Clouds

The new Commonwealth Secure Cloud Strategy from the Digital Transformation Agency (DTA) states

The case for cloud is no secret to industry or government. A move to cloud computing - away from on premise owned and operated infrastructure - can generate a faster pace of delivery, continuous improvement cycles and broad access to services. It can reduce the amount of maintenance effort required to ‘keep the lights on’ and refocus that effort into improving service delivery.

Cloud, however, is a new way of sourcing Information Communication and Technology (ICT) services and many agencies will have to change the way they operate to make the most of this new model. In the Australian Government, a number of factors can get in the way of agencies realising their cloud aspirations, from a shortage of knowledge and experience, decades old, stubborn operating models and a struggle to sell the case for cloud across the business.

The Secure Cloud Strategy has been developed to guide agencies past these obstacles and make sure everyone has the opportunity to make the most of what cloud has to offer. This is not a simplistic ‘lift and shift’ view of the transition. Instead, the strategy aims to lay the foundations for sustainable change, seizing opportunities to reduce duplication, enhance collaboration, improve responsiveness and increase innovation across the Australian Public Service.

Some agencies have already embraced the cloud model. A coordinated approach for further adoption will make sure government derives the maximum value from this shift. The strategy will ensure experience and expertise is not locked-up and create opportunities to reuse and share capabilities through increased collaboration.

The strategy is based around a number of key initiatives designed to prepare agencies for the shift to cloud and support them through the transition:

• Agencies will develop their own cloud strategies. There is no one-size-fits-all approach to implementing cloud. Agencies will use the Secure Cloud Strategy as a starting point to produce their own value case, workforce plan, best-fit cloud model and service readiness assessment.

• Cloud implementation will be guided by seven Cloud Principles: − make risk-based decisions when applying cloud security − design services for the cloud − use public cloud services as the default − use as much of the cloud as possible − avoid customisation and use cloud services as they come − take full advantage of cloud automation practices, − monitor the health and usage of cloud services in real time.  

• A layered Cloud Certification Model will be created. The certification model creates greater opportunity for agency-led certifications, rather than just ASD certifications. It creates a layered certification approach where agencies can certify using the practices already in place for certification of ICT systems. 

• Service procurement will be aligned with the ICT Procurement Review Recommendations. As cloud services move more rapidly than services available through panels traditionally do, the recommendations in the ICT Procurement Review align well with creating a better pathway for cloud procurement. 

• cloud qualities baseline and assessment framework will be introduced to clarify cloud requirements. The cloud qualities baseline capability and assessment framework will enable reuse of assessments. 

• A Cloud Responsibility Model will be developed to clarify responsibilities and accountabilities. Traditional head agreements cannot cover all cloud services and their frequent variations. A shared capability for understanding responsibilities, supported by contracts, will address unique cloud risks, follow best practice and maintain provider accountability. 

• A cloud knowledge collaboration platform will be built. The platform will enable secure sharing of cloud service assessments, technical blueprints and other agency cloud expertise, to iterate on work already done rather than duplicating it. 

• Cloud skills uplift programs will be designed. Increase government skills and competencies for cloud aligned with the Australian Public Service Commission Digital Skills Capability Program and create the pathways to leverage industry programs to enhance cloud-specific skills in the Australian Public Service. 

• Common shared platforms and capabilities will be explored including: − Federated identity for government to enable better collaboration in the cloud. − A platform for PROTECTED information management to reduce enclaves in agencies, and continue to iterate cloud.gov.au as an exemplar platform. − Service Management Integrations services to enable agencies to manage multi provider services.

These platforms will include the integration toolkits that enable agencies to seamlessly transition between the cloud services. 

These initiatives will be supported through a Digital Transformation Agency-led community of practice that will support agencies to plan and transition their environments for cloud. It will include delivering training and advice to agencies to build confidence in their ability to manage cloud services. 

The Australian Government has an ambitious agenda to transform its digital service delivery. Cloud offers reusable digital platforms at a lower cost, and shifts service delivery to a faster, more reliable digital channel. Cloud services have the opportunity to make government more responsive, convenient, available and user-focused.

