Australian Regulatory Compliance Review

Access Card will not proceed

The Australian reports that the new Government will not proceed with the Access Card proposal.

Labor's position on the Access Card

According to The Australian, if elected Labor will not proceed with the Access Card.

Even if the Coalition is re-elected the Access Card's future is doubtful. (see previous post)

Access Card: an IT Project Failure?

In a recent presentation, IT and privacy consultant Roger Clarke declared the Access Card project as a failure listing the following reasons:

• Vast Scale ("largest IT project in the world")
• Arbitrary and Ridiculously Tight Deadlines
• Tenders Prior to Parliamentary Approval
• Untested Technologies
• Unclear Requirements
• Rapidly Changing Requirements
• 'Going for Glory' (Hockey's "pilots are for aircraft")
• Huge Media Scepticism
• Huge Risk of Public Rejection
• Total Failure to Engage with the Public Interest
• Seriously Annoyed Tenderers, left in limbo
• Low Staff Morale, Staff Turnover, Loss of Corporate Memory

"Ellison's staff have realised it's an unmitigated disaster (and I'm limiting my comments here to project risk and not going into the impact it would have on privacy)....

The big Booz Allen Hamilton contract will be paid out.  But the tenderers for the big contracts can pack up and go home now, and the public servants can go hunting for their next jobs.  That will save us, as taxpayers, a cool billion dollars that would have been sadly wasted if the project had proceeded."

via Open and Shut

Access Card registration process

The Consumer and Privacy Taskforce's fifth report to government relates to Registration (pdf).

The Taskforce has identified the registration process, whereby in excess of 16.5 million Australians are registered and enrolled in the Access Card scheme as critical to the card's success.

The Report discusses:
• Preparing the system to undertake registration
• Personal registration activities
• Procedures at registration
• Production of, and Post-Production issues for, the Access Card.

Access Card update

The Office of Access Card has issued a series of fact sheets to accompany the second exposure draft of the Human Services (Enhanced Service Delivery) Bill 2007.

Chair of the Consumer and Privacy Taskforce, Professor Allan Fels AO, has also released a report on the Access Card Review and Appeals System and the Taskforce advice on governance.

“The Taskforce has recommended that a comprehensive system of internal and external review be established in relation to decisions about the card that affect individuals. Accountability mechanisms, primarily to the Parliament, should be strong,” Professor Fels said.

The draft Bill proposes to establish a dedicated Access Card Ombudsman rather than a separate review body for external reviews if a person is dissatisfied with an internal merits review.

Access card: second exposure draft bills released

The Minister for Human Services, Senator the Hon. Chris Ellison, has released for public comment second exposure drafts of the Human Services (Enhanced Service Delivery) Bill 2007 and the Human Services (Enhanced Services Delivery) (Consequential Provisions) Bill 2007.

The period for public comment on the draft Bills closes on Tuesday 21 August 2007.

Access Card: Voluntary Medical and Emergency Information

Chair of the Consumer and Privacy Taskforce, Professor Allan Fels AO, has released the Taskforce's second report (pdf), on whether Voluntary Medical and Emergency Information should be included on the customer controlled portion of the access card chip.

The Taskforce initially believed that there was considerable in principle support for the use of the Access Card as a device to enhance the access to emergency and health data which could
assist in the treatment of individuals in situations of accident and emergency.

However the submissions revealed how complex and difficult this would be to achieve in a practical sense. The critical issues revolved around the validation of data entered; keeping this data current and accessing it physically in emergency situations.

The main criticisms were :
• the use of the Access Card for the storage of medical and emergency health data is a purpose so removed from the essential rationale for having an Access Card that this functionality should not be supported
• that recommendations which preclude future uses in the medical and emergency health services area should not be supported
• insufficient attention has been paid to the additional and special privacy protections which need to be accorded to voluntary health data which is recognised as having a higher degree of sensitivity than many other classes of data
• there are numerous technical or architectural questions which still remain to be resolved before any effective system involving the storage of medical and emergency health data could be implemented. 

