Newsletter of 4 May 2024

APF Board members continue their efforts to influence policy in privacy-sensitive ways.

The load continues to be high, and we need more contributors. That way we can deepen, but also to diversify, the insights that we bring to environmental scanning, evidence-gathering, analysis and the presentation of arguments.

This Newsletter features an invitation to participate in a privacy-relevant focus group, and APF media media activity in the health area and in relation to cars and privacy.

The Board is currently considering a draft Policy Statement by a contributor on 'Privacy and Promiscuous Motor Vehicles'.

Two recent articles quote APF Board Chair David and another active member, Katharine:

• Toyota and Driver Data Privacy Concerns
• Cars Are A Privacy Nightmare on Wheels

Another Board member and past Chair of APF's Health Committee, Bernard, was quoted at length on "The AI Healthcare Boom".

And the current Chair, Juanita, has very recently finalised a Submission on the National Health (Privacy) Rules to the (still anti-privacy) OAIC.

APF has been approached by researchers well-known to APF Board-members, requesting that we draw to APF members' attention a project that the researchers are conducting.

The project aims to understand how 'communication' is understood by diverse consumers, with the view to better inform the regulation of digital communications technologies.

The project is funded by ACCAN and conducted by researchers from Deakin University and the Victorian University of Wellington.

Participation will involve an approximately 90-minute focus group and seeks a wide range of consumer perspectives to discuss the concept of communication. Auslan interpreters are available for the focus groups where needed.

Please note participation is voluntary and there is no obligation to participate.

If you decide not to participate there will be no impact on you or your relationship with the researchers or Deakin University, Victorian University of Wellington or ACCAN. Participants will receive a $50 gift card to compensate their time and must be Australian, 18 years or older and speak English.

Details are available as follows:

• A4 recruitment flyer
• A6 recruitment flyer
• Focus Group Plain Language Statement and Consent Form

If you are interested, please scan the QR code on one of the flyers to fill out a Qualtrics survey to participate, or return the signed consent form via email to: definingcomm@deakin.edu.au

[This study has received Deakin university ethics approval (2023-293)]

Roger Clarke, as APF Secretary

However, APF needs your assistance to maintain its momentum.

Renewing your membership is helpful.
To renew, direct deposit to the APF bank account at Bendigo Bank, BSB 633000 A/c No. 126 879 162.
Please include your name, to ensure we credit it to the right person.
It helps to email us at treasurer@privacy.org.au, saying you’ve paid. The rates remain $275 for Life, $40 regular, and $10 concession.
Further info at https://privacy.org.au/about/members/contributing/.

Even more helpful are direct contributions to APF’s policy work, at https://privacy.org.au/policies/ and https://privacy.org.au/publications/by-policy-area/.

We need more input from more people who have an interest in the area, and who have some ability in research, analysis and drafting of policy positions on privacy issues, or are prepared to develop those skills.

APF has multiple experienced people on the Board and Committees. They can provide support for new contributors to have impacts on policy and practice in the public and private sectors.

No-one can cover the whole, broad field, so you probably prefer to contribute in a particular area. We have Committees that focus on:

• Telecommunications and the Internet, including eBusiness and eGovernment, websites, apps, and security for handhelds and desktops
• Surveillance, including through the use of cameras and microphones, and the automated capture of data
• Health, including medical records and their use and abuse

You may have an area of interest that isn’t covered by an existing Committee. Let us know what your focus is, and we’ll look for colleagues for you among Board, Committee and members generally.

The APF Board, and Australian society, thank you for your contributions.

AN EVENT: Queensland Council for Civil Liberties (QCCL) is running the Derek Fielding Memorial Lecture, in Brisbane, on Thursday, 7 September 2023, 6:30-9:00 pm. The presenter is sometime APF Board-member Samantha Floreani, on ‘Human rights for a collective liberatory digital future’. Register here

Roger Clarke
As Secretary, Australian Privacy Foundation, on behalf of the Board:
https://privacy.org.au/about/contacts/

Advisory Panel

But not all of the thinking is clear enough.

