Second Exposure Draft of the Human Services (Enhanced Service Delivery) Bill 2007 August 2007

Transcription

1 submission Submission to the Office of Access Card, Commonwealth Department of Human Services, in relation to the Second Exposure Draft of the Human Services (Enhanced Service Delivery) Bill 2007 August 2007

2 Office of the Victorian Privacy Commissioner (Privacy Victoria) GPO Box 5057 Level 11, Queen Street Melbourne Victoria 3000 Australia Phone: Fax: Website:

3 TABLE OF CONTENTS Summary 3 List of Recommendations 5 Part 1 - Introduction 10 Commencement (Part 1, Division 1: clause 2) 10 Interpretation (Part 1, Division 3) 10 Definitions (clause 4) 10 Objects and purposes of the Act (Part 1, Division 4) 12 Objects of the Act (clause 7) 12 Administration of this Act to accord with Australian Government policy (clause 8) 13 Application of the Act (Part 1, Division 5) 14 Part 2 Being access card compliant 14 Part 3 - Registration 14 Minister and Secretary s discretion to register individuals and in respect of the manner of registration 14 Cancellation of registration (Part 3, Division 4) 15 Reinstatement of registration (Part 3, Division 5) 16 The Register (Part 3, Division 6) 16 Manner and form of the Register (clause 33) 16 Information included on the Register (clauses 34-38) 17 Part 4 The access card 20 Division 2, Eligibility 20 Division 3, Getting an access card 21 Division 4, Cancellation 21 Division 7, Name and form of access cards 22 Division 8, Information on the access card 22 The Surface of the card - Subdivision B 22 Information in the chip - Subdivision C 24 Division 9, Ownership of the access card 25 Division 10, Use of the access card 25 Part 5 Confidentiality 26 Part 6 Acting on behalf of an individual 27 Part 7 Compliance and enforcement 28 Division 2, Offences for requiring production of an access card 28 Division 8, Infringement notices 29 Division 9, Notice to give information, etc. 30 Part 8 Review of decisions 30 OVPC Submission on Second Exposure Draft Human Services (Enhanced Service Delivery) Bill

4 Part 9 Administration Rules 30 Part 10 Miscellaneous 31 The Privacy Commissioner acknowledges the work of Dr Anthony Bendall, Deputy Commissioner, in the preparation of this Submission. 2 OVPC Submission on Second Exposure Draft Human Services (Enhanced Service Delivery) Bill 2007

5 Summary 1. If this Bill is enacted, Australia will have a national population register. Although the federal government continues to claim that registration for the Access Card is voluntary, the reality is that since the card is the means to claim Medicare benefits, only the most financially privileged are likely to have such a choice. The creation of such a register has enormous privacy and security implications. While some of the concerns raised by the Senate Standing Committee on Finance and Public Administration ( the Senate Committee ) and the Community and Privacy Taskforce ( the Taskforce ) have been addressed in the Exposure Draft, there are still areas of grave concern. 2. There has been insufficient consultation by the federal government with states and territories on the way that concessions will operate under the Access Card scheme. Concessions and the consequent necessity for widespread access to the card chip, have numerous and significant implications for privacy and security. 3. The Taskforce s Privacy Impact Assessment has still not been published. The Taskforce s Report on Registration, which was only published on 23 July 2007, after the release of the Exposure Draft, poses a number of questions which have not been satisfactorily answered. Little detailed information about the technical architecture of the Register, the card chip or card readers has been publicly released. As a consequence, the Australian community and the Parliament are being asked to assess the scheme, the effectiveness of the legislative safeguards and the impacts on privacy without relevant information. This is entirely unsatisfactory. 4. In summary, the proposed scheme raises significant privacy and security concerns because: a. Individuals will not only need to produce the card to access Commonwealth benefits such as Medicare, unemployment benefits and pharmaceutical benefits but may also be required to be present their card to any organisation giving concessions to Commonwealth benefit recipients. This includes health sector organisations, state public transport authorities, driver licensing authorities and private sector entities. Organisations that provide concessions will require card readers since the individual s particular concession status will no longer be recognisable on the face of the card. b. The current definition of Regulated persons includes officers from any prescribed Commonwealth and non-commonwealth organisations. This encompasses state and territory agencies and private sector agencies that provide concessions. Employees of such organisations will have considerable powers to access information on the chip of the card and to alter it. The richness of the data will be of great attraction to many. The creation of criminal offences and audit logs will not protect the data from unauthorised access and misuse. c. An express object of the Act is to allow card holders to use the Access Card for any lawful purpose they choose (clause 7(1)(e), and see clause 81). As expressly stated (Explanatory Material (EM), p72), Individuals may choose to use the card as a convenient proof of identity document. The use of the card as an identity card is being expressly promoted through the mechanism of consent and choice. OVPC Submission on Second Exposure Draft Human Services (Enhanced Service Delivery) Bill