The Taskforce recommended that:

1. The Government should defer the possible implementation of this aspect of the access card program until such time as further consultation and consideration can be undertaken with a view to addressing the issues raised in this report;
2. At the point of registration, card applicants should be given the opportunity to register their consent to be an organ donor on the Organ Donor Register managed by Medicare Australia, and also be given the option to have their organ donor status reflected on the Access Card.

The Minister for Human Services Senator Ellison said that the Government will defer the introduction of the owner-controlled part of the chip until further consideration and consultation has taken place.

Access Card delay

The Australian has reported that the Access Card legislation introduction will be delayed by up to 8 months (here and here): "legislation due to go before federal Parliament this month had been delayed. Instead, a draft "exposure bill" will be released for public debate in the next fortnight."

Access Card registration issues

The Chair of the Access Card Consumer and Privacy Taskforce, Professor Allan Fels AO, has released the Discussion Paper on the Registration process.

In this Discussion Paper, the Taskforce has focussed on questions which it sees as directly related to, or immediately arising from, the central question of how to enrol, in excess of 16.0 million Australian citizens, permanent residents and other eligible persons and to provide them with their own Access Card before the scheme comes into full operation at some date in 2010.

The paper raises the fundamental question of what is the appropriate level of proof of identity that an applicant for an Access Card will need to establish in order to be issued with one.

It also discusses:

•managing address issues for persons who are chronically homeless
• security features related to data capture, transmission and storage
• particular issues related to people with religious/ethical objections to requirements of the Access Card registration process
• the methods of return of issued cards to cardholders
• commencement arrangements to activate operation of the Access Card
• the cancellation, suspension or deactivation of the card
• preferred replacement arrangements
• the specific issues faced by transgendered Australians
• the specific issues faced by people with mental illness or disability
• the specific issues faced in relation to the issue of cards to prisoners on release
• the inclusion of data about dependents, carers or people with powers of attorney on the card
• arrangements for the issue of the card, or amendment of its details, by Australians and other eligible cardholders living overseas.

The paper was written by the Taskforce prior to the Senate Inquiry Report being released .

Access Card update

The  Minister for Human Services, Senator Chris Ellison, said following the release of the report of the Senate Committee Inquiry into the Human Services (Enhanced Service Delivery) Bill 2007:

“The legislation will now be presented as one package, to be introduced in June. This will mean members of the public can see the full detail of the legislation.”

“The Government is committed to providing ordinary Australians with a better health benefits, veterans’ and social services system, and we remain on track to rolling out the access card in 2008.”

Access Card: Government responds to Senate Committee report

The Minister for Human Services, Senator Chris Ellison, said the Senate committee’s recommendation to combine the first and second pieces of legislation for concurrent consideration had merit, and on examination of the committee’s report he agreed with this approach.

Senator Ellison was confident concerns raised by the Senate inquiry could be addressed.

“The Government remains committed to having the legislation passed this year and ensuring the access card project delivers benefits for Australians who use health, veterans and social services – and those Australians who fund the provisions of those services,” Senator Ellison said

Senate Committee reports on Access Card

The Senate Finance and Public Administration Committee has released its report on the Human Services (Enhanced Service Delivery) Bill 2007 (Access Card).

The Committee considered that the bill needs to be combined with the second tranche of legislation into a consolidated bill to allow proper consideration of the access card proposal and provide safeguards.

The Committee concluded that the second tranche would need to deal with the following issues:

• Whether the government should consider providing appropriate terminals or readers to those agencies and providers providing benefits and services to access card holders.
• Whether the only mandatory information displayed on the surface of the card should be the card holder's name and that other information should be at the discretion of the card holder.
• Whether the Commonwealth area of the chip should store existing agency identifiers and that these numbers should be used when linking a card to a participating agency database, rather than the access card number.
• Whether the form and manner in which the register is to be kept should be set out in legislation and prohibitions such as keeping the register separate from other data bases should be expressly stated.
• Whether the following determinations should be made by way of legislation or disallowable legislative instrument:

          (a) what proof of identity (POI) information and documents are needed for registration;
          (b) what proof of identity documents (or information about those documents) will need to be                     scanned and placed on the register; and
            (c) when applying for an access card, what 'other specified information' or documents that the                 secretary deems necessary: (i) to be satisfied of the applicant's identity, or (ii) to obtain                         information required for the card or the register (clause 23(2)(b).

