2014
LEGISLATIVE ASSEMBLY OF THE
NORTHERN TERRITORY

ATTORNEY-GENERAL AND MINISTER FOR JUSTICE
Criminal Code Amendment (Identity Crime) Bill 2014
SERIAL NO. 68

EXPLANATORY STATEMENT

GENERAL OUTLINE
The Criminal Code Amendment (Identity Crime) Bill 2014 inserts the following specific identity theft offences into the Criminal Code:
(a)	section 228C – dealing in identification information;
(b)	section 228D – possessing identification information; and
(c)	section 228E – possessing equipment used to deal in identification information or identification documentation.
The creation of these new offences will fill a legislative gap regarding preparatory identity theft and credit card skimming offences.  Although the Criminal Code contains a number of general stealing, forgery and criminal deception offences which might apply to identity theft and credit card skimming, these offences do not cover preparatory offending such as the act of obtaining identifying data belonging to another person.  Under these general offences, a person who obtains identification information cannot be prosecuted until and unless a further offence is committed (for example, where financial information is used to purchase items over the internet).
In addition to creating identity offences, the Bill amends the Local Court Act and Sentencing Act to provide for a court to issue a certificate to a victim of identity theft confirming that certain transactions were in fact carried out by another person.
This is to assist a victim in remedying the effects of identity crime.  
The certificate will not restore the victims’ credit rating but may be used by the victim to prove that certain transactions were fraudulent.
The provisions of the Criminal Code Amendment (Identity Crime) Bill 2014 are largely based on the Model Criminal Code provisions proposed by the Model Criminal Law Officers’ Committee in their 2008 
Final Report on Identity Crime.
NOTES ON CLAUSES
Part 1	Preliminary matters
Clause 1.	Short Title
This is a formal clause which provides for the citation of the Bill.  
The Bill when passed may be cited as the Criminal Code Amendment (Identity Crime) Act 2014.
Clause 2.	Commencement
This clause provides that the Act will commence on a day fixed by the Administrator by Gazette notice.
Part 2			Amendment of Criminal Code
Clause 3.	Criminal Code amended
This Part of the Bill will amend the Criminal Code.
Clause 4.	Section 1 amended
This clause amends section 1 of the Criminal Code to insert the definitions for new terms ‘deal in’, ‘identification documentation’, ‘identification information’ and ‘victim’ for new Part Vll, Division 2A of the Criminal Code.  The full definition for each of these terms is contained in the new section 228A.
Clause 5.		Part VII, Division 2A inserted
Clause 5 inserts the new identity theft provisions into the Criminal Code after section 228 (blackmail and extortion).
A note has been inserted at the beginning of Division 2A to refer to the availability of a certificate that may be issued to the victim, the provisions for which will be found in new section 28C of the Local Court Act and Part 5, Division 1AA of the Sentencing Act.
New section 228A provides the definitions for the Division.
The term ‘deal in’ is defined to include make, copy, store, supply, transmit or use and has been drafted to ensure that all forms of dealing with identification information or identification documentation are covered.  This is particularly relevant to section 228E, which provides for the offence of possessing equipment used to deal in identification information or identification documentation.  If the definition of ‘deal in’ only included the term ‘make’, this would be insufficient to cover credit card skimming devices (‘equipment’) that merely retain or copy identification information as these devices do not manufacture or ‘make’ identification information.
‘Identification documentation’ means a document or other thing that:
(a)	contains identification information; and
(b)	can be used by a person to pretend to be, or to pass the person off as, another person (whether living, dead, real or fictitious).
The definition of ‘identification information’ has been specifically drafted to ensure the broadest possible application so that all forms of identity crime, including credit card skimming, are captured.  For example, the definition of identification information includes a credit or debit card, its number, or data stored or encrypted on it.
‘Victim’ means a person whose identification information is the subject of an offence against sections 228C, 228D or 228E of the Criminal Code.
New section 228B provides that section 43BF of the Criminal Code, which provides for the offence of attempting to commit a crime, does not apply to the offences in sections 228C, 228D or 228E.  Given the offences target preparatory offending, an ‘attempt offence’ is unnecessary.
New section 228C provides for the offence of dealing in identification information. The ‘default fault elements’ in section 43AM of the Criminal Code apply to this offence.
Therefore the offence will be made out if:
(a)	a person (the defendant) intentionally deals in information; and
(b)	they are reckless as to the fact that the information is identification information; and
(c)	the person deals in information with intent to commit a crime or facilitate the commission of a crime.