6 d. While the provisions relating to your area of the card chip contained in the previous Bill have now been removed, statements from the Minister for Human Services 1 and staff of the Office of the Access Card indicate that this may not be a permanent state of affairs and that an area containing personal information chosen by the individual may be provided for under the Administration Rules in Part 9 of the Exposure Draft. Any return of this feature would serve to exponentially increase the privacy and security risks presented by the card. State and territory agencies and sections of the private sector would see it as highly desirable to populate the individual section of the card chip with their own applications, perhaps by offering incentives for the individual cardholder to do so. As a result, access control requirements would be unknowable and possibly unmanageable. e. The proposed use of the card to obtain emergency payments means that the information on the card chip will be capable of being read by ATMs, thus increasing the risk of unauthorised access, because ATMs are notoriously vulnerable to misuse and attack. This situation would be made even worse if the idea of allowing or encouraging an e-purse facility, using the Access Card infrastructure, which was initially suggested by then Minister Hockey in July , was to be revived. f. Cards will be used at EFTPOS facilities (e.g. at doctors, pharmacists and perhaps taxis and various retail outlets). EFTPOS is another source of potential misuse and unauthorised access. The proliferation of places where cards can be read creates an unacceptable level of security risk. 5. In its present form and as embodied by the Exposure Draft, the proposed Access Card still presents unacceptable privacy risks that far outweigh any benefits that a single card might bring. The personal information of most, if not all, of the Australian population remains vulnerable to misuse, including for criminal purposes. 1 2 Media Release, Minister for Human Services, 13 June 2007, which states in part: the Government will defer the introduction of the owner-controlled part of the chip until further consideration and consultation has taken place. See Minister flags smartcard e-purse, The Australian, July 4, 2006, available at visited 20 August OVPC Submission on Second Exposure Draft Human Services (Enhanced Service Delivery) Bill 2007

7 List of Recommendations 1. The Bill should not be introduced into Parliament until the safeguards and other matters have been fully addressed, preferably in legislation, to a standard acceptable to the community through its Parliamentary representatives. 2. The definition of benefit in Clause 4 should be amended to clarify the intention that cards and vouchers to be prescribed by regulations are only those that are issued by a participating agency administering a Commonwealth benefit. 3. The definition of benefit card in Clause 4 should be amended to expressly clarify that the term is intended to be limited to participating agencies and to payments and other allowances relevant to accessing Commonwealth health and social services. 4. a. The definition of chip in Clause 4 should be expressly limited to ensure that new technologies are not introduced without public and Parliamentary scrutiny If the Bill is to allow new technologies to be adopted and inserted into the card, there should be a requirement for a Privacy Impact Assessment (PIA) to be carried out. The PIA should be a public process and involve input by the community and Parliament. 5. If the intent expressed in clause 7(2) is genuine, then the card should not be permitted to be used as an identity card outside of the health and social services context. Organisations should not be permitted to request that individuals consent to using the card as a form of identity outside of this context. There should be no need to distinguish whether someone has fully satisfied the Secretary as to his/her identity, or whether identification has been verified to a lesser status. 6. The Government, through the Explanatory Material (EM) accompanying the Bill or otherwise, should provide a reasoned basis for how the proposed legislative scheme is going to achieve the objects set out in clause The Government should explain the effect of the Minister s policy statements, under Clause 8, on individuals eligibility and rights of review. 8. The Government should explain how the offence provisions in Part 4 will act as a deterrent or accountability mechanism if officers of Commonwealth agencies breach the Act but are immune from prosecution. 9. The Government should explain how registration will be voluntary if entitlement to social security and other benefits will depend on being access card compliant. 10. The Bill should require the Minister, in a timely fashion, to publish the Privacy Commissioner s advice on the form of application for registration and provide reasons why the advice was not followed if that is the case. 11. The discretions given to the Secretary should be limited. Determining the boundaries of eligibility for access to health and social welfare benefits is more appropriately a matter for Parliament. Where flexibility is desired, safeguards must be included to ensure privacy is protected for example, by expressly limiting the amount and nature of personal information collected to what is necessary for determining eligibility and requiring that such information only be retained until this purpose has been fulfilled. OVPC Submission on Second Exposure Draft Human Services (Enhanced Service Delivery) Bill