The Strategy comments -

Myth: Privacy reasons mean government data cannot reside offshore. 

“Generally, no. The Privacy Act does not prevent an Australian Privacy Principle (APP) entity from engaging a cloud service provider to store or process personal information overseas. The APP entity must comply with the APPs in sending personal information to the overseas cloud service provider, just as they need to for any other overseas outsourcing arrangement. In addition, the Office of the Australian Information Commissioner’s Guide to securing personal information: ‘Reasonable steps’ to protect personal information discusses security considerations that may be relevant under APP 11 when using cloud computing.” https://www.oaic.gov.au/agencies-and-organisations/agency-resources/privacy-agency-resource-4-sending-personalinformation-overseas 

Additionally, APP 8 provides the criteria for cross-border disclosure of personal information, which ensures the right practices for data residing off-shore are in place. Our Australian privacy frameworks establish the accountabilities to ensure the appropriate privacy and security controls are in place to maintain confidence in our personal information in the cloud.

'The Ethics of Cloud Computing' by Boudewijn de Bruin and Luciano Floridi in (2017) 23(1) Science and Engineering Ethics 21-39 comments

Cloud computing is rapidly gaining traction in business. It offers businesses online services on demand (such as Gmail, iCloud and Salesforce) and allows them to cut costs on hardware and IT support. This is the first paper in business ethics dealing with this new technology. It analyzes the informational duties of hosting companies that own and operate cloud computing datacenters (e.g., Amazon). It considers the cloud services providers leasing ‘space in the cloud’ from hosting companies (e.g, Dropbox, Salesforce). And it examines the business and private ‘clouders’ using these services. The first part of the paper argues that hosting companies, services providers and clouders have mutual informational (epistemic) obligations to provide and seek information about relevant issues such as consumer privacy, reliability of services, data mining and data ownership. The concept of interlucency is developed as an epistemic virtue governing ethically effective communication. The second part considers potential forms of government restrictions on or proscriptions against the development and use of cloud computing technology. Referring to the concept of technology neutrality, it argues that interference with hosting companies and cloud services providers is hardly ever necessary or justified. It is argued, too, however, that businesses using cloud services (banks, law firms, hospitals etc. storing client data in the cloud, e.g.) will have to follow rather more stringent regulations.

Interning

"The Program Risks of Work-Integrated Learning: A Study of Australian University Lawyers' by Craig Cameron, Brett Freudenberg, Jeff Giddings and Christopher Klopper in (2017) 40(1) Journal of Higher Education Policy and Management 67-80 comments 

Work-integrated learning (WIL) is a risky business in higher education. The strategic opportunities that WIL presents for universities cannot be achieved without taking on unavoidable legal risks. University lawyers are involved with managing the legal risks as part of their internal delivery of legal services to universities. It is important to identify the risks that potentially arise, so these can then be managed. A case study involving Australian university lawyers reveals the ‘program risks’ of WIL. Program risk is a type of legal risk that relates to the conduct of universities, host organisations and students before, during and after a WIL placement, as well as the personal characteristics of students that can expose the university to legal risk. The research findings may be applied by university lawyers, academic disciplines and university management to evaluate and improve risk management in WIL programs

'Risks and Rewards of Externships: Exploring Goals and Methods' (Monash University Faculty of Law Legal Studies Research Paper No. 3071105) by Linda Smith, Jeff Giddings and Leah Wortham explores

 the full range of goals one might have for an extern program and the methods one should use to achieve those goals. Despite regulatory focus on practice readiness and “skills” development, externships need not and sometimes should not have “skills” as the primary goal. If skills are to be a focus, then students must learn the theory and methods behind the skills to be used in the placement either through targeted pre-requisites, a skills-focused classroom component, or selection of placement supervisors with the ability to impart both the relevant theory and methods. Commentators have identified both skills and professionalism as lacking in legal education, and externships have special advantages for development of professional identity and for institutional critique--the micro and the macro aspects of professionalism. Students are in the “real world,” able to try out a professional identity and to study the ways in which their supervisors enact the lawyering role. They are encountering actual legal institutions that function well or not-so-well, which should lead to critical inquiry into these institutions. The emotional and analytical distance between the teacher at the law school and the day-to-day supervisor should facilitate the exploration of both professional identity and institutional critique. Exploring these aspects of professionalism are rich and important goals, we argue, that extern programs ought to seek.