It is not a defence for the victim to have consented to their identification information being ‘dealt with’.  The terms ‘deal in’ and ‘identification information’ are defined in section 228A and are further explained above.
It is not the intention of the legislation to criminalise legitimate use of identification information, for example, the use of identification information by a bank or financial institution.  In order to ensure that legitimate use of identification information is not captured section 228C(1)(c) provides that a person cannot be found guilty of the offence unless they intended to use the information to commit or facilitate a crime.  On one hand, as banks and financial institutions are not dealing in identification information with the intention of committing or facilitating a crime, they will not have the requisite intention.  
On the other hand, if an employee of a bank uses identification information to commit or facilitate a crime, they will be guilty of an offence against section 228C.
The provisions are also not intended to cover minor offending such as the use or possession of fake identification by a juvenile to purchase alcohol.  As these offences carry a penalty of less than 2 years imprisonment, they do not fit the definition of a ‘crime’ as defined in section 38E of the Interpretation Act and, therefore, are not captured by the provisions.
Under proposed section 228C(2)(a), a person is guilty of an offence even if the crime for which information is dealt with is impossible to commit as long as the person intended to commit or facilitate the commission of a crime.
Section 228C(3) provides that it is not an offence for a person to deal in their own identification information.
The maximum penalty is 7 years imprisonment for this offence.
Section 228D provides for the offence of possessing identification information.  The ‘default fault elements’ in section 43AM of the Criminal Code apply to this offence.  Therefore the offence will be made out if:
(a)	a person (the defendant) intentionally possesses information; and
(b)	they are reckless as to the fact that the information is identification information; and
(c)	the person possesses information with intent to commit a crime or facilitate the commission of a crime.
It is not a defence for the victim to have consented to the possession of their identification information.  The term ‘identification information’ is defined in section 228A and is further explained above.
It is not the intention of the legislation to criminalise legitimate possession of identification information, for example, the possession of identification information by a bank or financial institution or a person minding identification for a friend while they use the bathroom.  
In order to ensure that legitimate possession of identification information is not captured, section 228D(1)(c) provides that a person cannot be found guilty of the offence unless they intended to possess the information to commit or facilitate a crime.  On the one hand, as a friend minding identification information is not doing so with the intention of committing or facilitating a crime, they will not have the requisite intention.  On the other hand, if the friend copies the identification information to commit or facilitate a crime, they will be guilty of an offence against section 228C (dealing in identification information).
The provisions are also not intended to cover minor offending as noted above in relation to section 228C.
Under proposed section 228D(2)(a), a person is guilty of an offence even if the crime for which information is possessed is impossible to commit as long as the person intended to commit or facilitate the commission of a crime.
Section 228D(3) provides that it is not an offence for a person to possess their own identification information.
The maximum penalty is 3 years imprisonment for this offence.
Section 228E provides for the offence of possessing equipment used to deal in identification information or identification documentation.  
The ‘default fault elements’ in section 43AM of the Criminal Code apply to this offence.  The offence will be made out if:
(a)	a person (the defendant) intentionally possesses equipment; and
(b)	they are reckless as to the fact that the equipment can be used to deal in identification information or identification documentation; and
(c)	the person possesses the equipment with intent to commit a crime or facilitate the commission of a crime.
The terms ‘deal in’, ‘identification information’ and ‘identification documentation’ are defined in section 228A and are further explained above.  The term ‘equipment’, in conjunction with the broad definitions of identification information and identification documentation, is designed to ensure that the provision remains technologically neutral and any future advancements in technology that can be used to commit identity crime are covered.
It is not the intention of the legislation to criminalise legitimate possession of equipment that can be used to deal in identification information or identification documentation, for example, the use of identification information by a bank or financial institution or possession of a smart phone, computer, photocopier or printer by any person.  
In order to ensure that legitimate possession of equipment is not captured, section 228E(1)(c) provides that a person cannot be found guilty of the offence unless they intended to use the equipment to commit or facilitate a crime.  As the ordinary person does not possess a scanner or smart phone with the intention of committing or facilitating a crime, they will not have the requisite intention.  On the other hand, if a person is in possession of a credit card skimming device with the intention of committing or facilitating a crime, they will be guilty of an offence against section 228E.
The provisions are also not intended to cover minor offending as noted above in relation to section 228C.
