ALP Senators' additional comments

ALP Senators' additional comments

Introduction

The ALP Senators on the Committee agree substantially with the content of the Committee Report and the recommendation to defer the bill.

The report covers many of the important issues raised in the public hearings and submissions.  It broadly reflects the concerns ALP Senators have with the legislation particularly the lack of clarity and certainty in key provisions of the bill, the impacts on privacy, the potential for the access card to become an identity card due to the presence of the photo and signature on the surface of the card, concerns with security of the information stored on the chip and database, the lack of Parliamentary scrutiny or oversight mechanisms and the inherent weakness in the offences and penalties provisions.

The ALP Senators support the Committee report's recommendation and list of matters to be taken into account, insofar as they seek to improve the access card legislation. However, there remain many unresolved issues and concerns which must be addressed before the access card system, including registration, is introduced. To resolve some of these issues, ALP Senators believe that the matters to be taken account listed in the Committee report should be more than just 'considered', as the report suggests. Most of these matters should be adopted and included in any redrafted legislation and the framework for the access card system.

Conduct of the Inquiry

The Human Services (Enhanced Service Delivery) Bill 2007 is a significant and complex legislative proposal. 

The first available date, having regard to the Senate sitting timetable, that public hearings could take place was Friday 2 March. The Committee has therefore had less than two weeks to consider the many written submissions, the substantial evidence given at three public hearings, the serious issues and concerns raised in respect to the bill and its implementation, and to draft and present its report.   

The ALP Senators are aware that the truncated timetable for the inquiry has placed unreasonable demands both on the Chair in producing a draft report and on the Secretariat staff who have had to work excessive hours under severe time pressures. 

In turn, the ALP Senators only received the final Chair’s draft report late on Wednesday 14 March, the day before the final report was due to be tabled.   

We agree with the concerns raised in the report regarding the lack of time to consider all issues.  We also note two other issues which support deferring consideration of this legislation by the Parliament.

Firstly, the Government has stated that this is only the first part of a legislative package and that further legislation will be introduced at an unspecified date to '...deal with the review and appeal processes for administrative decisions, further elements of information protection and legislative issues relating to the use of the card, including in relation to dependents'.[1]

Secondly, Professor Allan Fels, chair of the Access Card Consumer and Privacy Taskforce, has yet to present a number of key reports on the implementation aspects of the access card, while the taskforce's second report on registration is with the minister but has not been released.

ALP Senators therefore strongly endorse Committee recommendation 1 that this bill be combined with the proposed second tranche of legislation for the access card system into a consolidated bill.

The arrogance of the Government’s position is also reflected in the comments by the former Minister in the Second Reading Speech who labelled persons opposing or expressing serious concerns about the measures in the Bill as 'friends of fraud'.[2]

This is a despicable attack upon many reputable organisations and persons.  For instance, organisations such as the Office of the Privacy Commissioner, the Australian Medical Association, Carers Australia, the Federation of Ethnic Communities Council of Australia, the Australian Banker’s Association, Liberty Victoria, the Royal Australian College of General Practitioners, Legacy, MedicAlert and Vision Australia appeared during the public hearings and raised significant concerns with the legislation.

Professor Fels also expressed reservations regarding the inclusion of the biometric photo and digitised signature on the face of the card.[3] Many others provided considered written submissions and cogent views.[4]

It seems that the Government is intent on bludgeoning this legislation through and maligning its critics, rather than allowing a proper debate on the merits and detail of the access card legislation.

Registration and the Document Verification Service (DVS)

In evidence to the Committee the Department of Human Services stated that, on average, it expects 35,000 Australians to register each day for the card over a two year period.[5]

This is an average but the reality is that on any day the figure could be much higher, particularly in late 2009 and 2010 when many people may realise that they will lose access to Medicare and family tax benefits unless they have applied for the access card. 

ALP Senators are highly sceptical of the ability of the department and agencies to deal with this influx of applicants. We question whether there will be enough public servants trained to conduct rigorous registrations at all the locations that applicants will present to each day during the registration period.