It’s being touted that there’s a simple solution to driver licence data being compromised.

That solution is said to be the addition of a card-number.

So, instead of just the licence-number and expiry-date being used to authenticate a claim that a person is entitled to use that identity document, the card-number would also be required.

This was implemented recently in NSW, and it has now been announced for immediate implementation in Victoria, with about 1m of that State’s 5m licences to be urgently re-issued.

But will that achieve the aim?

Credit-cards have had a 3- or 4-digit ‘card verification code’ or ‘card security code’ on the back (variously called a CVV, CVC or CSC) since about 2000. Its function is identical to that of a card-number on a driver’s licence (on the front of the card in NSW and on the back in Victoria).

The MedLab attack gained access to credit-card details – including in some cases the CVV.

So the CVV was no protection against fraud, because it was accessed as part of the same attack.

If the next hacker gets the driver’s licence card-number, along with licence-number and expiry-date, the card-number provides no protection at all.

Organisations have to understand that the critical issue is:

The retention of authentication-data in databases creates an unmanageable vulnerability

For vulnerability to attacks to be reduced, security-sensitive data must either:

• not be stored at all – an application of the vital principle of data minimisation; or
• be retained only for the few seconds to a minute needed for the authentication process to be completed. Then that data must be expunged, to prevent access by future hackers.

Media Contacts for Australian Privacy Foundation board members:

23 August 2022

We’re combining this newsletter with the Annual Renewal Notice

How to renew

1. Check how much to pay ($275 Life, $40, or $10 concession), here
   Note: If you joined within the last 6 months, it won’t be necessary for you to renew until next year’s notice
2. Pay the relevant amount into this account:
   Bendigo Bank, BSB 633000 A/c No. 126879162
   Include your name, so that we can reconcile the account
3. Email to us, saying you’ve paid

Call for Nominations

As you can see from the brief outline of activities below, the APF Board is buried in work to defend privacy interests. With a couple of recent retirements from the fray by major contributors, we’re short-handed.
Please consider assisting the Board, whether casually on a matter of concern to you, via one of the Committees, or on the Board. Details are here.
If you’re aware of talent who we should be approaching, please put us in contact with them, or vice versa!

Key Aspects of APF Activities during 2021-22

1. Continued busyness, fighting against privacy-invasive behaviours, for privacy-sensitive practices, and for privacy protections. See at the bottom for a quick summary of recent major contributions
2. A shortage of volunteer policy analysts and other active support
3. We’re announcing waiver of the annual fee for volunteers who commit to material assistance in relation to any of the following:
   • research into new technologies, business practices and government initiatives that are likely to have privacy implications
   • drafting and review of proactive Policy Positions
   • drafting and review of submissions in response to policy-influencing opportunities in parliaments, governments and industry sectors
   • frequent social media postings on APF’s behalf, in the appropriate communication-style for one or more particular social media channels
   • drafting of old-fashioned, but still-needed, media releases
   • identification of media reports of suitable quality and relevance, and extraction and posting to the privacy policy e-list of the text and the source, with optional commentary on the topic
   • monthly maintenance of the APF publications index-pages (by date, by topic, and by jurisdiction)

Some Major Areas of Recent APF Activities

The Federal Election

• Media Release of 11 April 2022
• The resulting 2022 Federal Election Scorecard, version of 19 May 22
• The election-result was highly privacy-positive. The new AG has previously supported a privacy right of action, and the large cross-bench comprises Greens and Andrew Wilkie, whose platforms are strongly pro-privacy, plus ‘Teal Liberals’ who are moderately so.

