Conduct investigation may also be disclosed to agencies which are authorised to receive information under their respective legislation, including the Australian Public Service Commission and law enforcement bodies.

Injury Management
The personal information of a staff member who has suffered illness or injury may be disclosed to persons within the department including the staff member's case manager, the manager of their work area and relevant members of the People Services Branch. Information can also be disclosed to third parties, including Comcare, treating medical practitioners, ComSuper, independent specialists, any relevant third party or insurer considered to have contributed to the illness or injury, future employers and legal advisers.

Complaint handling procedures

We disclose personal information in response to investigations conducted by both the Commonwealth Ombudsman's Office and the Australian Human Rights Commission.

Disclosure of personal information relevant to a complaint is provided on the basis of either express or implied consent or, where applicable, on the basis that it is permitted by the Ombudsman Act 1976 or the Australian Human Rights Commission Act 1986.

Disclosures associated with external websites

Our website contains links to other websites, but personal information is not, as a matter of course, shared by us with these websites. We are not responsible for the content and privacy practices of these other websites and, if a person is using these other websites, they are encouraged to examine their privacy policies.