Identity Management: Is an Identity Card the Solution in Australia?

1. Identity Management:Is an Identity Card theSolution in Australia? Presentation to RSNA Conference The Social Implications of Information Security Measures on Citizens and Business Margaret Jackson and Julian Ligertwood May 2006 Presentation to RSNA Conference The Social Implications of Information Security Measures on Citizens and Business Margaret Jackson and Julian Ligertwood May 2006

2. Introduction • This paper examines the Government’s most recent proposals for identity-related cards and the UK Identity Cards Act • It asks whether a national identity card will address public and private security concerns while remaining consistent with privacy laws Company Overview

3. Australian ID Card Proposals • ID Card during World War II • Australia Card (1987) • Australia Card II (2005 -06) – July bombings/Jan announcement by Ruddock/shelved April 2006 • Human Services Smartcard (2005 -06) Company Overview

4. Identity Cards Act 2006 (UK) • Section 1(3) of the Act sets out the purposes of the national identity register: • … to facilitate, by the maintenance of a secure and reliable record of registrable facts about individuals in the United Kingdom – • (a) the provision of a convenient method for such individuals to prove registrable facts about themselves to others; and • (b) the provision of a secure and reliable method for registrable facts about such individuals to be ascertained or verified wherever that is necessary in the public interest. • Something is in the public interest if it is in the interests of national security; or is required for the purposes of the prevention or detection of crime, of enforcement of immigration controls, of the enforcement on prohibitions on unauthorised working or employment, or for securing the efficient and effective provision of public service (Identity Cards Act 2006 (UK) s1(4)). Company Overview

5. UK Identity Cards Act • Sections 3,6-7 & Schedule 1 set out the information to be collected and retained on the register • Section 10(1) provides for updating personal information but only Sec of State appears to have the power to correct data • Sections 17 – 20 provides for “public interest” access to the register by government agencies – individual’s consent not required Company Overview

6. UK Identity Cards Act cont… • The Act also: - empowers the Secretary of State to enforce registration (section 7) - establishes new offences for the possession of false identity documents (sections 25 & 31) - prohibits compulsory production of the card (section 16) except when accessing public services (section 13) Company Overview

7. UK Identity Cards Act cont… • The Act does not provide for: - a time limit on storage of personal information - a right of access to the Register by an individual - a requirement that an individual consents to third party provision of data Company Overview

8. UK Identity Cards Act cont… • The Act will allow about 265 government departments and 44,000 private sector organisations access to the register Company Overview

9. UK Identity Cards Act cont… • The UK Government maintains that its Identity Card scheme will: - Help prevent crime that depends on being able to use false identities - Enable people to access current services more easily - Provide a watertight proof of identity for use in everyday transactions and travel - Provide a means of providing more efficient services Company Overview

10. UK Identity Cards Act cont… • However, the UK Information Commissioner has voiced concerns that the Act is potentially inconsistent with the Data Protection Act (UK) 1998 including that: • The proposed extent of the information retained on the National Identity register is unwarranted and intrusive • The breadth of the purposes of the Act could lead to function creep into unacceptable areas of private life • The technical and administrative arrangements proposed in the Act lack independent oversight • The large breadth of organisations with access to the register is inconsistent with a ‘secure’ database • The extent, in practice, to which individuals’ consent to a check will be freely given, specific and informed • There will be extensive use of secondary legislation and a lack of privacy impact assessments. Primary legislation should be used to make the scheme compulsory, with appropriate safeguards Company Overview

11. UK Identity Cards Act cont… • The London School of Economics undertook a major investigation into the Identity Cards Bill, producing a report titled The Identity Project: an assessment of the UK Identity Cards Bill and its implications on 27 June 2005 • It stated that the proposals are: • too complex • technically unsafe • overly prescriptive • lacking a foundation of public trust and confidence Company Overview

12. UK Identity Cards Act cont… • The LSE Report found: • No evidence that the introduction of the proposed UK Identity card would reduce identity fraud and could lead to a greater incidence of such fraud • An identity card would have no impact on private sector fraud such as credit card fraud • An identity card would not reduce most immigration fraud and that money laundering usually does not involve false identities • Its only likely effective role would be to reduce social security fraud • The Report concluded that the proposal would be very expensive and queried the Government’s calculations • This Report provided the basis for the initial rejection of the Identity Cards Bill in the House of Lords on 16 January 2006 Company Overview

13. Will a national identity card scheme work? • The UK Government has not been able to show how the Identity Card and the Register will be used to reduce terrorism and other security threats • The LSE Report found that an identity card would have little impact on identity fraud and on a range of other areas of fraud (would affect 1% of total benefit fraud) • An ‘Australia Card’ similar to that in the UK may be in breach of privacy laws Company Overview

14. What scheme could work in Australia? • Various identity cards already exist in Australia. Passports, driver’s licence and Medicare Cards are quite acceptable by Australians as they have clearly defined purposes • Proposed cards: • Human Services Card • Document Verification Service • E-Passport • Medicare Smart Card • Electronic Health Records (Health Connect) Company Overview

15. The Access card • First mentioned in April 2005 as the ‘Human Services Smartcard’ • July 2005 – “Government Services Card’ • Contain a photo, replace 26 government services cards and concession cards and cost $500 million • January 2006 – compulsory ID card for all welfare recipients and contain biometric • Feb 2006 – to be used via EFTPOS machines for medical bill reimbursement • March – stop welfare fraud and for disaster relief but only compulsory for the provision of government services Company Overview

16. The Access card • April 2006, Cabinet approves a smart card for access to health and welfare services – cost approx $1.1 billion • Subsequently referred to as the ‘access card’ • Who can access it? Company Overview

17. Company Overview

18. Concerns • Government history of dealing with personal information eg ICAC reports and the Victorian Police LEAP database • Deputy Secretary of Dept of human Services says that ‘the card will deliver significant benefits to government’ • Treasurer quoted as saying he proposed card will contain more information than the Australia card • Head of the taskforce implementing the proposed card will contain more information than the Australia card • Ruddock days the smartcard development ‘reflected ongoing work on better ensuring people’s identities remained secure’ Company Overview

19. Conclusion • If Australia uses the UK Identity Cards Act as a model for its own national identification scheme, the Government’s original, vaguely stated objectives of ensuring national security and reducing identity fraud, would not be met • The Access card might reduce government services fraud • The need for a national identification scheme and identity card will have to be demonstrated compellingly and should not merely be an attempt to use one card to solve a range of identity management and verification issues Company Overview