Privacy Paradox

'Is the Privacy Paradox in Fact Rational? by Benjamin Agi and Nicolas Jullien comments 

Research on the privacy paradox – the dichotomy between individuals’ intentions to disclose personal information and their actual disclosure behavior – has become popular as policy makers have been working on privacy laws. This article provides a literature review of the privacy paradox across fields of study. Many researchers have explored the privacy paradox and come up with the conclusion that decisions taken by individuals regarding the transmission of private data were irrational. This article first provides a systematized review of the extensive literature in psychology, sociology, management, economics and biology that explores the decision-making process related to online transfer of private data. Then, we show that the literature seems to agree on the fact that people act either rationally or with limited rationality. To conclude, we focus on the potential importance of awareness campaigns or key historical moments to explain the different sensitivities people have regarding privacy issues.

Robots and Estates

The Rise of Robots and the Law of Humans (Oxford Legal Studies Research Paper No. 27/2017) by Horst Eidenmueller comments

In this article, I attempt to answer fundamental questions raised by the rise of robots and the emergence of ‘robot law’. The main theses developed in this article are the following: (i) robot regulation must be robot- and context-specific. This requires a profound understanding of the micro- and macro-effects of ‘robot behaviour’ in specific areas. (ii) (Refined) existing legal categories are capable of being sensibly applied to and regulating robots. (iii) Robot law is shaped by the ‘deep normative structure’ of a society. (iv) If that structure is utilitarian, smart robots should, in the not too distant future, be treated like humans. That means that they should be accorded legal personality, have the power to acquire and hold property and to conclude contracts. (v) The case against treating robots like humans rests on epistemological and ontological arguments. These relate to whether machines can think (they cannot) and what it means to be human. I develop these theses primarily in the context of self-driving cars – robots on the road with a huge potential to revolutionize our daily lives and commerce.

The South Australian Law Reform Institute report Who may inspect a will released late last year responds to the Institute's exploration of 'the areas of succession law that were most in need of review in South Australia'.

The Institute's recommendations are -

R 1 SALRI recommends that no change to the present law is necessary to allow inspection of a will prior to a testator’s death as SALRI does not support a legislative provision to allow inspection of a will prior to a testator’s death beyond any limited situations contemplated under current law and practice  

R 2 SALRI recommends that legislative provision be made in South Australia for an entitlement to inspect a will after a testator’s death based on the draft Wills Bill 1997 and s 54 of the Succession Act 2006 (NSW) and such a provision should extend to the following categories:

1. Any person named or referred to in the will, whether as a beneficiary or not; any person named or referred to in an earlier will as a beneficiary of the deceased person. 

2. The surviving spouse, domestic partner (whether of the same sex or not) or child or stepchild of the deceased person.  

3. A parent or guardian of the deceased person. 

4. Any person who would be entitled to a share of the estate of the deceased person if the deceased person had died intestate. 

5. Any parent or guardian of a minor referred to in a will or who would be entitled to a share of the estate of the deceased person if the deceased person had died intestate. 

6. Any person committed with the management of the deceased person’s estate under the Guardian and Administration Act 1993 (SA), immediately before the death of the deceased person. 

R 3 SALRI recommends that legislative provision should be made for a party (including a creditor) who has or may have a claim at law or in equity against the estate of a deceased person to be able to inspect a will but only by order of a court and such an order should only be granted where the applicant has some proper interest and can establish why inspection of the will is appropriate. 

R 4 SALRI recommends that consolidation of South Australian succession law legislation into one new Succession Act for ease of reference be progressed, either after, or at the same time as, any amendments to the Inheritance (Family Provision) Act 1972 (noting SALRI’s previous Report into Intestacy).