Under proposed section 228E(2), a person is guilty of an offence even if the crime for which equipment is possessed is impossible to commit as long as the person intended to commit or facilitate the commission of a crime.
The maximum penalty is 3 years imprisonment for this offence.
Section 228F provides for an alternative verdict in a trial or summary hearing if the trier of fact (jury or magistrate) is not satisfied beyond reasonable doubt that the defendant is guilty of dealing in identification information (under section 228C), they can still find the defendant guilty of the offence of possessing identification information 
(under section 228D) as an alternative verdict.
Clause 6.		Schedule 1 amended
This clause amends Schedule 1 of the Criminal Code by inserting reference to the new identity theft offences in Division 2A.  
Schedule 1 of the Criminal Code lists all offences to which the criminal responsibility provisions of Part IIAA apply.
Part 3			Amendment of Local Court Act
Clause 7.		Local Court Act amended
This Part of the Bill will amend the Local Court Act.
Clause 8.		Section 28C inserted
Clause 8 of the Bill inserts new section 28C into the Local Court Act to provide for the ability of a victim of identity theft offences to apply to the Local Court for a certificate confirming that certain transactions were in fact carried out by another person.
Section 28C will provide for a certificate to be issued by the Local Court at any time, irrespective of a prosecution for an identity crime offence or the identification of a perpetrator.  In addition, the Bill will provide for a certificate to be issued by a sentencing Court when sentencing an offender for one of the new identity theft offences.  The provisions relating to the issue of a certificate by the sentencing Court will be inserted into the Sentencing Act and are addressed below 
(under Part 4) in further detail.
Under new section 28C(1) of the Local Court Act, in order to issue a certificate to the victim, the court must be satisfied on the balance of probabilities that:
(a)	an offence has been committed against new sections 228C, 228D or 228E of the Criminal Code;
(b)	the victim’s identification information was the subject of the offence; and
(c)	the certificate may assist a victim to deal with any problems the commission of the offence has caused in relation to the victim’s personal or business affairs.
The ordinary standard of proof in the civil jurisdiction is the balance of probabilities, while the standard of proof in the criminal jurisdiction is ‘beyond reasonable doubt’.  Beyond reasonable doubt is a higher standard of proof than that on the balance of probabilities.  
The Local Court hears matters in the civil jurisdiction and section 28C(1) specifically provides that the standard of proof to be used when assessing an application is on the balance of probabilities.  
Although the Local Court will be determining whether or not an offence has been committed, this is not a prosecution and the finding will not result in any detriment to the offender, and so the Court will not need to be satisfied of this fact beyond a reasonable doubt.  This is extremely important in assisting the victim to make their application as the provision does not require them to prove beyond a reasonable doubt that an offence was committed, rather that, on the balance of probabilities an offence was committed.
A certificate may be issued:
(a)	whether or not the person who committed the offence is identifiable; or
(b)	whether or not criminal proceedings have or can be taken against a person, or are pending.
Section 28C(3) provides for the information that must be included in the certificate including:
(a)	the identity of the victim;
(b)	an explanation regarding the offence and how the victim’s identification information was used; and
(c)	any other information the Court considers appropriate in order to assist the victim deal with any problems the commission of the offence has caused in relation to the victim’s personal or business affairs.
It is unnecessary, for the purpose of the certificate, to identify the offender, and given the offender has not been found guilty of an offence to the criminal standard (beyond reasonable doubt), section 28C(4) states that the certificate must not identify the alleged offender.
Section 28C(5) states that the certificate is not admissible as evidence in any criminal proceedings in relation to the offence to which it relates.  The purpose of the certificate is to assist the victim to rebuild their identity and the issue of a certificate by the Local Court cannot be used as evidence against a defendant, in a criminal trial, to prove that the offence did occur.
Part 4			Amendment of Sentencing Act
Clause 9.		Sentencing Act amended
This Part of the Bill will amend the Sentencing Act.
Clause 10.		Section 3 amended
This clause amends section 3 of the Sentencing Act to provide for the definitions for the new terms ‘identification information’ and ‘victim’.  
The full definition for each of these terms is contained in the new section 228A of the Criminal Code.
Clause 11.		Part 5, Division 1AA inserted
Clause 11 inserts new Division 1AA into Part 5 of the Sentencing Act, after section 97.  Division 1AA, Part 5 will provide for a sentencing court, upon sentencing an offender for an offence under new sections 228C, 228D or 228E of the Criminal Code, to issue a victims certificate confirming that certain transactions were in fact carried out by another person.
