2023 DIGITAL ID ACCREDITATION
1. The Queensland Council for Civil Liberties (“the QCCL”) is a not-for-profit organisation that promotes civil liberties and receives queries from members of the public regarding their civil liberties and individual rights.
2. We make this submission in response to Digital ID Bill 2023 and Digital ID Accreditation Rules (“the ID Accreditation Bill”).
3. We have attached a copy of our submissions made in response to the Digital Transformation Agency (“the DTA”) public consultation regarding the Trusted Digital Identity Bill 2021 (“our TDIF Submission”).
4. We appreciate that the ID Accreditation Bill is not identical to the Trusted Digital Identity Bill 2021; however, we submit that our position generally stated in our TDIF Submission has equal application to the instant consultation. In essence, that submission was that:
a. the implementation of a digital identity scheme in Australia is a significant step and it is imperative that this is approached in a way that is measured, transparent, comprehensively safeguarded and that the Australian community is fully informed as to all potential consequences of this path; and
b. there are benefits that may be derived from a digital identity system in Australia; however, those benefits must be couched with clear and enforceable safeguards.
5. We consider that this is a balanced and reasonable position that measures the benefits for Australians against potential harm(s) that may arise from implementing a system into Australia law which will irretrievably alter the way that many Australians interact with government (and providers accredited under the Rules).
6. In our TDIF Submission, it was our position that:
… it is our submission that the Bill should not be progressed until at least the following has occurred:
a. an enforceable Federal human rights framework has passed into Australian law;
b. a public electoral campaign is held that brings the introduction of the Bill to an election;
c. further consultation is undertaken as to the operation of the Bill and the impact on Australians; and
d. public awareness polling occurs to ensure that the Bill and its operation is desirable to the Australian community.
It is our position that, although benefits could be inferred from the Bill, this legislation creates such a significant change to Australian life and the way in which Australians choose to identify and exchange identity that it warrants being taken to an election. In our view, the Federal Government is positioned to run this campaign and that process would significantly assist the Government in being able to make a genuine promise to the Australian community that the TDIF and Digital Identity arrangements can be trusted and that they are desirable to the Australian community.
In our view, put bluntly, if this arrangement is not taken to the Australian community via an election campaign, it will erode the trust required for this system to properly operate and demonstrate that the Bill is being introduced based on assumption rather than informed knowledge that the Bill is desirable.
7. We observe that our submission that the implementation of a digital identity scheme was not taken to the Australian public at the 2022 Federal election.
8. We also note that there are curious changes in the ID Accreditation Bill that are stark differences in drafting of core concepts in the Trusted Digital Identity Bill 2021. For example, we note the following changes to the definition of attribute of an individual.
9. In the Trusted Digital Identity Bill 2021, section 10(3) provided that the following is not an attribute of an individual:
(a) biometric information of the individual;
(b) a restricted attribute of the individual;
(c) information or an opinion about the individual’s:
a. racial or ethnic origin; or
b. political opinions; or
c. membership of a political association; or
d. religious beliefs or affiliations; or
e. philosophical beliefs; or
f. membership of a professional or trade association; or
g. membership of a trade union; or
h. sexual orientation or practices; or
i. criminal record;
(d) information that is prescribed by the TDI rules and relates to 12 the individual.
10. Section 10(4) of the Trusted Digital Identity Bill 2021 provided that “subsection (3) does not prevent information described in any of the paragraphs in subsection (2) from being an attribute of an individual if the information is not primarily of any of the kinds described in subsection (3), even if information of any of those kinds can reasonably be inferred from the information”.
11. However, these matters appear now to be specifically included as attributes of an individual. Indeed, the ID Accreditation Bill goes further and now provides the following at section 10:
(1) An attribute of an individual means information that is associated 8 with the individual, and includes information that is derived from 9 another attribute.
(2) Without limiting subsection (1), an attribute of an individual 11 includes the following:
(a) the individual’s current or former name;
(b) the individual’s current or former address;
(c) the individual’s date of birth;
(d) information about whether the individual is alive or dead;
(e) the individual’s phone number;
(f) the individual’s email address;
(g) if the individual has a digital ID—the time and date the 19 digital ID was created;
(h) biometric information of the individual;
(i) a restricted attribute of the individual;
(j) information or an opinion about the individual’s:
i. racial or ethnic origin; or
ii. political opinions; or
iii. membership of a political association; or
iv. religious beliefs or affiliations; or
v. philosophical beliefs; or
vi. sexual orientation or practices.
(our emphasis)
12. As the DTA would appreciate, this is a significant expansion (indeed, it encompasses previously excluded information) of the definition of “attribute”. Given that this definition is critical to the ID Accreditation Bill, and although we trust that this re-drafting has occurred for the purpose of a wider coverage of the privacy principles to accredited entities (as provided at s 33 of the ID Accreditation Bill), we question why this has been expanded and seek that the Government provides more clear information regarding this definition in the context of our primary submission recited at paragraph six (6) herein.
13. Further in the context of the immediately preceding paragraph, we note that the Government has recently released its response to the Privacy Act Review Report wherein the Government has responded that it will immediately implement many of the recommendations contained in that report and committed, in principle, to the vast majority of the recommendations.
14. Given that the implementation of the Privacy Act Review Report recommendations has a fundamental bearing on the ID Accreditation Bill and further noting the current review of Australia’s Human Rights Framework[1], we consider that it would be most appropriate to delay the introduction of the ID Accreditation Bill.
15. We trust that these submissions assist the consultation and the ID Accreditation Bill generally and we confirm that we are willing to assist further with any public hearing(s) associated with this process.
Please do not hesitate to contact us should you require any further information
[1] Australian Government, ‘Australia’s Human Rights Framework’, https://www.aph.gov.au/-/media/Committees/Senate/committee/humanrights_ctte/Aus_Human_Rights_Framework/Aust_HR_Framework_2010.pdf?la=en&hash=E28A006D823EE0BCDDCED2C0B851C4E56B4EEE04, accessed 2 June 2023.