Identity Management: Is an Identity Card the Solution in Australia? Presentation to RSNA Conference The Social Implications of Information Security Measures on Citizens and Business Margaret Jackson and Julian Ligertwood May 2006 Presentation to RSNA Conference The Social Implications of Information Security Measures on Citizens and Business Margaret Jackson and Julian Ligertwood May 2006

Company OverviewSlide 2 Introduction This paper examines the Governments most recent proposals for identity-related cards and the UK Identity Cards Act It asks whether a national identity card will address public and private security concerns while remaining consistent with privacy laws

Company OverviewSlide 3 Australian ID Card Proposals ID Card during World War II Australia Card (1987) Australia Card II ( ) – July bombings/Jan announcement by Ruddock/shelved April 2006 Human Services Smartcard ( )

Company OverviewSlide 4 Identity Cards Act 2006 (UK) Section 1(3) of the Act sets out the purposes of the national identity register: … to facilitate, by the maintenance of a secure and reliable record of registrable facts about individuals in the United Kingdom – (a) the provision of a convenient method for such individuals to prove registrable facts about themselves to others; and (b) the provision of a secure and reliable method for registrable facts about such individuals to be ascertained or verified wherever that is necessary in the public interest. Something is in the public interest if it is in the interests of national security; or is required for the purposes of the prevention or detection of crime, of enforcement of immigration controls, of the enforcement on prohibitions on unauthorised working or employment, or for securing the efficient and effective provision of public service (Identity Cards Act 2006 (UK) s1(4)).

Company OverviewSlide 5 UK Identity Cards Act Sections 3,6-7 & Schedule 1 set out the information to be collected and retained on the register Section 10(1) provides for updating personal information but only Sec of State appears to have the power to correct data Sections 17 – 20 provides for public interest access to the register by government agencies – individuals consent not required

Company OverviewSlide 6 UK Identity Cards Act cont… The Act also: -empowers the Secretary of State to enforce registration (section 7) - establishes new offences for the possession of false identity documents (sections 25 & 31) -prohibits compulsory production of the card (section 16) except when accessing public services (section 13)

Company OverviewSlide 7 UK Identity Cards Act cont… The Act does not provide for: - a time limit on storage of personal information - a right of access to the Register by an individual - a requirement that an individual consents to third party provision of data

Company OverviewSlide 8 UK Identity Cards Act cont… The Act will allow about 265 government departments and 44,000 private sector organisations access to the register

Company OverviewSlide 9 UK Identity Cards Act cont… The UK Government maintains that its Identity Card scheme will: - Help prevent crime that depends on being able to use false identities -Enable people to access current services more easily -Provide a watertight proof of identity for use in everyday transactions and travel -Provide a means of providing more efficient services

Company OverviewSlide 10 UK Identity Cards Act cont… However, the UK Information Commissioner has voiced concerns that the Act is potentially inconsistent with the Data Protection Act (UK) 1998 including that: The proposed extent of the information retained on the National Identity register is unwarranted and intrusive The breadth of the purposes of the Act could lead to function creep into unacceptable areas of private life The technical and administrative arrangements proposed in the Act lack independent oversight The large breadth of organisations with access to the register is inconsistent with a secure database The extent, in practice, to which individuals consent to a check will be freely given, specific and informed There will be extensive use of secondary legislation and a lack of privacy impact assessments. Primary legislation should be used to make the scheme compulsory, with appropriate safeguards

Company OverviewSlide 11 UK Identity Cards Act cont… The London School of Economics undertook a major investigation into the Identity Cards Bill, producing a report titled The Identity Project: an assessment of the UK Identity Cards Bill and its implications on 27 June 2005 It stated that the proposals are: too complex technically unsafe overly prescriptive lacking a foundation of public trust and confidence

Company OverviewSlide 12 UK Identity Cards Act cont… The LSE Report found: No evidence that the introduction of the proposed UK Identity card would reduce identity fraud and could lead to a greater incidence of such fraud An identity card would have no impact on private sector fraud such as credit card fraud An identity card would not reduce most immigration fraud and that money laundering usually does not involve false identities Its only likely effective role would be to reduce social security fraud The Report concluded that the proposal would be very expensive and queried the Governments calculations This Report provided the basis for the initial rejection of the Identity Cards Bill in the House of Lords on 16 January 2006

Company OverviewSlide 13 Will a national identity card scheme work? The UK Government has not been able to show how the Identity Card and the Register will be used to reduce terrorism and other security threats The LSE Report found that an identity card would have little impact on identity fraud and on a range of other areas of fraud (would affect 1% of total benefit fraud) An Australia Card similar to that in the UK may be in breach of privacy laws

Company OverviewSlide 14 What scheme could work in Australia? Various identity cards already exist in Australia. Passports, drivers licence and Medicare Cards are quite acceptable by Australians as they have clearly defined purposes Proposed cards: -Human Services Card -Document Verification Service -E-Passport -Medicare Smart Card -Electronic Health Records (Health Connect)

Company OverviewSlide 15 The Access card First mentioned in April 2005 as the Human Services Smartcard July 2005 – Government Services Card Contain a photo, replace 26 government services cards and concession cards and cost $500 million January 2006 – compulsory ID card for all welfare recipients and contain biometric Feb 2006 – to be used via EFTPOS machines for medical bill reimbursement March – stop welfare fraud and for disaster relief but only compulsory for the provision of government services

Company OverviewSlide 16 The Access card April 2006, Cabinet approves a smart card for access to health and welfare services – cost approx $1.1 billion Subsequently referred to as the access card Who can access it?

Company OverviewSlide 17 Purpose: -reduce welfare fraud -replace 17 other cards, including Medicare and aged pension cards -make payments to patients -provide instant Medicare rebates via EFTPOS machines in surgeries (still included?) -make welfare payments -delivery of services, not national security -disaster relief -slash red tape -all government financial transactions What information is collected? - biometric photographic identification -medicare number -- name -signature -Microchip will contain age -information about dependants -address Proposing a voluntary field: -blood type -organ donor -allergies -emergency contacts -but no health records Who can access it? -(originally ATO, Centrelink, Medicare, DEWR, Aust Customs Service, DITR) -Coles and Woolworths -Readers to be placed in all doctors surgeries, chemists and ambulances Proposing a user-managed data vault for personal information that the user can make available to specific agencies Individuals can access it to update details Who does it apply to? -aged pensioners -those on welfare (unemployment, disability, etc) -veterans -child care rebates -PBS -Austudy -Maternity payments -Family tax benefit payments -people with a Medicare card

Company OverviewSlide 18 Concerns Government history of dealing with personal information eg ICAC reports and the Victorian Police LEAP database Deputy Secretary of Dept of human Services says that the card will deliver significant benefits to government Treasurer quoted as saying he proposed card will contain more information than the Australia card Head of the taskforce implementing the proposed card will contain more information than the Australia card Ruddock days the smartcard development reflected ongoing work on better ensuring peoples identities remained secure

Company OverviewSlide 19 Conclusion If Australia uses the UK Identity Cards Act as a model for its own national identification scheme, the Governments original, vaguely stated objectives of ensuring national security and reducing identity fraud, would not be met The Access card might reduce government services fraud The need for a national identification scheme and identity card will have to be demonstrated compellingly and should not merely be an attempt to use one card to solve a range of identity management and verification issues