8 12. There should be some provision for the Secretary, before exercising the powers in Clause 25, to be required to satisfy him or herself, on reasonable grounds, that the individual is genuinely requesting cancellation of registration and has the capacity to do so. 13. The Bill should be amended to include specified grounds on which the Secretary can make a decision to cancel registration or to at least require that the decision be made on reasonable grounds. 14. The Bill should be amended to include specified grounds on which the Secretary can make a decision to re-instate an individual or to at least require that the decision be made on reasonable grounds. 15. The Bill should require the Minister to publish, in a timely fashion, the Privacy Commissioner s advice on the form of application for reinstatement and provide reasons why the advice was not followed if that is the case. 16. The form and manner in which the Register is to be kept should be set out in the legislation or regulations. 17. The Bill should not be introduced without more specifically addressing the issue of who has access to the information on the Register, and for what purposes. 18. a. The references to full and interim registration status should be deleted if the intent is to distinguish between those individuals who have satisfied a higher standard of identity verification without having any relevance to eligibility for health and social services. b. If the distinction is relevant, then the EM should provide an explanation of the intent and effect of including full or interim registration status on the Register. 19. a. The Bill should provide for a person s details to be excluded or suppressed from the Register in additional circumstances, such as where there are concerns for the individual s or their family s safety. The Bill should also be amended to take into account the potential for exposing assumed identities adopted by law enforcement officers. b. The mandatory requirement to include Any other name on the Register should be removed from the Bill and phone details should not be included in the Register but instead be left to the administrative collection by agencies that have an ongoing relationship with the cardholder. 21. The Government should reconsider the necessity of including in the Register all the information on the surface of all existing benefit cards 22. Identity documents should not be copied and included on the Register. This should be specifically prohibited in the Bill. Sighting identity documents at the time of registration may be adequate. Where copies are required, these should be stored separately, with appropriate security and disposal measures in place. 23. The EM should include an explanation of what information might be required to be included on the Register by other legislation including the Privacy Act 1988 and the Freedom of Information Act OVPC Submission on Second Exposure Draft Human Services (Enhanced Service Delivery) Bill 2007

9 24. The Government should reconsider whether the Access Card is an appropriate vehicle for the delivery of emergency payments. 25. a. The Bill should address disposal and destruction obligations for the information and documents included in the Register; and b. The Government should explain why the level of detail concerning a person s death is necessary to be included in the Register. 26. If information about indigenous status is not necessary for the purposes of registration, it should not be included. The more personal information held on the Register, the more vulnerable it is to unlawful access and misuse. 27. Item 18, which allows for Administration Rules to be used to require personal information to be included on the Register, should be removed from Clause 35(1). 28. The Bill should be amended to ensure that the Secretary does not include on the Register information that is inconsistent with state and territory laws intended to protect a person s identity. 29. The Government should explain why personal information relating to: name; birth date; citizenship; Indigenous status; sex; and contact details can be sourced from third parties to be included on the Register. 30. The Bill should provide for young persons under 18 to obtain medical and other services without the knowledge of the person who applies and holds an Access Card on their behalf, without first having to seek an exemption from the Secretary. 31. The Bill should address disposal and destruction obligations for the information and documents obtained with the form. 32. The Bill should require the Minister to publish, in a timely fashion, the Privacy Commissioner s advice on the form for written applications for an Access Card and provide reasons why the advice was not followed if that is the case. 33. To minimise the risk of unauthorised access or loss, the Bill should be amended to provide for a more secure method for delivering Access Cards. 34. Where an individual requests that his or her registration or Access Card be cancelled, there should be a requirement for the Secretary to satisfy him or herself, on reasonable grounds, that the individual is genuinely requesting the cancellation and has the capacity to do so. 35. The Bill should be amended to include specific grounds on which the Secretary can make a decision to cancel registration or an Access Card or to at least require that the decision be made on reasonable grounds. 36. The Bill should require the Minister to publish, in a timely fashion, the Privacy Commissioner s advice concerning the form of the Access Card and provide reasons why the advice was not followed if that is the case. 37. The Government should explain the need for a photograph to be included on the surface of the card, given authorised persons would otherwise have access to the digitised photograph in the card chip. If there is a need, apart from consensual uses of the card as an identity document, for the photograph to be viewed by persons without access to a reader, then this should be clearly explained. OVPC Submission on Second Exposure Draft Human Services (Enhanced Service Delivery) Bill