Your(?) ABC Joins the Digital Surveillance Economy
Imposition of Mandatory Registration to use ABC iView

• Open Letter – 2 Mar 22
• ABC Chair Ita Buttrose’s reply of 8 Mar 2022
• Letter to the ABC Chair on 11 May 2022
• Media Release on 15 May 2022
• See also this blog-entry by a past chair of APF

Health Privacy

• Health Legislation Amendment (Information Sharing) Bill 2021 (Vic)
• National Disability Insurance Scheme (NDIS) – a serious data breach
• The unjustifiably demanding ACT COVID ‘Case Investigation’ Form
Health Insurance Companies’ Marketing of Wearables to Consumers

Australia’s Electronic Surveillance Framework

• Submission to Dept of Home Affairs, of 8 Feb 2022, in conjunction with QCCL and Liberty Victoria
• Australian Border Force’s Warrant-less Access to Smartphone Comms

Expansion of the APF Advisory Panel

The Australian Privacy Foundation enjoys the support of many leading Australians across many walks of life. We routinely draw attention to the standing of the APF's Patrons and Advisory Panel members when we make submissions.

The APF's policy positions have always been based on research and careful argument, and we believe that the quality of the Panel reinforces that positioning. We're delighted to announce a tranche of new members of that Panel.

Their greatly-abbreviated bios demonstrate great diversity. They include leaders in the protection of human rights in Australia:

• the recently retired Human Rights Commissioner, Edward SANTOW
• the 20-year CEO of Civil Liberties Australia, Bill ROWLINGS
• sometime NSW Privacy Commissioner and consultant to the UN Privacy Rapporteur, now chairing APF's Int'l Ctee, Elizabeth COOMBS

And they're joined by:

• world-leading author on the problems of AI, Kate CRAWFORD
• retired Police Integrity Commissioner and justice advocate, Barbara ETTER
• world-leading researcher in secure and privacy-enabling computing systems, Gernot HEISER
• distinguished public affairs journalist, Kerry O'BRIEN

Their slightly longer Bios can be seen below, and on the Advisory Panel page.

The APF is an important player in countering the alarming shift towards authoritarianism and a technology-enabled surveillance society, which politicians, government agencies and corporations are bullying us into.

The support of such people is a vital contribution, for which we're very thankful. At the level of Boards and Committees as well, we need to continue broadening and deepening the APF's support-base,

Dr Elizabeth Coombs
CEO and senior executive of NSW government agencies until 2008, NSW Privacy Commissioner 2011-17, consultancies for the UN Special Rapporteur on the Right to Privacy 2017-21, Member of the Global Privacy Assembly Advisory Panel

Prof. Kate Crawford
Leading international scholar of technology and society, with professorial roles around the world including USC Annenberg in LA, École Normale Supérieure in Paris, and Microsoft Research in NYC, Author of the award-winning 'Atlas of AI'

Barbara Etter APM
Retired senior police officer and lawyer with a strong interest in forensic science - Research Director, Assistant Commissioner and CEO of an Integrity Commission, strong advocate for integrity and justice

Prof. Gernot Heiser FTSE
World-leading UNSW researcher in trustworthy operating systems and commodity off-the-shelf hardware, delivering the foundations of secure and privacy-enabling computing

Kerry O'Brien
Distinguished public affairs journalist, with six Walkley Awards including for Outstanding Leadership and the Gold Walkley, and a strong commitment to public interest issues

Bill Rowlings OAM
Journalist, editor, editorial director, media adviser, co-author of a PR text-book and a history of civil liberties in Australia, co-founder and CEO of Civil Liberties Australia from 2003, media commentator on people's rights and governments' wrongs

Edward Santow FAAL
Industry Professor - Responsible Technology at UTS, former Human Rights Commissioner, major contributions to the rights of those in detention and the social implications of AI, previously CEO of the Public Interest Advocacy Centre, Senior Lecturer at UNSW Law and Legal Officer at Australian Law Reform Commission.

Remarks by the long-time host of ABC’s 7:30 Report and later Four Corners,
in the Four Corners Anniversary Program of 19 August 2021,
republished in The Sydney Morning Herald on 23 August 2021:

“The lockdowns themselves have been necessary and not a direct threat to robust journalism. But I’m concerned that the imagery of such a substantial and aggressive use of police action coupled with the increasing military presence of uniformed soldiers in the streets of our cities and manning border roadblocks will become more acceptable to the public generally, and set an unfortunate precedent.