• Whether any proposals to appoint additional participating agencies should be made through legislative amendment of the principal act.
• Whether access of law enforcement and security agencies to the information in the register should be specified in the access card legislation.
• Whether any exercise of discretion by the secretary of DHS to grant law enforcement or security agencies access to the register should be reported to the Parliament, perhaps in the agency's annual report in such a way as not to compromise operational matters or national security.

Access Card update

The Human Services (Enhanced Service Delivery) Bill 2007 (now available at ComLaw) passed through the House of Representatives on 28 February and has been introduced into the Senate.

Peter Timmins at Open and Shut gives a detailed analysis of the debate so far.

Access Card Consumer and Privacy Taskforce Discussion Paper 2: Voluntary and Medical Emergency Information

Chair of the Access Card Consumer and Privacy Taskforce, Professor Allan Fels AO, has released a discussion paper on Voluntary and Medical Emergency Information that can be considered for inclusion in the consumer-controlled area of the access card.

The paper notes that:

"The key question which needs to be addressed is what information is absolutely necessary to be available from the chip [in the customer controlled area of the access card] to facilitate emergency medical treatment of a person in a crisis situation. Furthermore, what information is merely convenient for a cardholder to have available to them by way of storage in the customer-controlled area of their access card...

The decision about what specific health and emergency data might be listed in the card is a considerably more complex matter than might have been anticipated. It is not simply a matter of storing anything or everything in an unselected fashion. This is because the data entered into the chip is data which is intended to be acted upon by other people. This is not data, such as the storage of a list or a telephone number or a birthday or a bank account number, where the action which flows from the storage of the data is action initiated by the cardholder themselves. This is data upon which other people act in good faith and where their actions may have significant (and potentially life-threatening) consequences for both parties concerned....

Because of this, there must, in the opinion of the Taskforce be a requirement, for the protection of the person who acts in good faith on the data provided by the cardholder, that a robust system of authentication and verification must be incorporated into the storage process. Without such a checking mechanism the storage of the data becomes less than useful, since third parties will either decline to act, or be restrained from acting, on the data, thus negating the whole purpose of its listing in the first instance."

The Taskforce has recommended that:

The customer controlled area of the access card should contain a two-tiered system of emergency and health information:
• in the first tier, which should be accessible to anyone with an approved reader, there should be listed only that data which is absolutely necessary to facilitate the provision of emergency health treatment in a crisis situation;
• in the second tier, which should be PIN protected (and thus accessible only with the express consent of the cardholder) other medical and health data could be listed in accordance with the Recommendations which appear below;
• the Access Card itself could contain, on the surface, some symbol (such as the caduceus) to indicate that emergency medical data is stored in the chip so that no time is wasted in an emergency situation looking for information which may not be there in the first instance.

Submissions on the discussion paper close on 16 March 2007.

Access Card Bill introduced

The Minister for Human Services introduced the Human Services (Enhanced Service Delivery) Bill 2007 into Parliament today.

The Bill has been amended following comments on the Exposure Draft.

The Bill can be downloaded from www.aph.gov.au or here.

Access Card website

Privacy Commissioner comments on Access Card draft Bill

The Privacy Commissioner has suggested in a submission to the Office of the Access Card that a number of amendments be made to the Exposure Draft of the Human Services (Enhanced Service Delivery) Bill 2007, including:

• The guiding policy setting for the register should be to collect the minimum amount of personal information and this should be reflected in the legislation.
• While the Draft states that it is not an object of the Bill that access cards be used as a 'national identity card', it is suggested that community trust be further enhanced by recasting this provision and including a statement that the objects of the Bill include to prohibit the access card being used as a national identity card.
• The legislation should state that the access card number (and related identifiers) do not become unique identifiers for each individual, which could be used, shared or adopted by Australian Government agencies, State and Territory agencies, or the private sector.
• The legislation should prescribe, in detail, a statutory process for assessing and approving any future uses of the access card and associated systems (such as the register).