10 38. The Government should explain why the signature is needed on the surface of the Access Card. 39. a. Cardholders seeking to identify themselves over the telephone or internet should not rely on reciting the number on the surface of the card, but instead be expected to provide identifying information that is not visible on the surface of the card. b. There needs to be far greater safeguards regarding the use of the Access Card number. As discussed elsewhere in this Submission, the Bill should more expressly detail who has access to information on the Register, and what uses of the Access Card number are permitted or prohibited. c. The prohibition and offence provision (that was Clause 57 in the previous Bill) should be reinstated. 40. Date of birth should not be included on the surface of the card. 41. The individual (or your ) area of the Access Card should be excluded by the Bill, so that it can only be reintroduced by legislation, rather than Administration Rules. 42. The Government should explain the purpose of having the digitised signature on the Register and on the surface of the Access Card, as they cannot be compared. 43. The PIN should be mandatory and should apply to all fields, if the card is to be issued via mail or if home computer access is to be permitted. 44. The Government should indicate what legal rights actually arise from the vesting of ownership in the cardholder. In the absence of clear and express benefits, the clauses purporting to vest ownership should be deleted. 45. If the purpose of the card is to facilitate access to health and social services, and not to become a national identity card, there is no need to allow cardholders to consent to organisations using the card as evidence of identity. The legislation should not permit and facilitate the card s use as an identity card through the mechanism of consent. Unless the Government s intention is for the Access Card to be used as a national identity card, these provisions should be removed from the Bill. 46. The process whereby the Secretary authorises access under Clause 90 should be more clearly made subject to Parliamentary scrutiny, either by requiring relevant Administration Rules to be made under Part 9, or by making a document giving such authorisation a disallowable legislative instrument. Consultation with the Privacy Commissioner should also be made more transparent. 47. If enacted, the Bill should not commence unless and until systems are in place to ensure verification and security of source identity documents. 48. The Bill should set out the requirements and process whereby the Secretary may be satisfied that a representative is a person who is permitted to act on behalf of the principal. This should not be left to Administration Rules. 49. The Bill should require the Minister to publish, in a timely fashion, the Privacy Commissioner s advice concerning approval of the form whereby a person can be authorised to act as a representative of the principal to request cancellation of the principal s registration or Access Card and provide reasons why the advice was not followed if that is the case. 8 OVPC Submission on Second Exposure Draft Human Services (Enhanced Service Delivery) Bill 2007

11 50. a. The offence set out in the previous Clause 57 should be reinstated to the Bill. Due to the extreme risks to privacy represented by such recording, the Bill should not be introduced without such an offence provision being reinstated. b. Recording of information with or without consent should be an offence under the Bill, except in specific circumstances. If a database of Access Card numbers, photographs and signatures can be compiled, with or without consent, there is no control over the ongoing use and disclosure of the information on those databases. c. The card number is a unique identifier, and as such is a powerful tool facilitating data matching, linkage and aggregation of datasets. The protection of the Access Card number will be vital if the card number will be a means of accessing records by telephone or internet. The Bill should provide greater guidance about permissible uses and sanctions against prohibited uses. 51. At present, there is no remedy available for misuse of personal information by individuals, small private sector organisations and states and territories where there is no privacy legislation (as the Privacy Act does not apply). The Bill should include a system of civil remedies to better protect the privacy rights of individuals affected by misuse of their personal information. 52. The powers given to the Secretary to require individuals to give the Secretary, or his or her delegate, information or documents or to appear before the Secretary and give evidence, should be made subject to the review powers of the Administrative Appeals Tribunal, under Part 8, Division Clauses 160(3), 164(4) and 167(4), whereby a failure to properly inform the individual of their right of review does not affect the validity of decisions, should be removed from the Bill. 54. Part 9, which deals with Administration Rules, should be removed from the Bill and provisions for: proof of identity requirements; photographs; retention and disposal of information; the contents of the Register; the contents of the card chip; access to information on the Register and the card chip; and arrangements for representatives to act on behalf of individuals should be provided for within the Bill to be introduced to Parliament. 55. The Bill should require the Minister to publish, in a timely fashion, the Privacy Commissioner s advice in each instance where consultation is required and provide reasons why the advice was not followed if that is the case. OVPC Submission on Second Exposure Draft Human Services (Enhanced Service Delivery) Bill

12 Part 1 - Introduction Commencement (Part 1, Division 1: clause 2) 1. Clause 2 of the Exposure Draft provides that the main portions of the Act will arbitrarily commence within 18 months of Royal Assent or sooner by Proclamation. The Exposure Draft does not yet address the following significant issues: the procedures relating to identification, photographs and retention and disposal of information, which will be provided for in later Administration Rules; the likelihood that the National Document Verification System (DVS) will not be operational by the time that enrolment and registration is due to commence; there has been inadequate consultation with states and territories about the ways in which existing concession schemes will operate under the Access Card system; very little technical information about the Register, the card chip or card readers has been released publicly. If it is introduced in its current form, the Bill will establish the framework and authority that compels individuals to register and obtain a card in order to access health and other benefits without the necessary details and protections set out under law. 2. Recommendation 1: The Bill should not be introduced into Parliament until the safeguards and other matters have been fully addressed, preferably in legislation, to a standard acceptable to the community through its Parliamentary representatives. Interpretation (Part 1, Division 3) Definitions (clause 4) benefit 3. Benefit is defined broadly to include any concession, grant or payment and any card or voucher entitling its holder to a concession or a payment of any kind. This definition appears to extend the scheme to potentially include any concession etc. a person might have, whether for government services (state or federal) or for goods or services obtained from private sector entities. The Explanatory Material (EM) p 12 states that this definition is relevant to the definition of Commonwealth benefit and participating agency and these definitions will limit the scope to benefits provided by participating agencies. However it is not apparent how it limits it, or why, if the intention is to limit the scope in the way stated, it is necessary to have a separate definition of Commonwealth benefit (See also comments on the definition of Commonwealth benefit below.) 10 OVPC Submission on Second Exposure Draft Human Services (Enhanced Service Delivery) Bill 2007