“If political leaders take comfort now in sharing platforms with police and military commanders to enhance their own authority, and feel there is some political benefit in doing so, they’ll be tempted to do it again in the future, and it becomes a part of the normal fabric of politics, which it shouldn’t.

“I’d be less concerned if we hadn’t seen a steady erosion of civil liberties over the past 20 years, but we have.

“Every year, there are more changes to national security laws; every year there is much greater access both at a government and commercial private level to our private lives and in the accumulation of data,” he said. “The Freedom of Information laws, which were originally introduced by the Whitlam government to try and create a greater culture of openness within government, are diminishing in front of our eyes.

“There are all these strictures that are creeping into our society, which I think are a serious worry.”

1. Renewals

APF runs on a financial-year cycle, so renewals fall due on 1 July. If you are an annual member rather than life-member, would you please remit your renewal fee, and any donation you may wish to make, to:

Australian Privacy Foundation
Bendigo Bank
BSB 633-000
A/c 126 879 162
Please include the name in which your membership is registered.
Please advise us by email if your preferred email address has changed.

Annual Fee – $40     Concession Fee – $10     Life Membership – $275

Thanks to everyone for your support! We’re gradually moving towards the point at which we can use paid support to monitor opportunities to influence policy, and coordinate drafting of statements and submissions.

A note to recently-joined members: We generally treat those who join after 1 March as being members until the next-but-one 30th of June, i.e. if you joined within the last few months, it won’t be necessary for you to renew until next year’s notice.

If required, here is further information, or email me direct.

2. Current Policy Work

The COVID era has seen no let-up in the privacy issues confronting us. It’s even provided some additional opportunities for social control devotees to seek yet more powers over individuals’ lives.

APF members have been active on COVID-related privacy issues from the outset. A new contributor, Tom Lawrence, has consolidated and summarised the arguments, resulting in the following Policy Statement:

• COVID-19 Surveillance

Here are the APF’s many other Policy Statements.

It’s been a very busy half-year for policy work. This has been particularly the case in the health space, where rejoined Health Committee Chair, (Dr) Juanita Fernando, has followed up the strong work of the Chair for the last 6 years, (Dr) Bernard Robertson-Dunn, with a series of submissions to multiple agencies.

Here is the submissions-index.

The government-driven project to implement a so-called Consumer Data Right (which is actually a Corporate Data Right to Consumers’ Data) started out with promises of strong consumer protections.

With industry, particularly the much-hyped FinTech sector, very lukewarm about it, the hard-right has now grabbed control of the agenda. Treasury is tearing the consumer protections out of the scheme, in the hope that the removal of the key regulatory elements will attract companies into a wild-west, gold-rush frenzy to exploit consumers.

APF initially fought for protections for consumers’ data; but the scheme is now so bad that there’s no option but to outright oppose it.

Roger Clarke
Secretary, for the APF Board
Board Membership and Contact-Points]]> https://privacy.org.au/2021/05/07/4647/ Fri, 07 May 2021 04:59:11 +0000 https://privacy.org.au/?p=4647 Read More]]> We regret the 10-month delay since the most recent Newsletter!

The Board has remained very busy throughout, with about 20 submissions
made during that period.

These included a very substantial response to the Issues Paper published by the Attorney-General’s Department in relation to the (non-independent) review it is conducting of the Privacy Act. The scope was very broad, and it accordingly involved a team of contributors, led by Prof. Graham Greenleaf.

Other papers, lead-authored by a considerable range of members, addressed topics as diverse and important as:

• a number of COVID-19 initiatives that were unjustifiable or
  unjustifiably intrusive into privacy interests (done partly to
  helpensure that the media were tuned into the endeavours of
  Dutton and his friends to normalise population surveillance)
• Google’s takeover of Fitbit
• the ‘Consumer Data Right’, designed to achieve disclosure of
  personal data in the financial services sector, in return for
  little or no benefit to the large majority of consumers
• the valueless but still-not-dead-yet ‘My Health Record’
• drones
• OAIC’s revisions to its ‘Guide to Securing Personal Information’
• enormously invasive, unjustifiably intense background checking
  by employers, and specifically by Australia’s national university

A further succession of latter-day ‘surveillance society’ Bills have been fought. Ever so slowly, politicians are rediscovering their ticker, and questioning the justification for such nominally ‘national security’ measures, and the scope of the powers sought, and the collateral damage arising from them.