Further, we are particularly concerned that the proposed on-line Document Verification Service (DVS) which will link the Department of Human Services to the Births, Deaths and Marriages offices in each state and territory will not be available until 2010.  We are concerned that a registration process that commences in advance of the DVS being operational will be corrupted by existing problems around document authentication and proof of identity. The risk of fraudulent cards being issued in the absence of the DVS will be high. For example, a project conducted by Westpac and the NSW Registry of Births, Deaths and Marriages in 2001 found that 13 percent of birth certificates presented to banks are false.[6]

In estimates evidence given to the Senate Legal and Constitutional Affairs Committee in February 2007, it was confirmed that there is no intergovernmental agreement yet on what documents are sufficiently reliable for proof of identity processes.[7] The absence of a common agreed view on document reliability puts the registration process at further risk of subversion. It is essential for the integrity of the access card in general and the goal of combating identity theft in particular that the DVS is fully operational before access card registration commences.

Recommendation

ALP Senators recommend that the registration process for the access card not commence until the Document Verification Service is fully operational.

Identity Card or Access Card? 

ALP Senators support the aims behind the access card, namely to improve the delivery of benefits and services, make it easier to deal with the relevant government agencies, reduce fraud and replace a range of cards, particularly the Medicare Card, with a smartcard.  This legislation, however, does not achieve those aims.

In a most unusual move, the Bill states in Clause 6 (2) – Objects of this Act:

It is also an object of this Act that access cards are not to be used as, and do not become, national identity cards.

The very fact that the Government believes it is necessary to include this clause indicates that the card has the potential to become an identity card.  In its current proposed form we believe that it is inevitable.  This is because the card will on its face contain the person's biometric photograph, digitised signature and unique personal identifier number. 

If the card is only intended to be for access to services then it is sufficient that such details only be included on the chip and not visible without a card reader.  

ALP Senators support the view that including the biometric photo, digitised signature and personal identifier number on the face of the card should be optional.

The Extent of Ministerial Power

This legislation will give enormous powers to the Minister and the Secretary of the Department to add private information to the database, expand the uses of the card and issue guidelines that will sidestep parliamentary oversight. For instance, the Secretary of the Department of Human Services will have the power to order original identity documents presented by a person registering for an access card to be scanned and stored on the register.

If, as many suspect, the access card becomes widely used as an identity card either voluntarily or otherwise, there will inevitably be calls from the private sector to seek access to the national registration database in order to verify the identity details of the cardholder. This will generate pressure to expand the purpose and use of the card. The capacity of the Minister and departmental secretary to permit any expansion without Parliamentary control needs to be curbed.

ALP Senators believe that the legislation should place limits on the discretionary powers available to the Minister and the Secretary and that those circumscribed powers should be subject to Parliamentary oversight.

Recommendation

ALP Senators recommend that the access card legislation limit the discretionary powers available to the Minister and the Secretary and that these powers are subject to Parliamentary oversight.

Offences 

The offences provisions in the legislation are incomplete, poorly drafted and appear to reflect policy discussions that are still taking place rather than decided policy on conduct the Government wants to prohibit. This is a major weakness in the bill. The offence provisions and authorised uses are scattered across a variety of divisions in the bill with no clear structure. It is unclear, for instance, that there are adequate offences or penalties relating to officers of the Crown who may inappropriately access stored information.

It is also unclear which agencies are authorised to deal with the access card register – to view, change or add to it – or which agencies have the power to require the card to be produced.

We also note concerns raised by the Australian Bankers Association and the AFP about the effect of Clause 57 which prohibits information from the card being copied and the conflict this raises in situations where a person gives permission for the card to be copied.[8] While subsequent advice suggests some of these concerns may be unfounded, the uncertainty about these issues reflects the rushed approach to, and poor drafting of, this bill.

Contracts and Tenders

The Committee heard the access card project will ultimately involve five primary contracts, or as they were described by the department 'procurement processes': systems administration, smart card manufacture, transaction delivery provider, terminals and infrastructure and the registration process. Two requests for tender have been released, that of systems administration and smart card manufacture.

ALP Senators note the department’s decision to have five separate contracts as opposed to one lead contract. The department indicated it had investigated best practice contracting for this type of project. The aim is to maintain competitive tension within some of those contracts to reduce the risk of the access card system being ‘captured’ by external service providers.[9] This approach amounts to a departure from the Howard Government's previous poor methodology for outsourcing major IT projects.