The Institute states

There is no entitlement to inspect a will before the testator’s death. The will of a living person is considered a private document (and SALRI sees no reason to change this position). There is also no entitlement in South Australia under either statue or the common law to inspect a will after the testators’ death (or at least until a will is admitted to probate when it becomes a public document). There is no apparent statutory or inherent power for a court to order inspection of a will before a grant of probate as Master Sanderson explained in the recent West Australian case of Chapman v Garrigan (which is equally applicable in a South Australian context). The Master commented: ‘There appears to be no reported case in which a party has sought, let alone obtained, a copy of a will not yet admitted to probate.’ 

The National Committee supported a legislative provision to allow inspection of a will after a testator’s death. It noted that a person who has the control of a will after the testator’s death may be reluctant to show it to anyone owing to a misconceived view that a will is a private document or a desire to keep the person who is seeking to see the will in ignorance of its contents. The National Committee also noted that not all wills are brought to court for probate, particularly where an estate is small and not worth the expense involved. In such a situation, possible beneficiaries and other claimants may be placed in ‘an invidious position if they do not know anything about the contents of the will’.30 A person who is eligible to apply for family provision may not be able to discover whether the testator has made provision for him or her by a will, and is unable to begin to consider whether to make a claim. 

The National Committee accepted that only a person with a ‘proper interest’ (not say a journalist) should be able to see the will and that the persons entitled to share in the estate should be able to see the contents of a will. The Committee noted such information is always publicly available once a will has been admitted to probate. 

The National Committee drew on the proposed s 66A of the Administration and Probate Act 1958 (Vic), but stated that, in addition to the four categories of eligible parties listed in s 66A,  the following people should also be entitled to see a will: beneficiaries of prior wills or a parent or guardian of a minor referred to in the will or who would be entitled to a share of the estate of the testator if the testator had died intestate. The National Committee considered that any new provision should include either testamentary documents that have been revoked, or documents the testamentary nature of which may be disputable. It noted an executor is not permitted by a probate court to pick and choose which testamentary instruments he or she should bring to court for probate purposes. The National Committee recommended that the term ‘will’ in any provision should include ‘a revoked will, or a copy of any such will and any part of such a will’. The National Committee prepared a draft Wills Bill 1997 which was intended to be adopted across Australia. Clause 52 of this Bill dealt with the inspection of a will.  

The National Committee in 2005 reiterated its support for such a provision to allow inspection of wills. 

Similar laws to that suggested by the National Committee now exist in New South Wales, the ACT, Northern Territory, Queensland, Tasmania and Victoria. No such law exists in South Australia or Western Australia. No such law, despite the support of the New Zealand Law Reform Commission, exist in New Zealand. The will of a living person is considered private in England. Upon a testator’s death, but before a grant of probate, only the executor has the strict authority to access the will. A will becomes public after probate and any person may search the probate records and receive a copy of the will. 

The Tasmanian section allowing access to a will provides that it does not operate while a testator is alive. The Victorian provision extends to de facto spouses (or ‘domestic partners’ to use the South Australian expression). The Queensland provision extends to an ‘entitled person’. This means a person considered to have a proper interest in the will such as a person who may apply for a family provision order. The ACT section extends to ‘an interested party’ which includes a child or domestic partner of the deceased. 

The NSW model is most recent and most detailed and the one that SALRI has examined.    

The Succession Act 2006 (NSW) (the NSW Act) commenced on 1 March 2008. The object of the Act is to restate with amendments the law relating to wills in New South Wales to implement, with modifications, the relevant recommendations of the National Committee. One of several changes introduced was a change in the persons entitled to inspect the will of a deceased person. 

Section 54(2) of the NSW Act gives specified persons a right of inspection or to receive copies of the will of a deceased. This right was not previously available. Section 54 applies to wills whenever made if the testator dies on or after 1 March 2008 being the commencement date of the Act (reproduced at Appendix B). For the purposes of s 54, a will includes (reflecting the view of the National Committee) a revoked will, a document purporting to be a will, a part of a will and a copy of a will. 