13 4. Recommendation 2: The definition of benefit in Clause 4 should be amended to clarify the intention that cards and vouchers to be prescribed by regulations are only those that are issued by a participating agency administering a Commonwealth benefit. benefit card 5. The list of cards included within the definition of benefit card is open-ended. In addition to cards relating to health and social welfare services (e.g. Pensioners Card and Health Care Card), the definition includes a card or voucher prescribed by the regulations. The Bill does not appear to require such a card to relate to Commonwealth health or social services, although the EM (p 12) suggests that this is the intention and that it is there only in the event of another benefit card being issued by a participating agency before the scheme takes effect. However, the definition leaves it open to include any card or voucher in yet-to-be drafted regulations. 6. The breadth of the definition is significant in that it allows the operation of the Access Card regime to be vastly expanded by extending: a. the amount and nature of information collected on the Register (clause 35, item 7); b. the amount and nature of information included in the card chip (clause 74, item 6); and c. the circumstances in which it is lawful for persons (other than delegates and other regulated persons) to demand production of the Access Card for the purposes of identifying concession status and the supply of goods and services (clauses 131(1)(d)(i),131(4)(e) and 131(6)(e)). 7. Recommendation 3: The definition of benefit card in Clause 4 should be amended to expressly clarify that the term is intended to be limited to participating agencies and to payments and other allowances relevant to accessing Commonwealth health and social services. chip 8. The term chip is intentionally defined in a broad way to keep up with technological changes (EM p 12). This is consistent with the practice of making Australian legislation technology neutral. However, in this case, the definition leaves the scheme established by the legislation unable to address currently emerging or as yet unknown privacy and security risks. The reference in the definition to any other device that stores or processes information is quite broad and can include a range of existing and emerging technologies that carry potential privacy risks. 9. As drafted, the definition would authorise the use of Radio Frequency Identification (RFID) chips to be included in each card. RFID chips (or tags ) not only store data about a person but can also transmit their location to a remote device. The use of RFID or other location-tracking technologies in the Access Card would clearly raise privacy risks that would require further assessment and community debate. An open-ended definition designed to enable the adoption of new technologies leaves open the possibility of function creep and may raise new privacy issues. OVPC Submission on Second Exposure Draft Human Services (Enhanced Service Delivery) Bill

14 10. Recommendation 4: a. The definition of chip in Clause 4 should be expressly limited to ensure that new technologies are not introduced without public and Parliamentary scrutiny. b. If the Bill is to allow new technologies to be adopted and inserted into the card, there should be a requirement for a PIA to be carried out. The PIA should be a public process and involve input by the community and Parliament. Objects and purposes of the Act (Part 1, Division 4) Objects of the Act (clause 7) 11. Clause 7(2) expressly states that it is an object of the Bill that the Access Cards are not to be used, and do not become, a national identity card. In spite of this stated object, the practical outcome is that the Access Card is an identity card because: a. except in exceptional circumstances, from 2010 it will be mandatory to present the card in order to access Commonwealth benefits, including Medicare (EM p5); b. virtually every resident of Australia, from birth, will need to access Medicare; c. the whole purpose of registering is to ensure (as far as possible) that people are correctly identified (EM p5). The card is intended to allow the person presenting the card to be identified by the card, which includes name, photograph, signature and other optional information about themselves; d. the Exposure Draft contains provisions which refer expressly to the inclusion of information in the Register and in the card chip, relating to the extent to which a person has satisfied the Secretary of their identity (clause 35(1), item 9; and clause 74(1), item 10) without any explanation or indication as to how this information is relevant to eligibility for access to health and social services; e. one of the permitted uses of the card is to identify individuals for the purpose of confirming their concession status. This means that it can be potentially required to be produced as a means of identification by state and territory governments, local government and private enterprise which are offering concessions to those in receipt of Commonwealth or other benefits (see EM p 99 and 100, and (clauses 131(1)(d)(i);131(4)(e); and 131(6)(e); and f. an express object of the Act is to allow card holders to use the Access Card for any lawful purpose they choose (clause 7(1)(e), and see clause 81). As expressly stated (EM p72), Individuals may choose to use the card as a convenient proof of identity document. The use of the card as an identity card is being expressly promoted through the mechanism of consent and choice. 12. Recommendation 5: If the intent expressed in clause 7(2) is genuine, then the card should not be permitted to be used as an identity card outside of the health and social services context. Organisations should not be permitted to request that individuals consent to using the card as a form of identity outside of this context. There should 12 OVPC Submission on Second Exposure Draft Human Services (Enhanced Service Delivery) Bill 2007

