Criminalising identity theft

Federal legislation

12.11 Currently, identity theft is not a federal offence in Australia. There are, however, numerous federal offence provisions that can be used to prosecute offenders who use illicitly acquired personal information when engaging in certain activities. These include offence provisions in the Criminal Code (Cth),[21] as well as in other pieces of federal legislation, such as the Financial Transaction Reports Act 1988 (Cth)[22] and the Migration Act 1958 (Cth).[23]

12.12 In 2000, the House of Representatives Standing Committee on Legal and Constitutional Affairs concluded that the offences to be inserted into the Criminal Code (Cth) by the Criminal Code Amendment (Theft, Fraud, Bribery and Related Offences) Act 1999 (Cth) dealt adequately with criminal conduct related to identity fraud.[24]

12.13 Nevertheless, in 2004 a new Part containing ‘financial information offences’ was inserted into Chapter 10 of the Criminal Code.[25] Accordingly, it is now a federal offence dishonestly to obtain or deal in personal financial information without the consent of the person to whom the information relates.[26] The definition of ‘personal financial information’ is broad and includes all information relating to a person that may be used, alone or in conjunction with other information, to access funds, credit or other financial benefits.[27]

12.14 The financial information offences in the Criminal Code were intended to address credit card skimming—the illicit capturing or copying of legitimate credit card data[28]—and internet banking fraud.[29] They appear, however, to be broad enough to cover many instances of identity theft.

12.15 In March 2008, the Model Criminal Code Law Officers Committee released a report on identity crime.[30] Using the term ‘identity crime’ to refer to practices including identity theft and identity fraud, the Committee recommended the creation of three identity crime model offences that relate to:

  • dealing in identification information;

  • possession of identification information with the intention of committing, or facilitating the commission of, an indictable offence; and

  • possession of equipment to create identification information, in certain circumstances.[31]

12.16 At the time of writing in April 2008, the Standing Committee of Attorneys-General had agreed to prepare a review paper examining the implementation priorities of the Committee’s report.[32]

State and territory legislation

12.17 In the majority of Australian states and territories, it is not an offence to assume or adopt another person’s identity. There are, however, numerous state and territory offences that can be used to prosecute offenders who use illicitly obtained identity information to commit criminal offences.[33]

12.18 In some circumstances, however, identity theft is a criminal offence in South Australia. Section 144B of the Criminal Law Consolidation Act 1935 (SA) makes it an offence to assume the identity of another person (whether living or dead, real or fictional, natural or corporate) with the intent to commit, or facilitate the commission of, a ‘serious criminal offence’.[34] Section 144C makes it an offence to use the ‘personal identifying information’ of a living or deceased person, or a body corporate, with the intent to commit, or facilitate the commission of, a serious criminal offence. In March 2007, similar offence provisions were enacted in Queensland.[35]

Other jurisdictions

12.19 In October 1998, the United States Congress passed the Identity Theft and Assumption Deterrence Act of 1998 (US). This Act makes it a federal offence, punishable by up to 15 years imprisonment or a fine of US$250,000, to

knowingly transfer or use, without lawful authority, a means of identification of another person with the intent to commit, or to aid or abet, any unlawful activity that constitutes a violation of Federal law, or that constitutes a felony under any applicable state or local law’.[36]

12.20 The Identity Theft Penalty Enhancement Act of 2004 (US) establishes penalties for the offence of aggravated identity theft.[37] Identity theft is also an offence in the vast majority of states in the United State s.[38]

12.21 In the United Kingdom it is also an offence, with some exceptions, to obtain, disclose or procure the disclosure of personal data without the consent of the data controller.[39] This offence provision could be used to prosecute those who engage in identity theft. The Identity Cards Act 2006 (UK) makes it an offence to possess or control false identity documents, including genuine documents that belong to another person.[40]

[21] See, eg, Criminal Code (Cth) ss 134.1 (obtaining property by deception), 134.2 (obtaining a financial advantage by deception), 135.1 (general dishonesty), 135.2 (obtaining financial advantage), 135.4 (conspiracy to defraud).

[22] See, eg, Financial Transaction Reports Act 1988 (Cth) s 24 (opening account, etc in false name).

[23] See, eg, Migration Act 1958 (Cth) s 234 (false papers etc).

[24] Parliament of Australia—House of Representatives Standing Committee on Legal and Constitutional Affairs, Advisory Report on the Criminal Code Amendment (Theft, Fraud, Bribery and Related Offences) Bill 1999 (2000), [3.8]–[3.10].

[25]Crimes Legislation Amendment (Telecommunications Offences and Other Measures) Act (No 2) 2004 (Cth) sch 3.

[26]Criminal Code (Cth) s 480.4.

[27] Ibid s 480.1(1).

[28] Model Criminal Code Officers Committee of the Standing Committee of Attorneys-General, Discussion Paper, Model Criminal Code Chapter 3, Credit Card Skimming Offences (2004), 1. This Committee has recently been renamed the Model Criminal Law Officers Committee.

[29] Commonwealth, Parliamentary Debates, House of Representatives, 4 August 2004, 32035 (P Slipper), 32036–32037.

[30] Model Criminal Law Officers’ Committee of the Standing Committee of Attorneys-General, Final Report—Identity Crime (2008).

[31] Ibid, 25–41.

[32] Standing Committee of Attorneys-General, ‘Communiqué’ (Press Release, 28 March 2008).

[33] See R Smith, ‘Examining the Legislative and Regulatory Controls on Identity Fraud in Australia’ (Paper presented at Marcus Evans Conferences, Corporate Fraud Strategy: Assessing the Emergency of Identity Fraud, Sydney, 25–26 July 2002).

[34] A ‘serious criminal offence’ is an indictable offence or an offence prescribed by regulation: see Criminal Law Consolidation Act 1935 (SA) s 144A.

[35] The Criminal Code and Civil Liability Amendment Act 2007 (Qld) s 6 inserts a new section into the Criminal Code Act 1899 (Qld), which in certain circumstances makes it an offence to obtain or deal with identification information: Criminal Code Act 1899 (Qld) s 408D.

[36]Identity Theft and Assumption Deterrence Act of 1998 18 USC § 1028 (US).

[37] Identity Theft Penalty Enhancement Act of 2004 18 USC § 1001 (US)

[38] United States Government Federal Trade Commission, State Laws: Criminal <www.ftc.gov> at 1 May 2008.

[39]Data Protection Act 1998 (UK) s 55.

[40]Identity Cards Act 2006 c 15 (UK) s 25.