Section 54(2) provides that a person who has possession or control of a will of a deceased person must allow any one or more of the following persons to inspect or be given copies of the will (at their own expense): (a) Any person named or referred to in the will, whether as a beneficiary or not; (b) Any person named or referred to in an earlier will as a beneficiary of the deceased person; (c) The surviving spouse, de facto partner (whether of the same or opposite sex) or issue of the deceased person; (d) A parent or guardian of the deceased person; (e) Any person who would be entitled to a share of the estate of the deceased person if the deceased person had died intestate; (f) Any parent or guardian of a minor referred to in a will or who would be entitled to a share of the estate of the deceased person if the deceased person had died intestate; (g) Any person (including a creditor) who has or may have a claim at law or in equity against the estate of the deceased person; (h) Any person committed with the management of the deceased person’s estate under the Protected Estates Act 1983, immediately before the death of the deceased person, (i) Any attorney under an enduring power of attorney made by the deceased person; (j) Any person belonging to a class of persons prescribed by the regulations. 

Master Sanderson in Chapman v Garrigan noted the reluctance on the part of executors named in a will to provide an interested party with a copy of the will ‘is an issue which not infrequently causes problems both in relation to probate matters and particularly in relation to [family provision] matters’. The Master encouraged practitioners to exercise common sense in this area and remarked that it is difficult to envisage any circumstance where it would be appropriate for a party who has or may have an interest in an estate to be denied a copy of the will. The Master commented that, even if a potential beneficiary were to object to that course of action, the named executor would still be justified in providing a copy of the will upon request. The Master noted the benefit of a legislative provision to allow inspection before probate. 

The Institute goes on to comment

SALRI accepts that there are situations where it would be helpful to allow inspection of a will before a testator’s death56 but this undermines legitimate consideration of privacy and confidentiality (a view also emphasised by the Hon Tom Gray QC). SALRI does not support a legislative provision to allow inspection of a will prior to death beyond any limited situations contemplated under current law and practice. In contrast, SALRI supports allowing inspection of a will after a testator’s death to parties with a proper interest or potential interest in the estate. 

SALRI considers that there are four benefits to a legislative provision for the inspection of wills after a testator has died. 

First, it would encourage openness and transparency in the administration of estates. In the absence of a clear obligation to provide access to a will, those in control of the will may be reluctant to show it to anyone or allow inspection. This may be because they view a will as a private item or desire to keep it secret. Refusing to allow access may lead to suspicion and mistrust. In contrast, allowing those with a proper and legitimate interest (not a mere ‘busy body’ as Mr Rymill notes) in the estate to see a will may help defuse distrust and prevent unnecessary litigation. Given the tensions and stresses all too often evident in the aftermath of a testator’s death, anything which serves to alleviate tension and distrust is welcome. 

Secondly, it would assist in the orderly administration of estates. As Master Sanderson observed, the administration of estates would run more smoothly if access to a will was provided as a rule rather than as an exception to some assumed rule. 

Thirdly, to allow access to a will promotes fairness. It enables creditors to find out about the assets of the deceased. Those eligible to make a claim under the IFPA will have more time to consider whether to make a claim because they can determine earlier if any claim under the IFPA is likely to be successful. A person only has six months in South Australia to make a claim under the IFPA after probate is granted. Access to the will may address the unfairness experienced by possible beneficiaries and other claimants (including under the IFPA) where an estate is informally administered without a grant of probate60 (this is a regular event, notably in smaller estates). 

Finally, to allow access promotes clarity and certainty. SALRI has been told by succession lawyers that they often hold wills on behalf of their clients and may have no instructions from the testator but they often receive requests after the testator’s death for access to the will. The firm may be placed in a difficult position in deciding who should or should not have access. Tasmanian practitioners welcomed the Tasmanian section based on the draft Wills Bill 1997 setting out access to a will and remarked that the provision simply gave effect to what already happened in practice. 