Multiple of these submissions have involved interactions with other advocacy organisations, including both traditional ‘civil liberties’ and more recent ‘digital freedoms’ associations.

A further initiative has been the establishment of a Policy Drafting Forum. This enables members to contribute to research and drafting on a variety of topics, without needing to commit to the responsibilities of being on the Board itself.

A first output from this group is approaching completion, in the form of a Policy Statement on COVID-19 Surveillance.

As always, the APF’s activities can be watched here:

• https://privacy.org.au/publications/by-date/
• https://privacy.org.au/media-release-archive/
• https://privacy.org.au/policies/

Roger Clarke
Secretary, for the APF Board
https://privacy.org.au/about/contacts/

The primary reason has again been busyness on policy issues, but to some extent the COVID-19 epidemic has also played a role.
The lockdown hasn’t greatly affected the workings of an organisation that has operated mostly virtually for decades already. However, it’s had a substantial impact on many of our most active volunteers.
The drastic economic slowdown is disproportionately affecting the self-employed. Meanwhile, the government’s structuring of its support programs to actively exclude the tertiary education sector has harmed the interests even of employed academics. And it’s doing far more damage to the large proportion of university teaching staff who have been ‘casualised’ as a result of the invasion of chancelries by profit-oriented CEOs and their inevitable focus on large marketing overheads.

The COVID-19 epidemic has been used as an excuse by elements within the public service to further their desires for social control. Rather than being abashed by the court’s demolition of the Robo-Debt program, they have turned their attention to establishing the misleadingly-named ‘COVIDsafe’ contact ‘tracing’ tool that was quite evidently designed to fail, both technically and operationally, opening up the possibility of mass ‘tracking’ surveillance.

Considerable efforts continue to be invested in a wide range of other privacy matters.

The desire among economists to impose a right for corporations to access consumers’ data, dressed up as a ‘Consumer Data Right’ (CDR), is coming to fruition, with the privacy needs largely ignored.

The ABS held a nominal consultation process in relation to Census 2021, and then ignored the submissions made to it. It may be necessary for the APF to be more forthright than it has been in the past, and declare the ABS to have not just breached public trust, but to have destroyed it, such that the public can be expected to increasingly treat the agency and the survey with disdain.

Applications of biometrics continue to be wildly inappropriate and largely uncontrolled.

The OAIC continues to protect government agencies and business, not privacy.

Among the issues where we’re still in the ring, influencing policy decisions, are:

• Google’s proposed acquisition of Fitbit – a global collection of health, location and other data
• TOLA (the Telecommunications Legislation Amendment (International Production Orders) Bill) – weakly-accountable overseas access to a wide range of Australian data in the cloud
• extensions of the CDR into such areas as electricity and gas

On the positive side:

• re RoboDebt, the submissions of APF and so many other advocacy organisations about the iniquitous behaviour of (Achtung: newspeak:) ‘Services Australia’ have been vindicated, but far too late to prevent a vast amount of harm among the least well-off. But the harm, and the waste of over a billion dollars, have given rise not to sackings, demotions and prosecutions, but rather to promotions
• aspects of the ACCC’s Report on Digital Platforms have been highly privacy-positive, and may lead to some actual benefits for privacy
• even technology suppliers are realising that the potential of facial recognition has been massively over-sold, and governments need to pull back on their schemes until and unless they are subjected to effective regulation

Here is the index of policy papers.

They are also accessible by topic-area.

We’re working on a wiki page to carry details of all current opportunities to influence policy relevant to privacy. It’s intended to be maintainable by any contributor. Here’s a pilot implementation.

The APF continues to value your support for its work for privacy, and against privacy-abusive initiatives in business and government.

Membership Renewals: With the turnover of the new financial year, Renewal Notices are due to go out shortly, except of course to Life Members and recent new Members. Here is Membership-related information