29 September 2016

Chewing gum and string fixes for Privacy

In another instance of reactively fixing Australia's privacy regime with chewing gum and string (and offsetting news of another health data breach) the national Attorney-General has announced that the Privacy Act 1988 (Cth)
will be amended to improve protections of anonymised datasets that are published by the Commonwealth government". 
No news, alas, about improved protection for non-government data.

The media release states
The publication of major datasets is an important part of 21st century government providing a great benefit to the community. It enables the government, policymakers, researchers, and other interested persons to take full advantage of the opportunities that new technology creates to improve research and policy outcomes.
Our ability to deliver better policies and to solve many of the great challenges of our time rests on the effective sharing and analysis of data. For this reason, the Coalition Government has promoted the benefits of open government data, in accordance with the Australian Government Public Data Policy Statement, and published anonymised data on data.gov.au.
Minister Porter recently drew attention to the benefits of research with anonymised data for identifying risks of long-term welfare dependency and to help break the cycle of dependency.
In a unanimous report, the Senate Select Committee on Health drew attention to the opportunities for research and policy design from the government's data holdings, and recommended that open access to de-identified datasets should be the default position.
In accepting the benefits of the release of anonymised datasets, the Government also recognises that the privacy of citizens is of paramount importance.
It is for that reason that there is a strict and standard government procedure to de-identify all government data that is published. Data that is released is anonymised so that the individuals who are the subject of that data cannot be identified.
However, with advances of technology, methods that were sufficient to de-identify data in the past may become susceptible to re-identification in the future.
The amendment to the Privacy Act will create a new criminal offence of re-identifying de-identified government data. It will also be an offence to counsel, procure, facilitate, or encourage anyone to do this, and to publish or communicate any re-identified dataset.
The legislative change, which will be introduced in the Spring sittings of Parliament, will provide that these offences will take effect from today's announcement.