Multi-purpose identifiers

30.105 This section discusses identifiers assigned to individuals by governments for use by multiple government agencies and organisations (multi-purpose identifiers). The section commences by providing an overview of concerns that have been expressed about the impact on privacy of multi-purpose identifiers. It then examines the history of identification schemes in Australia before discussing the recently abandoned access card scheme. Finally, the ALRC makes a recommendation to address the privacy concerns associated with unique multi-purpose identifiers.

Benefits and privacy concerns

30.106 Schemes involving multi-purpose identifiers can have a number of benefits. For example, they can increase administrative efficiency and enhance data accuracy.^[137] The existence of multi-purpose identifiers, however, also raises a number of privacy concerns. One such concern is that the introduction of a multi-purpose identifier changes fundamentally the relationship between the individual and government.^[138] In liberal democratic societies, governments are accountable to their citizens. It has been argued that the introduction of a multi-purpose identifier symbolically reverses this tradition, making citizens accountable to their governments.^[139] This could then open the way for ‘further extensions of government power and … further restrictions on the individual’s sphere of independent action’.^[140]

30.107 It also is argued that linking a multi-purpose identifier to a name limits the ability of individuals to use different names in different contexts.^[141] At common law, there is nothing to prevent an individual from operating under various names, provided that he or she does not use different names to engage in unlawful behaviour.^[142] Aliases may be used by a variety of people, such as artists, authors and intelligence operatives.^[143]

30.108 Further, the introduction of multi-purpose identifiers increases the ability of the state to monitor the activities of its citizens. By recording multi-purpose identifiers during transactions, government agencies and organisations can compile substantial amounts of information about a person, including information about a person’s financial circumstances, family composition, hobbies or health. This could then be used for a variety of purposes, such as to locate a person or to determine a person’s interests for the purposes of direct marketing.

30.109 Different agencies or organisations could then combine the data collected about the transactions or activities of particular individuals to create a richer dataset. This process is known as data-matching.^[144] The use of a multi-purpose identifier facilitates greatly the data-matching process. The ability of a government to compile dossiers of personal information about individuals could have a ‘chilling effect’ on the activities of citizens, who no longer have a private sphere in which to relax, experiment or engage in creative pursuits.^[145]

30.110 In addition, the unintended dissemination of either the identity information required to be provided by individuals in order to receive a multi-purpose identifier, or data generated by the use of the multi-purpose identifier, can erode the privacy of the individual to whom the information relates.^[146] For example, such information could be stolen by a ‘hacker’; accidentally disclosed through an administrative error; or deliberately sold by those with access to it, such as employees of agencies. This can increase the risk that the individual will subsequently become the victim of identity theft.^[147]

30.111 Another privacy concern relates to the quality of the data involved in an identification scheme involving multi-purpose identifiers. Errors inputting data for the purposes of the scheme, or corruption of stored data, could impact adversely on the ability of individuals to access the services for which the multi-purpose identifier is required.

30.112 Finally, it has been argued that identity documents have had a long history of discriminatory uses for social control.^[148] One commentator has noted that slaves in the United States were required to carry identification papers to travel, Nazis used identification cards to locate Jewish people during World War II, and the slaughter of Tutsis in Rwanda was aided by the fact that their identity cards revealed their ethnicity.^[149]

History of identification schemes in Australia

Identification schemes in wartime

30.113 Several identification schemes were implemented in wartime Australia. During World War I and World War II, all aliens (non-British subjects) were required to register with local government officials.^[150] After registration, they were required to notify officials if they changed their address^[151] and to produce their certificates of registration on demand.^[152] In 1942, all residents of 16 years of age or above (other than aliens and other specified groups, such as members of the Defence Force performing continuous full-time war service) were required to register with local government officials in order to obtain an identity card.^[153] They were then required to produce their identity cards if requested to do so by specified people, such as constables on duty.^[154]

The Australia Card

30.114 In September 1985, the Australian Government announced its intention to develop a national identification scheme—the ‘Australia Card’ scheme^[155]—to combat tax fraud, social security fraud and illegal immigration.^[156] In May 1986, a Joint Select Committee on an Australia Card delivered a report that strongly recommended against the introduction of the Australia Card. The Committee suggested a number of alternative reforms such as: the computerisation of all state and territory registries of births, deaths and marriages;^[157] and the introduction of an upgraded, high-integrity tax file number scheme.^[158]

30.115 In October 1986, the Australia Card Bill 1986 (Cth) was introduced into Parliament. On two occasions the Australia Card Bill was passed by the House of Representatives^[159] only to be rejected by the Senate.^[160] Under s 57 of the Australian Constitution this became a potential trigger for a double dissolution election. Accordingly, in May 1987, the Australian Government announced Australia’s sixth double dissolution election.^[161] On 11 July 1987, the Australian Labor Party was returned to office and the Australia Card Bill was reintroduced into Parliament for a third time. The Bill was ultimately laid aside after Opposition senators indicated that they would disallow regulations that were required to bring crucial clauses of the Bill into effect.^[162]

