KRAHULCOVA, Ms Lucie, Executive Director, Digital Rights Watch Inc. [by video link]

WARREN, Mr Justin, Board Member, Electronic Frontiers Australia Inc. [by video link]

[11:26]

CHAIR: I welcome representatives from Digital Rights Watch and Electronic Frontiers Australia. Information on parliamentary privilege and the protection of witnesses in giving evidence to Senate committees has been provided to you. I now invite you to make a short opening statement and, at the conclusion of your remarks, I'll invite members of the committee to ask questions.

Mr Warren : Thank you, Chair and committee members, for the opportunity to speak today. Good intent is just a start. There is some good intent behind this legislation, and there are some potential benefits, such as only having to provide information to the government once instead of saying the same thing dozens of times to different people. Good intentions, while necessary, are not sufficient, and there are myriad reasons to be concerned about this legislation and the approach taken to creating it.

The government demands to be trusted without first demonstrating that it is trustworthy. In fact, it has done quite the opposite. The list of failures is long. In 2016 the government published a trove of Medicare data, the MBS/PBS dataset, only to pull it offline after experts pointed out they could re-identify people in that dataset. There has been some discussion about de-identification today, so that's particularly important, I think. The government response was to try to outlaw pointing out the problem, not to stop it from happening in the first place. In 2017, Centrelink provided private personal information about a payments recipient to a journalist in order to 'correct the record' in what was widely viewed as retaliation designed to silence a critic. In 2020, only a year ago, Service NSW leaked 738 gigabytes of data including personal information of 186,000 people. That was a data breach.

Then there was the entire robodebt saga, which has already been canvassed here today, in which the government unlawfully took money from hundreds of thousands of people after a laughably ham-fisted data-matching exercise and, for years on end, continued to insist that everything it was doing was fine. It was not fine. It took a private class action to force the government to stop.

The government demands that we consent to this, yet we can't say no. It's illegal to not complete the census or to fail to file tax returns. If we want access to society's services, which is, after all, the actual point of having a government in the first place, we have to provide personal information before we can do so. We have Medicare cards, drivers licences and all manner of forms to fill out, and we may have done so gladly, based on a bargain that we made in the past. My drivers licence photo was taken over a decade ago, when I still had hair. I allowed for my photo to be taken so I could drive on the public roads—a fair bargain—but then that photo was uploaded to a central database for other purposes, like facial recognition, that I didn't sign up for and never said was okay. We had a deal and now, after the government has already collected all of this private personal information about us, you tell us that you are altering the deal, some like bureaucratic Darth Vader. That might pass for consent in ministerial offices in Parliament House, but it doesn't out here in the real world.

We're asking for governments to do more to protect our privacy, and we have for decades. We keep asking for more protections from the likes of Google and Facebook, but the government seems focused instead on turning itself into Facebook. When the government gets it wrong we have essentially no recourse. Like a bad boyfriend, time and time again you just keep promising that this time it will be different; this time you will change. We want to know what happens if you fail again, just like all the other times before. We're the ones who get hurt, not you. All you offer is a chance to hurt us again and you won't let us leave. That concludes my statement.

CHAIR: Thank you very much. Digital Rights Watch, please?

Ms Krahulcova : Thank you for inviting us to speak on these bills and their impact on digital rights. We appreciate this opportunity. For those unfamiliar, Digital Rights Watch advocates for free and open internet, democratic accountability, and individual rights and freedoms in the digital era. As such we have consulted and contributed to dozens of parliamentary hearings on everything from telecommunications privacy reform to most recently the media bargaining code. We see great overlap in all this work that we do, and that's why I bring it up, and that is the act of reshaping the relationship between government and individuals. I think there is a shift in responsibility and a shift in accountability across all these fields, and we're extremely concerned about that direction.

In the interests of the committee's time—and I want to give time for questions—I won't repeat the submission, but I will reiterate for those tuning in that there is a Privacy Act review currently underway and it aims to bring Australia in line with international data protection and privacy standards in part so that trade and ecommerce can continue, privacy decisions can be handed out and we can continue being a relevant international partner. It does not make I think policy sense or financial sense to be passing this legislation while money is being spent reviewing the Privacy Act, especially if this legislation as primary legislation will be exempt from the resulting rules and standards in that review.

