Government bill needs better privacy protections
This week HTI Director Professor Edward Santow gave evidence at the Senate Legal & Constitutional Affairs Legislation References Committee hearing for a critical piece of Australia’s digital identity system. HTI also provided a formal written submission for this inquiry.
The Identity Verification Services Bill 2023 (Cth) (IVS Bill) would provide a legal framework for a number of digital ID systems that are already in operation. Professor Santow said the Bill’s privacy protections needed to be strengthened, especially given that this system relies on facial recognition and other privacy-intrusive technologies. The system was used more than 140 million times last year without any clear legislative authority.
Professor Santow noted that the goal of digital ID is to increase convenience for citizens, reduce privacy and other risks, and save money for government and the private sector.
This goal can be achieved only if the underlying technology is sound, and if there are strong legal safeguards.
Otherwise digital identity brings enormous risks – especially to Australians’ privacy rights.
- Prof Edward Santow
The privacy protections in the bill only require organisations to comply with existing Australian or New Zealand privacy law. While the Government has committed to Privacy Act reform, there is no timeline for this, so if the IVS Bill is passed, it will rely on fundamentally inadequate privacy protections.
At the same time, Australia’s Finance Minister has released an exposure draft Digital ID Bill – legislation that is intimately connected to the IVS Bill and which proposes additional privacy protections.
Professor Santow urged the Government to consider the following options to ensure adequate privacy protections:
1. The Government could introduce the Privacy Act reforms before proceeding with the IVS Bill.
2. The IVS Bill could be amended to include an equivalent to Chapter 3 of the Digital ID Bill, so that the digital ID scheme as a whole would contain consistent and more effective privacy protections.
3. The IVS Bill could be amended to empower the Minister to make rules in subordinate legislation to strengthen the privacy protections of the IVS Bill.
In addition, Prof Santow called for broader reform of facial recognition technology, in line with HTI’s model law.