If you have never heard of the proposed Data Sharing and Release Act you are not alone.
The new legislation, which will over-ride the Privacy Act (where there are conflicts), has been quietly planned for the past year or so, without much fanfare and little media interest.
When it has been subject to reportage, the focus has been on the Consumer Data Right, which will require businesses to give consumers data they hold about us so we can transfer it to competitors for a better deal. The Consumer Data Right will be initially implemented in the banking sector, telecommunications and energy sectors.
But this new right is only one aim of the Data Sharing and Release Act, which has far wider implications and consequences. The new Act creates an entirely new system to govern what both government and private sector organisations will be able to do with the information they hold about us.
Anyone remotely interested in the ramifications of MyHealthRecord need to keep reading because what is being done to your health data is only one small piece of the puzzle when it comes to government plans for sharing our data.
In fact, the one article I did find announcing consultation for the new legislation claims:
“If the new law does come into effect, it would effectively be a government-wide version of what the Health Department has been trying to do with its controversial MyHealth Record Service.”
Given the launch of the consultation period early this month, the media silence over this new law contrasts palpably with the heavy focus initiated by the MyHealthRecord opt-out period.
One possible reason for the dearth of media interest is possibly the lengthy and complex backstory, which I managed to condense into a few tweets in a thread that went viral:
People interested in #myhealthrecord might also be interested in new legislation being introduced which will over-ride the Privacy Act to allow sharing of your administrative data https://t.co/WFvpyTfkhu #Auspol
— Rosie Williams (@Info_Aus) July 16, 2018
History of the Data Sharing and Release Act
So what is that history? Many people will recall the huge outcry over the 2016 Census but few people fully understand what was fueling the concerns of privacy advocates.
Mainstream media was of little help as it reported the Government claims (later criticised in the ‘2016 Census: Issues of trust’ Inquiry Report) that nothing much had changed with the Census.
The reality could not be further from the truth. And while the ABS did get chastised by the ensuing Inquiry Report for misleading the press, the media’s lack of critical analysis in its own reporting was not remarked upon.
Governments of either persuasion have been trying to de-anonymise the Australian Census for decades.
It is an interesting fact that the reason Australia has privacy legislation at all is due to the outcry against the threatened de-anonymisation of the 1976 Census:
“The ALRC received a wide-ranging reference on privacy from the federal Attorney-General in April 1976. At the same time, public controversy arose in relation to certain aspects of the Census to be held on 30 June 1976, therefore, the Attorney-General requested that the implications of the census for individual privacy be taken into account in the Commission’s general reference. The ALRC released a discussion paper Privacy and the Census (ALRC DP 8) in 1978 and its first report, Privacy and the Census (ALRC Report 12), was tabled in federal Parliament in November 1979” (Quote from ALRC web site)
Has the Govt got your confidence despite the #CensusFail, or do you find yourself agreeing with Shorten? #TheDrum pic.twitter.com/MvOppfJcac
— ABC The Drum (@ABCthedrum) August 10, 2016
Up until the ill-fated 2016 Census, the ABS had always maintained the privacy and integrity of the Australian census by keeping names and other identifying information only until the data had been processed.
Successive attempts had been made to dispense with these privacy protections, but past ABS heads saw that the ABS Charter and the Census and Statistics Act – which govern the Census as being to collect and provide statistics only – by their nature, should be anonymous. The Census and Statistics Act requires that significant changes to the Census need to be put before parliament and subject to a public vote by our representatives.
In 2005, the Howard Government again sought to de-anonymise the Census for the purpose of using it to join multiple administrative datasets together in what is termed ‘cross-portfolio data integration projects’.
“The consultants described this as moving the Census from a ‘snapshot’ of your life to a ‘movie’ of your life.”
With the 2016 Census, the Turnbull Government finally got past the privacy advocates by doing an internal Privacy Impact Assessment – critiqued here as ‘manifestly inadequate’ – and keeping their plans quiet right up until a few months before the Census was due to run.
By the time people understood what was going on, the government had moved governance of data integration projects to the Department of Prime Minister and Cabinet – under Minister for Law Enforcement and Cyber Security Angus Taylor and directly under Prime Minister Malcolm Turnbull – and replaced the role of the Cross Portfolio Data Integration Oversight Board with the Secretaries Data Group.
If you are wondering why any of this matters, it is because this is all to allow the Government to take the personal information (name, date of birth, address) provided with our Census forms and create a key with it, to string together all our administrative datasets and make this panopticon available to research and industry.