In fact, the proposal as it is is even rewriting existing privacy principles. In our submission we brought up the fact that privacy principle 6 is essentially being rewritten, and that is the primary [inaudible] definition. There are exceptions to that in that the existing privacy principles, but this is a top-down override of privacy principle 6 and it is a blunt approach that dilutes legal protections and remedies currently available to Australians, and there are not many to begin with.

The bill also does not require specific testing against competing public interest claims, and I think that's important to privacy [inaudible]. There is a need for 'a description of how the public interest is served by the sharing'. There's no need to actually balance competing public interests. I think that's important because you can also make a [inaudible] case for something but it's much different when you do a calculation. I would say that that's insufficient.

Further, I'm concerned about the impracticable clause to obtain consent. I think that has been brought up before today. It's almost absurd because it will never be practicable to obtain consent at that level. I was working in Brussels for several years for another NGO called Access Now. I remember when the GDPR was implemented. What happened was not practical. Everyone was [inaudible] by a variety of emails [inaudible] consent to different data-sharing purposes. [inaudible] by email for government services. That was not practical, but it was an interesting and important exercise that highlighted to people exactly where their data was and what purposes their data was shared for. Using that language already doesn't set this up, I think, as a timely legislative update.

That brings me to a point on research I want to highlight. We went into it in our submission a lot, so I won't go into the details. I'm super happy to speak about what GDPR has done, in that regard, in Europe. We don't want to copy and paste here but there are some important protections for data sharing that GDPR introduces. We want evidence based public policy. That's incredibly important and benefits society at large, especially given the sensitive nature of data held by government agencies, specifically the ones mentioned that handle incredibly private personal information. But it's paramount that the bill tightens up its provision to ensure that the data is secure and individual privacy remains protected and all the data remains anonymised.

We have seen cases where security researchers have been able to de-anonymise data that has been leaked in Australia and there has been very little done by the government. There's really no mechanism for this sort of research to be turned into action and for changes to be made on the basis of it. Now, largely, those sorts of studies are ignored and that's an incredible problem. As Justin pointed out before me, and I would agree with everything he said, there are a lot of examples where leaks have happened and privacy of individuals was not sufficiently protected. In most of these instances, individuals have no redress or compensation by the government, and I think that is a broken system.

Lastly, I would like to raise this issue of the bill allowing for data sharing for enforcement purposes. That's something that's been brought up as 'It won't happen; it can't happen.' In our submission, we find that there have been some word changes in 15(4). I'm happy to discuss that, but we must be absolutely sure that (a) no such gaps in legislation exist and (b) we don't preclude any protections that come from the Privacy Act review through this legislation.

As things become digital, it's imperative that we examine the role and relationship between government as an entity that provides governance, security and services and individuals as [inaudible] that entity and what that relationship should be. Looking at this from a strictly value based type of calculation, which is what data sharing often [inaudible] and it's something that consumer data rights, for instance, also does, it does not paint a complete picture. I would argue that it's imperative that we take a principle based approach to data governance or we risk reducing individual lives to numbers and a bottom line. I think that creates a real issue for democratic governments. I'm happy to answer any questions. I hope that was helpful.

CHAIR: Thank you very much. That was very insightful. I have a couple of questions before I pass to the deputy chair. This is probably one for Ms Krahulcova. It doesn't, necessarily, go to exactly what you just talked about but I'm interested in your thoughts. Once we've granted access to data to these third parties, do you have any concerns about how that data might be accessed beyond that third party, whether it's through a cybersecurity incursion or through hacking or something like that?

Ms Krahulcova : By third party do you mean by entities or—

CHAIR: Once government data has been provided to a third party, under the legislation that we're talking about here today do you have any concerns around oversight of how that third party deals with that data, in terms of potential cybersecurity attacks, hacking and that sort of thing?

Ms Krahulcova : Yes, absolutely. What we elaborated on in our submission, on this point, was also that there's no required ethics test even for sharing with certain research institutions and private entities. I know that we have representatives here from the University of Sydney and I know some of the bigger institutions have that sort of mechanism for any studies they do. That's not always the case, and I think the legislation should be very clear about what its expectations are because, yes, you're really losing sight of that data. I would argue that, as its primary custodian, you have a responsibility to people to understand just how that data might be used and how that makes them vulnerable.