15 be no need to distinguish whether someone has fully satisfied the Secretary as to his/her identity, or whether identification has been verified to a lesser status. 13. Clause 7(3) states that is the intention of Parliament that the Act be construed to the greatest extent consistent with the attainment of its objects, so as to limit interferences with the privacy of individuals. This is of questionable effectiveness. The privacy impact of the proposal will lie in the way that personal information is collected, secured, used and disclosed, rather than in the way the eventual Act is construed. For this reason, there needs to be more concrete and stringent privacy protections built into the legislative scheme. 14. It is questionable whether other objects of the Act set out in clause 7 will be achieved. On information provided to date: a. the scheme will not reduce the complexity of accessing Commonwealth benefits or make it more convenient and user-friendly for the majority of the population who only hold a Medicare card and receive health and pharmaceutical benefits. In fact, the registration and application for the card processes are far more onerous than the present scheme; b. the rigorous registration and application process is likely to increase the complexity of accessing Commonwealth benefits for the most vulnerable, such as persons with limited English and homeless persons; c. apart from sweeping claims, no evidence has been produced as to the likely effectiveness of the scheme in reducing fraud, or whether the saving in the claimed reduction will outweigh the cost of the scheme; and d. it has not been explained how having the Access Card will improve access to Australian Government emergency relief, particularly if individuals cards are lost or destroyed in the disaster. 15. Recommendation 6: The Government, through the Explanatory Memorandum accompanying the Bill or otherwise, should provide a reasoned basis for how the proposed legislative scheme is going to achieve the objects set out in clause 7. Administration of this Act to accord with Australian Government policy (clause 8) 16. Clause 8 authorises the Minister to issue policy statements setting out the Australian Government s policy in relation to administration of the Bill. Although it is said that this clause does not authorize the Minister to issue policy statements inconsistent with the Act (EM p 16), it is noted that this provision: a. is not a legislative instrument; and b. allows there to be a change in policy in the administration of the card without the matter going back to Parliament, even though the changes will need to be tabled. 17. Given the breadth of discretion proposed to be given to the Minister, the Secretary and his or her delegates (discussed later in this Submission), policy statements governing the manner in which the scheme will be administered take on greater significance. These documents may also affect individuals review rights, should they be denied registration or an Access Card. 18. Recommendation 7: The Government should explain the effect of the Minister s policy statements on individuals eligibility and rights of review. OVPC Submission on Second Exposure Draft Human Services (Enhanced Service Delivery) Bill

16 Application of the Act (Part 1, Division 5) 19. Clause 9 states that, although the Act binds the Crown, the Crown is not liable to be prosecuted for an offence. If Crown immunity protects Commonwealth agencies from being prosecuted for misusing the information on the Register or the Access Card, or requiring the card to be used as an identity card for purposes other than permitted by the Bill, then the offence provisions provide limited protection. 20. Recommendation 8: The Government should explain how the offence provisions in Part 4 will act as a deterrent or accountability mechanism if officers of Commonwealth agencies breach the Act but are immune from prosecution. Part 2 Being access card compliant 21. This Part relates directly to the Exposure Draft of the Human Services (Enhanced Service Delivery) (Consequential Provisions) Bill Clause 77A of that Bill amends the Social Security (Administration) Act 1999 to provide that individuals who would otherwise be entitled to social security benefits or to a concession card will not be eligible unless they are access card compliant. This undermines the repeated assertion by the Government that registration for the card is voluntary, because failure to register has severe social security and other financial implications. 22. Recommendation 9: The Government should explain how registration will be voluntary if entitlement to social security and other benefits will depend on being access card compliant. Part 3 - Registration Minister and Secretary s discretion to register individuals and in respect of the manner of registration 23. The registration process detailed in Part 3 gives wide discretion to the Minister and the Secretary, leaving the boundary of the scheme administratively open-ended. The Minister has the discretion to determine: a. the manner and form of applying for registration (clause 19(2)(a)); and b. the information and documents required to accompany the form, (clause 19(2)(b)). 24. Clause 19(3) requires the Minister to consult with the Privacy Commissioner regarding the form of application and take into account any comments. However failure to do so does not affect the validity of the approval. While on the face of it, this may seem to benefit the applicant, the provision provides little incentive for the Minster to comply with the requirement. There is also little, if any, transparency as neither the Privacy Commissioner s advice nor the Minister s response is required to be tabled or published in any way. Commonwealth officers have expressed the view that it would be expected that the Privacy Commissioner would include such information in his or her Annual Report to Parliament, as required under Clause 199 (see below). However, Clause 199 only requires the Privacy Commissioner to include an overview of consultations under this Act between the Minister and the Privacy Commissioner 14 OVPC Submission on Second Exposure Draft Human Services (Enhanced Service Delivery) Bill 2007

