Australian Regulatory Compliance Review

Access Card: Government responds to Senate Committee report

The Minister for Human Services, Senator Chris Ellison, said the Senate committee’s recommendation to combine the first and second pieces of legislation for concurrent consideration had merit, and on examination of the committee’s report he agreed with this approach.

Senator Ellison was confident concerns raised by the Senate inquiry could be addressed.

“The Government remains committed to having the legislation passed this year and ensuring the access card project delivers benefits for Australians who use health, veterans and social services – and those Australians who fund the provisions of those services,” Senator Ellison said

Senate Committee reports on Access Card

The Senate Finance and Public Administration Committee has released its report on the Human Services (Enhanced Service Delivery) Bill 2007 (Access Card).

The Committee considered that the bill needs to be combined with the second tranche of legislation into a consolidated bill to allow proper consideration of the access card proposal and provide safeguards.

The Committee concluded that the second tranche would need to deal with the following issues:

• Whether the government should consider providing appropriate terminals or readers to those agencies and providers providing benefits and services to access card holders.
• Whether the only mandatory information displayed on the surface of the card should be the card holder's name and that other information should be at the discretion of the card holder.
• Whether the Commonwealth area of the chip should store existing agency identifiers and that these numbers should be used when linking a card to a participating agency database, rather than the access card number.
• Whether the form and manner in which the register is to be kept should be set out in legislation and prohibitions such as keeping the register separate from other data bases should be expressly stated.
• Whether the following determinations should be made by way of legislation or disallowable legislative instrument:

          (a) what proof of identity (POI) information and documents are needed for registration;
          (b) what proof of identity documents (or information about those documents) will need to be                     scanned and placed on the register; and
            (c) when applying for an access card, what 'other specified information' or documents that the                 secretary deems necessary: (i) to be satisfied of the applicant's identity, or (ii) to obtain                         information required for the card or the register (clause 23(2)(b).

• Whether any proposals to appoint additional participating agencies should be made through legislative amendment of the principal act.
• Whether access of law enforcement and security agencies to the information in the register should be specified in the access card legislation.
• Whether any exercise of discretion by the secretary of DHS to grant law enforcement or security agencies access to the register should be reported to the Parliament, perhaps in the agency's annual report in such a way as not to compromise operational matters or national security.

Access Card update

The Human Services (Enhanced Service Delivery) Bill 2007 (now available at ComLaw) passed through the House of Representatives on 28 February and has been introduced into the Senate.

Peter Timmins at Open and Shut gives a detailed analysis of the debate so far.

Access Card Consumer and Privacy Taskforce Discussion Paper 2: Voluntary and Medical Emergency Information

Chair of the Access Card Consumer and Privacy Taskforce, Professor Allan Fels AO, has released a discussion paper on Voluntary and Medical Emergency Information that can be considered for inclusion in the consumer-controlled area of the access card.

The paper notes that:

"The key question which needs to be addressed is what information is absolutely necessary to be available from the chip [in the customer controlled area of the access card] to facilitate emergency medical treatment of a person in a crisis situation. Furthermore, what information is merely convenient for a cardholder to have available to them by way of storage in the customer-controlled area of their access card...

The decision about what specific health and emergency data might be listed in the card is a considerably more complex matter than might have been anticipated. It is not simply a matter of storing anything or everything in an unselected fashion. This is because the data entered into the chip is data which is intended to be acted upon by other people. This is not data, such as the storage of a list or a telephone number or a birthday or a bank account number, where the action which flows from the storage of the data is action initiated by the cardholder themselves. This is data upon which other people act in good faith and where their actions may have significant (and potentially life-threatening) consequences for both parties concerned....

Because of this, there must, in the opinion of the Taskforce be a requirement, for the protection of the person who acts in good faith on the data provided by the cardholder, that a robust system of authentication and verification must be incorporated into the storage process. Without such a checking mechanism the storage of the data becomes less than useful, since third parties will either decline to act, or be restrained from acting, on the data, thus negating the whole purpose of its listing in the first instance."

The Taskforce has recommended that:

The customer controlled area of the access card should contain a two-tiered system of emergency and health information:
• in the first tier, which should be accessible to anyone with an approved reader, there should be listed only that data which is absolutely necessary to facilitate the provision of emergency health treatment in a crisis situation;
• in the second tier, which should be PIN protected (and thus accessible only with the express consent of the cardholder) other medical and health data could be listed in accordance with the Recommendations which appear below;
• the Access Card itself could contain, on the surface, some symbol (such as the caduceus) to indicate that emergency medical data is stored in the chip so that no time is wasted in an emergency situation looking for information which may not be there in the first instance.

Submissions on the discussion paper close on 16 March 2007.

Access Card Bill introduced

The Minister for Human Services introduced the Human Services (Enhanced Service Delivery) Bill 2007 into Parliament today.

The Bill has been amended following comments on the Exposure Draft.

The Bill can be downloaded from www.aph.gov.au or here.