As noted above in relation to clause 8 of the Bill, a certificate may only be issued by the sentencing court if the victim has not already obtained a certificate under section 28C of the Local Court Act.
In addition, under new section 97AB(1)(a), a sentencing court may only issue a certificate if sentencing an offender for one of the new identity theft offences.
Proposed section 97AB provides that the sentencing court may issue the certificate on its own initiative or on application by the prosecution if satisfied on the balance of probabilities that the certificate may assist a victim to deal with any problems the commission of the offence has caused in relation to the victim’s personal or business affairs.  
Unlike the Local Court, as a certificate may only be issued by the sentencing court when they are sentencing an offender for one of the new identity theft offences, the sentencing court is not required to be satisfied that an offence has occurred.
The information to be included in the certificate is outlined in new section 97AC of the Sentencing Act, is similar to that which is required in a certificate issued by the Local Court (as noted above in relation to clause 8 of the Bill) and the certificate must not identify the person who committed the offence to which it relates.
Part 5		Amendment of Private Security 
(Crowd Controllers) Regulations
Clause 12.		Regulations amended
This Part of the Bill will amend the Private Security (Crowd Controllers) Regulations.
Clause 13.		Regulation 3 amended
Clause 13 amends the Private Security (Crowd Controllers) Regulations by adding each of the new identity theft offences (sections 228C, 228D and 228E of the Criminal Code) to the list of disqualifying offences for obtaining a crowd controllers licence, under regulation 3 of the Private Security (Crowd Controllers) Regulations.  As a result, persons who have been convicted of identity theft offences will not be ‘appropriate persons’ for the purposes of section 15 of the Private Security Act and will be precluded from obtaining a crowd controllers licence.
Part 6		Amendment of Private Security 
(Miscellaneous Matters) Regulations
Clause 14.		Regulations amended
This Part of the Bill will amend the Private Security (Miscellaneous Matters) Regulations.
Clause 15.		Schedule 1 amended
Clause 15 amends the Private Security (Miscellaneous Matters) Regulations by updating the application form for obtaining a security officer or crowd controller licence, contained in Schedule 1 of the Private Security (Miscellaneous Matters) Regulations by adding each of the new identity theft offences (sections 228C, 228D and 228E of the Criminal Code) to the list of disqualifying offences.  It should be noted that the application form does not prescribe the ‘disqualifying offences’; it merely lists them for the information of the applicant when applying for a security officer or crowd controller licence.
Part 7		Amendment of Private Security (Security Firms) Regulations
Clause 16.		Regulations amended
This Part of the Bill will amend the Private Security (Security Firms) Regulations.
Clause 17.		Regulation 2 amended
Clause 17 amends the Private Security (Security Firms) Regulations by adding each of the new identity theft offences (sections 228C, 228D and 228E of the Criminal Code) to the list of disqualifying offences for obtaining a security firms licence, under regulation 2 of the Private Security (Security Firms) Regulations.  As a result, persons who have been convicted of identity theft offences will not be ‘appropriate persons’ for the purposes of section 15(7) of the Private Security Act and will be precluded from obtaining a security firms licence.
Clause 18.		Schedule amended
Clause 18 amends the Private Security (Security Firms) Regulations by updating the application form for obtaining a security firms licence, contained in the Schedule of the Private Security (Security Firms) Regulations by adding each of the new identity theft offences 
(sections 228C, 228D and 228E of the Criminal Code) to the list of disqualifying offences.  It should be noted that the application form does not prescribe the ‘disqualifying offences’, it merely lists them for the information of the applicant when applying for a security firms licence.
Part 8		Amendment of Private Security 
(Security Officers) Regulations
Clause 19.		Regulations amended
This Part of the Bill will amend the Private Security (Security Officers) Regulations.
Clause 20.		Regulation 2 amended
Clause 20 amends the Private Security (Security Officers) Regulations by adding each of the new identity theft offences (sections 228C, 228D and 228E of the Criminal Code) to the list of disqualifying offences for obtaining a security officers licence, under regulation 2 of the Private Security (Security Officers) Regulations.  As a result, persons who have been convicted of identity theft offences will not be ‘appropriate persons’ for the purposes of section 15(7) of the Private Security Act and will be precluded from obtaining a security officers licence.
Part 9 			Expiry of Act
Clause 21.		Expiry of Act
Clause 21 states that the Criminal Code Amendment (Identity Crime) Act 2014 will expire after its commencement.