I would also flag that a lot of the time when datasets get cross-referenced and big databases are created, that creates a honey pot. If that's a foreign concept, it just means it creates a really lucrative opportunity where a lot of data on individuals is interlinked. We've seen in previous iterations where in South Korea, for instance, the central government database that they created was taken offline a few weeks later because it was subject to so many cyberattacks. People were just wanting to hack it and get that information because it linked people's social security numbers, or whatever their equivalent is, with names and birthdays. It just makes identity theft incredibly easy, as well as understanding the population at large.

CHAIR: Thank you very much. I have a question regarding the census. Both submissions reference census data as an example of information that Australians may not be comfortable having shared with third parties. Do you think there's any risk that people will be less likely to complete the census this year if they're concerned about the privacy of that data?

Mr Warren : Yes, we already know that to be true based on the last census. There was a lot of controversy at the time, you may recall, regarding the linkage of names and addresses in order to create a longitudinal dataset from multiple censuses, rather than the census being an individual snapshot of data from that particular time. There were a lot of people who were very concerned and who publicly stated they would not complete the census at that time because of that perceived risk. The perceived risk from this kind of data-sharing of essentially the entire dataset is vastly greater than that. So, yes, we would absolutely see a chilling effect, particularly for people who have a memory of what governments have done with census data in the past. Some of those will be fresh memories, because they have escaped those regimes to come here to Australia, where they believe that kind of thing doesn't happen.

Ms Krahulcova : I would just add that in January last year there was a consultation conducted by the Australian Bureau of Statistics that actually explored integrating private datasets as a way to fix the census. What they were proposing was actually taking the aggregate census data, and taking data mainly from something like the electrical grid, to patchwork and fix them to the households where the answers were incomplete or flawed. There was a huge privacy impact assessment that happened on the back of that. Ultimately, they agreed it's not a good idea because it will erode the trust that people have and the social contract that a census operates under. It's very lucrative, and, from a purely financial or efficiency standpoint, it makes total sense. In effect, you wouldn't have to have a census; you could just pull everybody's electricity usage data and paint a very clear picture. But there's a reason that's not what we do, and there's a reason that the census is held the way it is, because you need participation and you're legally obligated to participate. I 100 per cent agree with Justin that, yes, that would erode people's trust in that mechanism.

CHAIR: Thank you very much for that response. Senator Ayres, I will hand over to you.

Senator AYRES: Thanks very much. Ms Krahulcova, in your opening statement you referred to the compliance enforcement question, and changes that you say happened in the draft that haven't resolved your concerns about that. There's a lot of public interest in both the robodebt context and the emerging issues around data-matching being used for compliance with the NDIA. What do you have to say about that? Could you expand on your opening comments about that issue?

Ms Krahulcova : As to why data shouldn't be used in those ways?

Senator AYRES: In what sense do you think this smooths the path for that kind of data-matching activity for compliance purposes?

Ms Krahulcova : I think Justin might want to add to this as well. I think the overly broad intent of this bill and the description of how public interest is served by the sharing—you can make a hundred different cases across a lot of agencies that public interest would be served by sharing the data. That's why I think that test is insufficient. Just because something is well-intentioned or would serve public good in a very narrow view doesn't mean that it should be done. There are also limits, and many data scientists will be able to tell you of the sort of data that you're able to aggregate. A lot of NGOs have done research like this. Privacy International was one of them. They actually showed that data aggregated through social media services, which ends up with targeted advertising, political advertising et cetera, is actually an incredibly flawed and incomplete picture of who you are. We over-trust and over-rely on data, because there are a lot of consultancies who have a very big financial stake in making that narrative stick. So we over-trust and over-rely on this when it's creating really imperfect pictures of people's lives. At a human level, I think it's cruel to rely on the numbers and merge datasets to paint people's lives in those instances. Justin?

Mr Warren : Yes. To expand further on the point, the legislation as drafted is about intent. There are some loopholes in part D that have been added in there as well about sole purpose. There are certain things where there is a dual purpose. There are some quite convenient loopholes in there that I could very easily craft an argument to drive through, so they should definitely be removed, which was in our submission. But there's good intent here, in that we want to do something which sounds beneficial. That may be true when the actual intention matches the stated intention. That is not always true. Sometimes humans lie. Any safe system needs to be designed to take that into account, because the purpose of a system is what it does, not what you intended it to do. So, if the legislation is written with, 'If you intended to do this for not an enforcement purpose, then sharing is fine.' When we then find out later on that it was actually used for an enforcement purpose, what happens? What are the consequences for that outcome?