17 during the year. This may include detail as to the advice given and the Minister s response, but as this is not expressly required, it will effectively be left to the discretion of the Commissioner. Further, any overview would be long after the event and would therefore be less likely to be noticed. 25. Recommendation 10: The Bill should require the Minister, in a timely fashion, to publish the Privacy Commissioner s advice on the form of application for registration and provide reasons why the advice was not followed if that is the case. 26. The provision in clause 19 for the Minister to determine which documents will be necessary in order to satisfy the Secretary as to an individual s identity raises the question as to what will subsequently happen to the copies of the identity documents collected. While copies of these documents are no longer required to be part of the Register (see comments in relation to clause 35, below), there is no requirement that copies of these documents be destroyed once identity has been established. Moreover, item 18 in Clause 35 may allow the Administration Rules to provide for copies of these identity documents to be placed on the Register or elsewhere (see discussion below). 27. The Secretary has the discretion to a. request additional information and documents required to assess the application for registration (clause 19(4)); b. allocate an Access Card number or numbers to an individual (clause 20); and c. determine whether he or she is satisfied as to a person s eligibility to be registered (clause 22(a)) and identity (clause 22(c)) such that the person must be registered; 28. While such discretion allows the Secretary, or his or her delegate, to have some flexibility in dealing with exceptional cases where an individual may not be able to meet the formal requirements expected of most applicants, the breadth of discretion also permits the process to be made more onerous or the collection of information more intrusive. 29. Recommendation 11: The discretions given to the Secretary should be limited. Determining the boundaries of eligibility for access to health and social welfare benefits is more appropriately a matter for Parliament. Where flexibility is desired, safeguards must be included to ensure privacy is protected for example, by expressly limiting the amount and nature of personal information collected to what is necessary for determining eligibility and requiring that such information only be retained until this purpose has been fulfilled. Cancellation of registration (Part 3, Division 4) 30. Clause 25 requires the Secretary to cancel the registration of an individual if the individual so requests. It is difficult to conceive of the circumstances in which an individual would choose to request that his or her registration be cancelled. The Bill contains no provisions to protect the individual from malicious third parties masquerading as the individual or from self harm due to mental illness or other incapacity. 31. Recommendation 12: There should be some provision for the Secretary, before exercising the powers in Clause 25, to be required to satisfy him or herself, on OVPC Submission on Second Exposure Draft Human Services (Enhanced Service Delivery) Bill

18 reasonable grounds, that the individual is genuinely requesting cancellation of registration and has the capacity to do so. 32. Clause 26 again gives the Secretary a very wide discretion to cancel an individual s registration. While clause 26(2) provides the individual with a measure of procedural fairness, there are no specified grounds provided for the Secretary s decision. Given the seriousness of the consequences for an individual, Parliament should provide more guidance to, and control over, the Secretary in making such a decision. 33. Recommendation 13: The Bill should be amended to include specified grounds on which the Secretary can make a decision to cancel registration or to at least require that the decision be made on reasonable grounds. Reinstatement of registration (Part 3, Division 5) 34. The decision to reinstate an individual (clause 29) is again in the discretion of the Secretary. While the Bill now contains review mechanisms (see comments on Part 8, below), here as elsewhere in the Bill, there are still no provisions specifying the grounds on which such a decision is made or even that it be made on reasonable grounds 35. Recommendation 14: The Bill should be amended to include specified grounds on which the Secretary can make a decision to re-instate an individual or to at least require that the decision be made on reasonable grounds. 36. Clause 30 provides that the Minister shall approve the form of application for reinstatement. As discussed in relation to Clause 19, above, while the Minister is required to consult with the Privacy Commissioner regarding the form of application and take into account any comments, failure to do so does not affect the validity of the approval. There is also little if any transparency as neither the Privacy Commissioner s advice nor the Minister s response is required to be tabled or published in any way. 37. Recommendation 15: The Bill should require the Minister to publish, in a timely fashion, the Privacy Commissioner s advice on the form of application for reinstatement and provide reasons why the advice was not followed if that is the case. The Register (Part 3, Division 6) Manner and form of the Register (clause 33) 38. While it is acknowledged that the stated intention of the Government is for the Register to consist of a number of separate databases, this is not required by the legislation itself. Clause 33 gives the Minister wide discretion to determine the form and manner in which the Register is kept. The manner and form of the Register will not be subject to proper Parliamentary scrutiny or disallowance, as the Register is not a legislative instrument (clause 33(6)). The Ministerial direction as to the manner and form is a legislative instrument. However, this does not provide a proper level of scrutiny, as neither section 42 (disallowance) nor Part 6 (sun setting) of the Legislative Instruments Act 2003 applies to the direction. 16 OVPC Submission on Second Exposure Draft Human Services (Enhanced Service Delivery) Bill 2007