Access Card exposure draft bill released

The Minister for Human Services, the Hon Joe Hockey MP, has released an exposure draft of the Human Services (Enhanced Service Delivery) Bill 2007 for the access card.

The exposure draft will enable public consultation and comment on the proposed legislation prior to it being introduced into Parliament in February 2007.

The Bill broadly addresses the following areas in relation to the access card, including:  

• Purpose and scope including function creep
• Information on the card and the register
• Ownership
• Protecting the card and the rights of cardholders.

Comments are to be submitted by 12 January 2007.

Overview

Exposure draft explanatory material

First Access Card Taskforce Report released

The Government has released the first Access Card Consumer and Privacy Task Force Report into the Health and Social Services Access Card, as well as the response by the Government to the Task Force's recommendations.

The Taskforce Report identifies issues and makes recommendations in relation to "architecture" questions of the Access Card including:

• The ownership of the access card
• Disability features
• The name on the card and in the database
• Photographs on the card and in the database
• Storage
• Digitised signatures
• The card number
• Expiry date on the card
• Scanning / copying of proof of identity documents
• Emergency medical and other data on the card
• Systems / chip capacity
• Emergency/disaster relief functionality

The Government's response confirms that legislation will be introduced to ensure that the Access Card is:
• Not a national identity card;
• Not required to be carried at all times; and
• Not able to be demanded outside health and social service purposes.

It says that Access Card legislation will be consistent with existing laws that protect privacy and information disclosure.

The Privacy Commissioner has welcomed the emphasis on privacy in the report but noted that not all her recommendations had been taken up either by the Taskforce or in the Government's response, for example, making the inclusion of a photograph on the face of the card voluntary.

Privacy Commissioner responds to Access Card Taskforce Paper

The Privacy Commissioner, Karen Curtis, has recommended a range of privacy safeguards be developed for the proposed health and social services access card. These recommendations have been made in her submission to the first Discussion Paper released by the Access Card Consumer and Privacy Taskforce.

In her submission to the Taskforce, Ms Curtis proposes that a number of key areas be addressed in the access card planning process including in the areas of card system design, technology choices, legislation and oversight measures.

The submission also calls for the enactment of legislation with privacy protection measures which apply over all elements of the access card system, including sanctions and remedies. Specifically, it recommends that legislation: limit the uses of the physical card; prevent unauthorised access to, collection or misuse of information on the card or chip; and prevent unauthorised or unintended uses and disclosures, including routine data-matching. In addition, the submission suggests that individuals should have transparent rights to access and, where necessary, correct information on the system.

The submission suggests that further detailed privacy impact assessments be undertaken during the design and implementation of the access card system.

The Government’s Vision for a Single Health and Social Services Smartcard

The Minister for Human Services Joe Hockey has spelt out the Government's Vision for a Single Health and Social Services Smartcard (pdf).

Some key quotes:

The fact is if you were to invent or create the optimum service delivery model, it would be internet based. However, there are Australians that neither understand the internet nor have access to it.

The Queensland government in particular has formed a working group for the Federal government, as the Queensland government proceeds down the path of rolling out its smart card driver’s licence from the beginning of 2008.

we are working closely with the financial services sector to ensure that we have consistent technology...that allows us to deliver, in my case, one hundred billion dollars a year, potentially through the banking system

one of the key applications of the new health and welfare access card is to enable it to be used for emergency payments, and that it could be used at EFTPOS terminals, and in automatic teller machines, to enable people to access cash immediately.