Access Card website

Privacy Commissioner comments on Access Card draft Bill

The Privacy Commissioner has suggested in a submission to the Office of the Access Card that a number of amendments be made to the Exposure Draft of the Human Services (Enhanced Service Delivery) Bill 2007, including:

• The guiding policy setting for the register should be to collect the minimum amount of personal information and this should be reflected in the legislation.
• While the Draft states that it is not an object of the Bill that access cards be used as a 'national identity card', it is suggested that community trust be further enhanced by recasting this provision and including a statement that the objects of the Bill include to prohibit the access card being used as a national identity card.
• The legislation should state that the access card number (and related identifiers) do not become unique identifiers for each individual, which could be used, shared or adopted by Australian Government agencies, State and Territory agencies, or the private sector.
• The legislation should prescribe, in detail, a statutory process for assessing and approving any future uses of the access card and associated systems (such as the register).

Access Card exposure draft bill released

The Minister for Human Services, the Hon Joe Hockey MP, has released an exposure draft of the Human Services (Enhanced Service Delivery) Bill 2007 for the access card.

The exposure draft will enable public consultation and comment on the proposed legislation prior to it being introduced into Parliament in February 2007.

The Bill broadly addresses the following areas in relation to the access card, including:  

• Purpose and scope including function creep
• Information on the card and the register
• Ownership
• Protecting the card and the rights of cardholders.

Comments are to be submitted by 12 January 2007.

Overview

Exposure draft explanatory material

First Access Card Taskforce Report released

The Government has released the first Access Card Consumer and Privacy Task Force Report into the Health and Social Services Access Card, as well as the response by the Government to the Task Force's recommendations.

The Taskforce Report identifies issues and makes recommendations in relation to "architecture" questions of the Access Card including:

• The ownership of the access card
• Disability features
• The name on the card and in the database
• Photographs on the card and in the database
• Storage
• Digitised signatures
• The card number
• Expiry date on the card
• Scanning / copying of proof of identity documents
• Emergency medical and other data on the card
• Systems / chip capacity
• Emergency/disaster relief functionality

The Government's response confirms that legislation will be introduced to ensure that the Access Card is:
• Not a national identity card;
• Not required to be carried at all times; and
• Not able to be demanded outside health and social service purposes.

It says that Access Card legislation will be consistent with existing laws that protect privacy and information disclosure.

The Privacy Commissioner has welcomed the emphasis on privacy in the report but noted that not all her recommendations had been taken up either by the Taskforce or in the Government's response, for example, making the inclusion of a photograph on the face of the card voluntary.

Privacy Commissioner responds to Access Card Taskforce Paper

The Privacy Commissioner, Karen Curtis, has recommended a range of privacy safeguards be developed for the proposed health and social services access card. These recommendations have been made in her submission to the first Discussion Paper released by the Access Card Consumer and Privacy Taskforce.

In her submission to the Taskforce, Ms Curtis proposes that a number of key areas be addressed in the access card planning process including in the areas of card system design, technology choices, legislation and oversight measures.

The submission also calls for the enactment of legislation with privacy protection measures which apply over all elements of the access card system, including sanctions and remedies. Specifically, it recommends that legislation: limit the uses of the physical card; prevent unauthorised access to, collection or misuse of information on the card or chip; and prevent unauthorised or unintended uses and disclosures, including routine data-matching. In addition, the submission suggests that individuals should have transparent rights to access and, where necessary, correct information on the system.

The submission suggests that further detailed privacy impact assessments be undertaken during the design and implementation of the access card system.

The Government’s Vision for a Single Health and Social Services Smartcard

The Minister for Human Services Joe Hockey has spelt out the Government's Vision for a Single Health and Social Services Smartcard (pdf).

Some key quotes:

The fact is if you were to invent or create the optimum service delivery model, it would be internet based. However, there are Australians that neither understand the internet nor have access to it.

The Queensland government in particular has formed a working group for the Federal government, as the Queensland government proceeds down the path of rolling out its smart card driver’s licence from the beginning of 2008.

we are working closely with the financial services sector to ensure that we have consistent technology...that allows us to deliver, in my case, one hundred billion dollars a year, potentially through the banking system

one of the key applications of the new health and welfare access card is to enable it to be used for emergency payments, and that it could be used at EFTPOS terminals, and in automatic teller machines, to enable people to access cash immediately.

We are also determined to avoid application creep. It should be noted that this is a replacement card. It is a replacement card for the Medicare card, and in total is a replacement for seventeen cards and vouchers across the Human Services family. And because it is a replacement card, it is far easier to deal with the logistics of the roll out even though we anticipate that from 2008 it will take two years for the entire population that wants to access the card to receive one.

Four percent of our interactions are online. And one of the challenges for us has been, in delivering better services, one of the challenges has been increasing the level of online activity and being able to identify the person claiming to be accessing the online service. Now, there is a compelling argument to having a PIN associated with the smart card. If that is the case, then that solves a lot of our online authentication needs.

It is a replacement of a magnetic strip with a chip....The information in the mandated fields on the chip will contain your basic identity information. Name, address, date of birth, obviously a Medicare number. And the only field which we control, the government controls, will be your concessional status, whether you are a pension concession recipient, or a health care card recipient, and so on. That is the only field the government will control. All other mandated fields are in the control of the individual.