19 39. The form and manner of the Register will have a significant impact on the privacy interests of individuals and the necessary security and other safeguards that must be considered and established. 40. Recommendation 16: The form and manner in which the Register is to be kept should be set out in the legislation or regulations. Information included on the Register (clauses 34-38) 41. Clause 35 lists information that must be included on the Register. The Register will contain a significant amount of personal information which, if unlawfully accessed, may have serious consequences for individuals, including identity fraud and theft. The Register will be a population database, containing personal information about the identity of almost all citizens and residents of Australia and some overseas visitors. While the Bill now contains provisions as to who will be able to access or use information on the Register and for what purpose, this is open-ended, as clause 90 provides that the Secretary may authorise an individual to have access to protected records, including the Register (see discussion below). 42. Recommendation 17: The Bill should not be introduced without more specifically addressing the issue of who has access to the information on the Register and for what purposes. 43. Clause 35 also provides that the Register must include information as to whether an applicant s proof of identity is full or interim (clause 35(1), item 9). Apart from this reference and a later reference in relation to the card chip (clause 74(1), item 10), there is no information about how the Secretary will decide whether proof of identity is full or interim or what the impact of such a determination will be. 44. Recommendation 18: a. The references to full and interim registration status should be deleted if the intent is to distinguish between those individuals who have satisfied a higher standard of identity verification without having any relevance to eligibility for health and social services. b. If the distinction is relevant, then the EM should provide an explanation of the intent and effect of including full or interim registration status on the Register. 45. A residential address is included on the Register (clause 35(1) item 6(a)), under contact details, unless the person is granted a residential address exemption by the Secretary under clause 191 or 192. There is no other provision allowing for an exemption for other persons whose personal security would be at high risk if their residential address is known. Given that the individual s postal address is required to be included (clause 35(1), item 6(b)), it is difficult to see why a residential address also needs to be included where that is different to the postal address. 46. The inclusion of any other name as a mandatory requirement on the Register (Clause 35(1), Item 1(c)) is difficult to justify, as it has no relevance to Commonwealth services or benefits. This again leads to the increased likelihood of the Register and Access Card being used as a national identity system. OVPC Submission on Second Exposure Draft Human Services (Enhanced Service Delivery) Bill

20 47. Recommendation 19: a. The Bill should provide for a person s details to be excluded or suppressed in additional circumstances, such as where there are concerns for the individual s or their family s safety. The Bill should also be amended to take into account the potential for exposing assumed identities adopted by law enforcement officers. b. The mandatory requirement to include any other name should be removed from the Bill. 48. The inclusion on the Register of address and phone numbers, at the cardholder s request (clause 35(1) items 6(c) and (d)), appears unnecessary and likely to quickly become out dated. Such details would be better provided to individual agencies with whom the cardholder has an ongoing or current relationship. Agencies that do not have such a relationship with the cardholder do not need to know their current contact details. 49. Recommendation 20: and phone details should not be included in the Register but instead be left to the administrative collection by agencies that have an ongoing relationship with the cardholder. 50. Clause 35(1) item 7 provides that if the individual holds a benefit card or cards, all information relating to the individual that is on the surface of the benefit cards held must be included in the Register. No reason is provided as to why this information should be held on the Register, rather than be retained by the originating agency. This has the potential to further increase the amount of personal information held on the Register and thus increase privacy risks. 51. Recommendation 21: The Government should reconsider the necessity of including in the Register all the information on the surface of all existing benefit cards. 52. While the provision requiring retention of copies of identity and other documents on the Register has been removed, there is still potential for them to be included, as there is no requirement that copies of these documents be destroyed once identity has been established. Moreover, item 18 in Clause 35 may allow the Administration Rules to provide for copies of these identity documents to be placed on the Register. Retention of copies of identity documents potentially creates risks of unauthorised reproduction to commit identity theft or other fraud. Through those copies, the collection of other agencies unique identifiers (such as drivers licence and passport numbers) itself creates risks of unauthorised linkage, profiling or other misuses. 53. Recommendation 22: Identity documents should not be copied and included on the Register. This should be specifically prohibited in the Bill. Sighting identity documents at the time of registration may be adequate. Where copies are required, these should be stored separately, with appropriate security and disposal measures in place. 54. The Access Card number, which must be included on the Register (clause 35(1) item 10), is a unique identifier that can be used to facilitate data linkage. As discussed earlier (paragraph 38), although the Register is intended to be separate from the databases maintained by the various delivery agencies, the Access Card number creates a system that allows for information on the Register to be linked or aggregated with the information contained on any or all of those databases. This reinforces the need for the Register to be extremely secure. 18 OVPC Submission on Second Exposure Draft Human Services (Enhanced Service Delivery) Bill 2007