Other proposed identification schemes

30.116 After the bombings in London in July 2005, the then Prime Minister of Australia stated that the introduction of a national identification scheme was an issue that should be ‘back on the table’.^[163] The introduction of such a scheme was discussed on a number of occasions during 2005 and early 2006.^[164] On 26 April 2006, however, it was announced that the Australian Government did not intend to proceed with the introduction of a compulsory national identity card. It did intend, however, to introduce a new card that would be required to access health and welfare benefits (the access card).^[165]

The access card

Overview

30.117 The access card scheme was intended to enable consumers to access all health and social services with one card; access emergency relief payments through automatic teller machines and through Electronic Funds Transfer at Point of Sale (EFTPOS);^[166] and reduce fraud in relation to Australian Government benefits.^[167]

30.118 The access card would have replaced up to 17 existing health care and social services cards and vouchers.^[168] It would have displayed the cardholder’s name and photograph on its front, and the cardholder’s signature and card number on its back.^[169] Other personal information, such as the cardholder’s photograph, date of birth, concession status, and details of the cardholder’s children or dependants would have been stored on a microchip embedded in the card.^[170] Information on the card and the chip would have been stored on a database that would have been maintained separately from existing agency databases.^[171]

30.119 The Human Services (Enhanced Service Delivery) Bill 2007 (Cth), was introduced into the House of Representatives on 7 February 2007. The Bill provided a framework for the introduction of the proposed access card scheme^[172] and stated that the purpose of the scheme was to improve the delivery of Commonwealth services and reduce fraud, particularly in relation to identity theft.^[173] Later legislation was intended to provide detail on aspects of the scheme such as information protection, uses of the card, and review and appeal processes.^[174]

30.120 On 8 February 2007, the provisions of the Bill were referred for inquiry to the Senate Standing Committee on Finance and Public Administration (the Committee).^[175] The Committee released its report on 15 March 2007.^[176] The Committee endorsed the goals of the proposed access card scheme^[177] but noted that a number of privacy concerns that related to the architecture of the scheme were not dealt with by the Bill.^[178]

30.121 At the time the federal election was called in October 2007, the Australian Government was conducting consultations on a revised exposure draft of access card legislation.^[179] Shortly after winning the federal election in November 2007, the Australian Labor Party announced it would not proceed with the access card scheme.^[180]

Privacy and the access card scheme

30.122 A number of concerns were expressed about the potential impact of the access card scheme on privacy. Some argued that the access card scheme was the same as the failed Australia Card scheme.^[181] Other commentators were concerned about: profiling of individuals through the use of access card numbers;^[182] accessing of the database for illegitimate purposes; ^[183] and the possibility for ‘function creep’^[184] if new legislation required or authorised the use or disclosure of personal information collected for the access card scheme, or new uses for the access card.^[185]

Regulation of multi-purpose identifiers

30.123 In light of the above, in IP 31 the ALRC asked what role the Privacy Act should play in the regulation of multi-purpose identifiers.^[186]

30.124 In DP 72, the ALRC expressed the view that the policy intent of NPP 7 remains relevant for Australian Government identification schemes, such as the proposed access card scheme. The ALRC noted that multi-purpose identifiers such as the proposed access card number would likely fall within the definition of ‘identifier’ in the ‘Identifiers’ principle. Any exceptions to the ‘Identifiers’ principle should be set out clearly in legislation establishing such schemes. To this end, the ALRC proposed that before introducing a multi-purpose identifier, the Australian Government, in consultation with the Privacy Commissioner, should consider the need for a privacy impact assessment (PIA).^[187]

Submissions and consultations

30.125 Several agencies expressed support for the practice of conducting a PIA before introducing a multi-purpose identifier.^[188] The Department of Human Services supported the ALRC’s proposal on the basis that it afforded flexibility to the Australian Government by not mandating the requirement for a PIA but allowing the Government to consider whether there was a need for a PIA.^[189]

30.126 On the other hand, a number of stakeholders submitted that the ALRC’s proposal would not provide individuals with sufficient privacy protection.^[190] The OVPC submitted that mandatory PIAs should be required in the context of multi-purpose identifiers.^[191] The OPC supported mandatory PIAs in cases where significant privacy risks are anticipated, and submitted that multi-purpose identifiers often create such risks.^[192]

30.127 The Cyberspace Law and Policy Centre submitted that, for the regulation of multi-purpose identifiers,

[a]ny variations from the application of any of the principles should be defined by specific legislative provisions stating exceptions or variations, and not left to inference from the existence of a different set of principles. Such an approach will (i) ensure that variations are obvious; (ii) facilitate a consistent body of law emerging on both the core principles and the exceptions.^[193]

ALRC’s view

30.128 The ALRC has not recommended that the ‘Identifiers’ principle apply to agencies. Multi-purpose identifiers, however, pose significant privacy risks. Accordingly, such identifiers should be established by legislative schemes that set out clearly the exceptions to the ‘Identifiers’ principle. The ‘Identifiers’ principle would regulate the adoption, use and disclosure by organisations of multi-purpose identifiers where this is not addressed by specific legislative regimes establishing such identifiers.

30.129 The potential privacy risks of multi-purpose identifiers are always so significant that the Australian Government, in consultation with the OPC, should be required to conduct a PIA before the introduction by agencies of any multi-purpose identifier. This proactive approach encourages agencies to incorporate privacy and security safeguards into the design of multi-purpose identifiers.