When gauging what the public might make of these plans back in 2014, the consultants conducting focus groups on behalf of the ABS described this as moving the census from a “snapshot” of your life to a “movie” of your life. If you care to, you can read about it here and consider for a moment how such a momentous change as the de-anonymisation of the Census was justified off the back of a handful of focus groups and a hundred or so participants!
Not to be deterred by the #CensusFail debacle, in December that year (2016), the Productivity Commission was tasked by Prime Minister and Cabinet with the Data Access and Use Inquiry which proposed the changes now being implemented by Prime Minister and Cabinet. Under current arrangements, only the ABS, AIHW and the AIFS are able to integrate data from different government portfolios (such as joining ATO data with Centrelink data).
The Data Sharing and Release Act decentralises this capacity, providing multiple accredited data authorities – termed Accredited Release Authorities or ARAs in the Productivity Commission’s report – under the oversight of the new National Data Commissioner:
ARAs would be sectoral hubs of expertise, independent entities that are funded by the Commonwealth (but may be based in a State or Territory, or even a not-for-profit entity that has a public interest focus).
ARAs would, under governance arrangements agreed with cooperating dataset custodians, be responsible for whether a dataset is available for public release or limited to sharing with trusted users. Dataset custodians would retain their legislated responsibility for original data contributed to ARAs and so make the choice regarding its release or sharing in that original form; but where an ARA goes on to transform data (for example via integration, linkage, de-identification or use of Artificial Intelligence) the transformed dataset would become the primary responsibility of the ARA. The ongoing maintenance and updating of the transformed dataset would necessitate cooperation between ARAs and custodians of component datasets.
This is revolting. How can Australia treat it’s citizens like that? #privacymatters
Australian government plans to do a Facebook on citizens’ data • The Register – https://t.co/brkQeHGben
— Andreas Brandenborg (@Andtaeus) May 2, 2018
Despite what might be becoming blindingly obvious to you – that the construction of these data integration projects is already well advanced – there is one impediment to them and that impediment is the Privacy Act 1988.
Until the Data Sharing and Release Act comes into effect, it is a breach of the Privacy Act and the Australian Privacy Principles, upon which it is based, for agencies to use our administrative data for secondary purposes not directly related to providing us service. Re-using our administrative data to create research products and services is one such secondary purpose forbidden by the Privacy Principles.
With the exception of “health data” – for which there is a carve-out – the Privacy Act requires that data can be collected by the government (and all entities subject to the Act) only where absolutely necessary and only to be used for the purpose for which it was provided.
The guidelines for secondary use of MyHealthRecord data stipulate that (due to the aforementioned exception), MHR data can already be integrated with other datasets:
‘6.1 The Board can permit the linkage of MHR system data with other data sources once the applicant’s use is assessed to be of public benefit.’
The government would now like to expand this privilege across all your administrative data and override the Privacy Act where conflicts arise so that government and other organisations can share your data under the new framework put in place by the Data Sharing and Release Act.
Data is not a dirty word, Michael Keenan says https://t.co/aLUU0dmXaL https://t.co/XmSuFAmXIC
— Elizabeth Foley (@EFoley62) July 3, 2018
Minister for Human Services Michael Keenan puts it more succinctly, saying that the Bill proposes to:
“…provide authority for sharing and release of data where currently prohibited.”
In the past, research data was collected from voluntary participants specifically for the purpose of the research by qualified academics governed by ethics committees. Administrative data, on the other hand, is not volunteered by us with the intention of answering research questions or subject to opt-out. With the advent of the concept that “data is the new oil”, the Government has begun turning our administrative data into products to sell to industry and researchers.
The advent of MyHealthRecord is an early example of this effort. The main difference between what is happening now with MyHealthRecord and what the Government is building with our Census data is that, unlike MyHealthRecord, which can be accessed by up to 12,000 access points across the country, access to the cross-portfolio data integration projects will be governed according to the following framework:
Model framework provided by the Productivity Commission in the draft report of the Data Access and Use Inquiry.
A key question for the public is exactly who will be considered a “trusted user” in this model and thereby given access to our data? Given the recent public comments from the insurance industry still hoping for access to MyHealthRecord, one has to wonder whether and how this framework will protect the public from exploitation and plunder by industries only too keen to take advantage of any data they can get their hands on.
To read more about the new framework under which your data will be managed check out the high-level summaries here, the introduction to the legislation here or the new Data Commissioner’s site here. The ‘Productivity Inquiry Report’ that contains more detail is available here.
Rosie Williams is a citizen journalist who has written extensively on issues of open government, data policy and privacy. You can follow Rosie on Twitter @Info_Aus. This article was first published on the Independent Australia website.
Do you know more? Contact James Riley via Email.