It's particularly challenging with data privacy, because data privacy, like life, once it's gone, it's lost forever. Intent is the difference between murder and manslaughter: the victim is still dead. In this case, our privacy has still been invaded; it's still been lost. We can't ever get that back, and what we see here are things like some civil penalties of 300 penalty rates, which at the current rate works out at about $66,000. Personal information is extremely valuable. If I managed to get hold of a data leak of every Australian's medical record, 66 grand sounds like a pretty fair fee. You can pay more than that to various data brokers to get access to datasets. So maybe I just go, 'Okay, I'll pay the fine.' Those are some of the issues that we need to wrestle with with this—that it's not good enough to have good intent; we need to have systems that deal with bad intent and bad outcomes.

Senator AYRES: To what extent does a presumption in favour of the production of anonymised data as a result of the data sharing activity resolve your concerns?

Mr Warren : No, for two reasons. One, the source data is actually coming from the most sensitive data, which is about individual people, rather than starting with something which is inherently safer, like data about government operations. Why aren't we studying something that's easy and much safer, just inherently safer? Because it's about aggregate operations of government, and we're analysing what government is doing. Why don't we start there and prove capability and then build trust with people to say, 'Yes, we can actually do this in a safe manner,' before we start dealing with the really sensitive and delicate data that's about individuals? That's incredibly valuable data, which is why researchers want access to it. I understand that. But starting with the most dangerous option seems misguided to me. We also know—and we have proof because it's happened—that people like to think that they can de-identify this data, and then they don't. Or they say that it has been done, and then they're told, 'No, you're doing it wrong,' and they attack those critics and do it anyway, and then we prove them wrong. Or they say, 'Oh, this is really complicated to do.' Often the idea of complexity is different, so what I consider to be complex mathematics is very different to what a PhD in mathematics would consider to be difficult. The cybercriminals who are getting access to this data or who want the data because it's incredibly valuable to them are very smart. They can buy people with PhDs. There are lots of people who are very good at this, and none of them have to tell you what they're doing. They all just grab the data, re-identify it and get on with what they're trying to do—and you might never even know. We've seen the response from government so far when we try to point this out. It is to pretend that it doesn't happen, and that doesn't inspire confidence.

Senator AYRES: How does this re-identification process work? What does that mean?

Mr Warren : There are a variety of techniques. Essentially, you take data in one dataset and correlate it with other information that is publicly available or, in some cases, private datasets that you've already collected. For example, I can work out where you are in time and space and I only need four data points to do that. There was an article by Will Ockenden some years ago, before the metadata retention was passed, showing that, if you have access to the metadata from someone's telephone and got access to that and published it online and then invited people to tell him things about his life, they worked out where he lived, where he worked and where he'd like to go for lunch. I think they worked out where his parents lived. You can find out a lot about people with surprisingly little information. And because it's surprises people, because it doesn't seem obvious, that's why it's so very, very dangerous. Smart people can do amazing things with this data. In fact, that's often what the big data exceptionalists like to say: 'We can do this amazing stuff. If you just give us access to this data, we'll be able to do a whole bunch of amazing things.' The bad guys can do amazing things too, because they have access to the same maths.

Ms Krahulcova : If I may, I'll just elaborate briefly on that. I think it's often a big concept for people to grapple with. For instance, an insurance company having aggregate datasets about where certain diseases are more prevalent or which neighbourhoods have a higher risk of this or that are just very real consequences, even in anonymised datasets. People always tell me that they're not too worried about it, the data, like, 'What's that going to do?' But if your insurance premiums go up or your insurance goes up on your house, because there are certain risk factors that they've been able to derive from information that you disclosed to the government, because you thought they couldn't operate as a private entity and they wouldn't share that data, suddenly the private entity has that data, and they're able to, in a very real way, impact your life. Mobile phone operators really want to do this and offer different sorts of plans in different neighbourhoods based on the socioeconomic status. I was a member of the World Economic Forum consumer data group a year ago. Health companies are keen to get very nuance data on people, because they want to literally market and sell people custom-tailored vitamins based on their lifestyle, based on their commute, based on every data point about them. It compounds critical issues, such as people being misdiagnosed or not diagnosed for certain illnesses. Where is the responsibility? You have that data as the government. You shared it with private entities and it's making people's lives worse. It's making their lives more expensive—or cheaper. But what is the responsibility?