ALP Senators also note the department’s stated purpose of maintaining competitive tension within some of those five contracts is to reduce the risk of the Commonwealth being ‘captured’ by external service providers.

Many technical details about the operation and implementation of the access card were claimed to be unavailable to the Committee because of probity issues surrounding the tender process. 

This inhibited the Committee’s inquiries into basic details regarding the technical operation of the access card. For example, when asked a question about whether 35,000 registrations per day was feasible and related questions, witnesses representing CSC, a company bidding for the systems integration tender, were predictably unable to answer because of the deed of confidentiality they had been required to sign to participate in the tender.[10]

This raises the question of why the tender for the systems integration of the access card had already been released to the market prior to the bill being debated in, let alone passed by, the Parliament. This is contemptuous of the Senate committee inquiry and has hampered the gathering of key evidence.

It also raises the possibility of the Commonwealth, having called for a response to tenders that may have to be modified or cancelled, being left in a compromised position, depending on the outcomes of the processes of the Parliament.

This has also meant that the Committee was unable to get details of the registration process. For example, CSC provided evidence that implied the contract was structured so the external service provider would not be liable if the registration process did not achieve the Government’s claims of 35,000 per day. CSC identified the cooperation of the public as a key risk factor in achieving registrations to the levels foreshadowed by the Government.[11]

The Department also refused or was unable to provide detail regarding aspects of the technical operation of the access card, either on the ground that it would be in the next bill or that probity issues prevented disclosure. These issues fall into four categories:

  • The relationship (technical interface, including meta-data standards) between the existing multitude of databases in participating agencies and the new access card (Registration) database;
  • The management, security and distribution of authorised card readers linked to terminals with registration database access;
  • The detail of privacy safeguards, security, storage, access and archiving protocols of digitised personal, private ID information collected by the DHS through the registration process; and
  • The technical features of the smartcard itself including PIN protected areas, eg. an individual’s ability to protect the private part of the Card with a PIN separate to the PIN protecting information required to be held on the Card by the Commonwealth.

It is of great concern to ALP Senators that this critical information was unable to be provided. As a consequence, it is very difficult to assess the degree of privacy protection and technological and organisational security that will apply to both the access card and the registration database.

Recommendation

ALP Senators recommend that the Government not request any more tenders for access card related contracts until after consideration by Parliament of all access card bills. 

Other Issues

Whilst there are a number of other issues of concern, noted in the Committee report, that warrant the legislation being deferred, ALP Senators wish to highlight three matters of concern which were raised during the public hearings, but which the department was unable to adequately address or refute.

Firstly, Electronic Frontiers noted that it was 'completely inappropriate' that the chip's design has not yet been decided. ALP Senators note that the operational features, including many practical privacy and security related issues, depend on the design of the chip itself.  Hence it is extremely difficult to assess the veracity of the government's privacy and security claims in the absence of technical information and appropriate technical advice from experts on these matters.

Secondly, Legacy expressed a concern that there could be significant costs involved for war widows who have to obtain original documents for registration. The costs of identity verification were raised several times by witnesses.[12]  The department was not able to provide detailed information as to how they would ensure that registration would be affordable for all Australians

Thirdly, MedicAlert raised a serious concern that medical details stored on the access card register could create dangers because they can quickly become out of date or if the details are not verified by medical practitioners or authorities. MedicAlert is also concerned that its ongoing viability may also be threatened if the Government promotes the access card as an alternative to MedicAlert. MedicAlert provides an excellent service to hundreds of thousands of Australians.  Its service is unique as the health information on their database has to be verified by a doctor.[13] The implications of the access card need to be clarified to ensure there are no adverse consequences for the MedicAlert system and organisation.

These three matters are further examples of the rushed approach to this legislation and the gaps in it. In view of these and other shortcomings, this bill should be deferred.

 

Senator Michael Forshaw
Deputy Chair 		Senator Carol Brown
   
Senator Kate Lundy Senator Claire Moore

Navigation: Previous Page | Contents | Next Page