We are also determined to avoid application creep. It should be noted that this is a replacement card. It is a replacement card for the Medicare card, and in total is a replacement for seventeen cards and vouchers across the Human Services family. And because it is a replacement card, it is far easier to deal with the logistics of the roll out even though we anticipate that from 2008 it will take two years for the entire population that wants to access the card to receive one.

Four percent of our interactions are online. And one of the challenges for us has been, in delivering better services, one of the challenges has been increasing the level of online activity and being able to identify the person claiming to be accessing the online service. Now, there is a compelling argument to having a PIN associated with the smart card. If that is the case, then that solves a lot of our online authentication needs.

It is a replacement of a magnetic strip with a chip....The information in the mandated fields on the chip will contain your basic identity information. Name, address, date of birth, obviously a Medicare number. And the only field which we control, the government controls, will be your concessional status, whether you are a pension concession recipient, or a health care card recipient, and so on. That is the only field the government will control. All other mandated fields are in the control of the individual.

Access Card update

Chair of the Access Card Consumer and Privacy Taskforce, Professor Allan Fels AO, has released the first discussion paper developed by the Taskforce on the health and social services access card.

The Discussion Paper outlines the Government's proposal for the new access card and discusses some of the issues that require public consideration and debate.

The Taskforce has been established by the Government to provide independent advice directly to the Minister for Human Services about how consumers will use the card and the subsequent privacy considerations. It expects to release further Discussion Papers during the current consultation period.

Professor Fels said the Taskforce had identified key questions which need to be immediately addressed:

• how any new card can be prevented from evolving into a national identity card
• the administrative or legislative basis upon which the new card should be established
• the impact on personal privacy of introducing an access card
• the consumer benefits or otherwise of having an access card

Submissions on this Discussion Paper can be made up to 27 July.

PS I have set up a new Access Card category (see right hand column) so that you can see all posts on the one page.

Access card or National ID card?

The Australian Privacy Foundation says the proposed health services access card has all the features of the cancelled Australia Card and worse privacy dangers.

Access Card costings and privacy

The Human Services Minister Joe Hockey has released the business case prepared by KPMG for the health and social services access card.

Instead of the Advisory Board recommended by KPMG he has established an independent Consumer and Privacy Taskforce and appointed Professor Allan Fels, AO to chair it.

More

Access Card and Privacy

The introduction of Australia's proposed access card (formerly known as the health smart card) will be monitored by an Access Card Consumer and Privacy Taskforce to be headed up by Professor Allan Fels, AO.

Human Services Minister Joe Hockey announced that consumer and privacy organisations can contact Professor Fels through the Office of Access Card:
Mail: PO Box 3959 Manuka ACT 2603
Email: a.fels@humanservices.gov.au
Telephone: (02) 6223 4739
General information about the access card is available on its website

When is a smartcard an identity card

Queensland has already announced a driver's licence smartcard.

The Commonwealth Government has now announced a health and welfare services smartcard which seems to rule out a compulsory national security ID card.

More

An Australian national identity card?

The Commonwealth Attorney General, Philip Ruddock has indicated he will launch an inquiry into whether or not a national ID card will be introduced.

Speaking to ABC radio he said

"the question is whether or not, in terms of people being able to satisfactorily identify themselves, and people being satisfactorily identified for a range of other purposes, a form of national identifier would in cost benefit terms be useful...

The major concern I’ve always had... is with the information the government does hold about individuals and the question you have to look at always is, whether information that is held should be pooled and with a national identifier you don’t have to do that.

At the moment we have legislation that deals with data matching and allows matching of information for certain purposes, but not for others. And when it relates to information of a health character, for instance, or matters of people’s financial affairs, tax details, people want to be assured that their privacy in relation to those matters won’t be breached.

A universal system of identification shouldn’t necessarily do that and the protections that we have now ought to be able to be maintained even if you do introduce such a system."

UPDATE : OFFBEAT...if we are going to have an identity card, let's think about how we can use technology and design to protect our privacy and be useful: look at the IDEO Identity Card Concept Project