I'm sorry I keep coming back to this example, but I think GDPR was very specific about the conditions under which academic institutions can get data specifically for these reasons. They're also very strict about data minimisation, technical measures to protect that data at the institution—privacy by design and default. There are a lot of concepts that I think need to be introduced before it's ready. That's why we stressed that the privacy factor should come first, and this legislation shouldn't supersede it. I'm really worried that we're going to have a very painful fight about the Privacy Act review and, in the end, this is going to do something else entirely, because it was passed a year before it. Please be wary of the sort of world we're creating for people and the injustices that we risk perpetuating.

Senator AYRES: That's your primary view, is it—that the Privacy Act review ought to happen first? Mr Warren, I wouldn't have necessarily read this in the explanatory memorandum, but the second-last page of your submission quotes the explanatory memorandum, saying:

Data sharing decisions by data custodians will not be reviewable on their merits under this scheme. Such decisions are best made by data custodians as they have a full understanding of the risks of and public interest in sharing their data.

This is one of the most high-handed things I've read for a while. That was in the context of the capacity for review of decisions. There has been some discussion about transparency—what data-sharing decisions are being made and how Australians see into that. In your view, is the legislation redeemable by amendment and, if so, what are the top three priorities for you, in terms of amendment?

Mr Warren : That's tricky, because the approach being taken is that it came out of the Productivity Commission and took a very financial view of data having value—that it's government data and we should unlock greater value from it. Firstly, I would question that. There's lots of government policy that never gets enacted, even though we have plenty of data about what we should be doing. Yet we ignore it, sometimes for many decades. We haven't closed the gap for 30 years, for example. Maybe we should get on with doing that first before we go researching new problems and proving that we will actually do something with all this lovely research. Having said that, I think there is room for greater data access and transparency. The trouble is that it's: what data? If data about individuals were removed and this became data about operations of government, then I think that the legislation would have value. We, as individuals, could gain greater faith that government could keep data safe, because it would be data about itself rather than data about us. That would align the incentives of government to make sure there wasn't a data breach and that the Russian or Chinese government wouldn't get a hold of all this lovely data. Prove you can do that first, then you can come for my medical scans.

I would also like to see consequences. If a breach happens, there should be a private action, which has already been passed by the Australian Law Reform Commission. That has been waiting to happen since 2014. At the moment, the only recourse that we have is to wait for a regulator to occasionally act. We have had plenty of royal commissions about circumstances where regulators have failed to act. So we are left with no recourse if the government decides not to police itself. That must change. There must be consequences for bad behaviour. Waiting for good intentions and hoping that we can shame people into behaving in the correct way does not work. There must be consequences, and the consequences have to actually happen. If we wait for government to do them, then we are at the mercy of a government that polices itself or decides not to. And, unfortunately, we're seeing that happen far too often.

The final one would be just to have fundamental privacy protections that exist as a matter of Constitution. We, in Australia, are unlike any other comparable democratic regime. We do not have a bill of rights that encodes things like personal privacy. That must happen. It's astounding that we're here in 2021 and we still don't have that as a fundamental part of the make-up of our democratic society. That would provide us with a backstop of protection, no matter what government decides it wants to do from day to day. Maybe this government can be trusted with this access and transparency legislation, but the next one may not. We need to have that kind of continuous protection regardless of the vagaries of one government changing to another. We've seen in other regimes overseas very recently what happens when there is a sudden and rapid shift to an extreme. Laws can simply be ignored.

If those were to happen, yes, I think this legislation would be redeemable. It's a big ask, though. Failing that, I think you need to wait until privacy more generally is reviewed and we start to grapple with this as a whole-of-government exercise, rather than trying to carve out a special exemption to get rid of all these pesky privacy laws that we don't really want to have to deal with.

Senator AYRES: Thanks, both of you, for that discussion. Chair, I've concluded.

CHAIR: Thank you very much, Senator Ayres. If there are no further questions from other senators, that will be all from these witnesses today. Thank you so much for your testimony. I would like to thank all witnesses who've given evidence to the committee today. Thanks to Hansard and Broadcasting for their support as well. The deadline for questions on notice is 22 April. I now declare this meeting of the committee adjourned.

Committee adjourned at 12:01