SALRI considers that its proposal does not undermine considerations of privacy or confidentiality. A will is always publicly available once it has been admitted to probate. The proposed provision is simply designed to ensure the same result prior to a will’s admission to probate, or in the event that no application is made for probate. 

SALRI considers that there is benefit in a legislative provision to provide for access to wills prior to probate. It draws on what was identified by Master Sanderson as sound practice and common sense.

Product Lifetimes

What is a lifetime in relation to a product warranty under the Competition and Consumer Act 2010 (Cth)? The Australian Competition and Consumer Commission (ACCC) has reminded people that 'lifetime' refers to the consumer - put simply, the human animal - rather than to the shorter period of flourishing of a snail, gnat or other non-human animal or to the lifetime of electronic kit.

The ACCC reports that it has accepted a court-enforceable undertaking from consumer electronics manufacturer Belkin to honour claims under its lifetime warranty policies for the lifetime of the original purchaser.

It comments

 During 2016 and 2017, Belkin supplied certain products with a “lifetime warranty” or “limited lifetime warranty”. However, Belkin applied a policy of only repairing or replacing products under these warranties within the five years from the date of purchase.  

A disclaimer was not printed on product packaging but was referred to on Belkin’s website. Products affected by these “lifetime warranty” claims included wireless routers, switches and cables.

“Belkin has acknowledged that its lifetime warranty representations may have breached the Australian Consumer Law, which prohibits misleading or deceptive conduct and false or misleading representations about the effect of a warranty or guarantee,” ACCC Commissioner Sarah Court said. “Manufacturers must ensure consumers are not misled by warranty representations. If a business makes a lifetime warranty claim, they must be very clear about what this means with their customers.” 

In addition, Belkin has admitted that some products with lifetime warranties were likely to be non-compliant with the Australian Consumer Law because they did not include the wording required for use in any warranty against defects. 

Belkin has undertaken to correct its website and packaging to comply with this requirement.

Belkin cooperated with the ACCC’s investigation and has taken steps to resolve the ACCC’s concerns.

The specific Undertaking notes

Between about July 2016 and July 2017, Belkin made representations on the packaging of more than 130 types of its products that those products were sold with a “lifetime warranty” or “limited lifetime warranty”.

In fact, Belkin had a policy on repairing or replacing those products pursuant to the warranty only within five years of the date of purchase.

On its website, Belkin stated that these warranties applied for the lifetime of the product, which Belkin had determined to be five years, not the lifetime of the consumer. However, there was no material on or in the packaging of Belkin’s products informing consumers of this.

The ACCC considers that some consumers may have understood that a “lifetime warranty” or “limited lifetime warranty” applied for the lifetime of the purchaser, or a period longer than five years.

SnailSpace

Presumably in response to yesterday's report on the reidentification of health data noted here, the Office of the Australian Information Commissioner (OAIC) has released a statement that it is still investigating the 2016 health data breaches but is - of course - mindful of the importance of trust.

The delay is symptomatic of the OAIC's bureaucratic incapacity (regulatory capture exacerbated by under-resourcing after the year when Attorney-General George Brandis recurrently announced that the OAIC would be abolished but failed to get his legislation through the national legislature).

It adds weight to the UNSWLJ article by Burdon and Siganto on OAIC Own Motion Investigations.

That article - 'The Privacy Commissioner and Own-Motion Investigations into Serious Data Breaches: A Case of Going through the Motions?' in (2015) 38(3) University of New South Wales Law Journal 1145 - commented

If the OAIC does not have the technical knowledge or skills to analyse the causes or methods for prevention of security breaches, or to assess technical details about how security breaches occurred, then it is not clear how the OAIC is able to conduct these investigations or assure itself that third-party expert reports are accurate, complete and based on the use of an appropriate standard of care. It is therefore difficult to determine how the OAIC can adequately say whether there has been any failure to properly protect personal information. 

Further

Our investigation of the six OMIs suggests that the OAIC’s decisions to commence the investigations were in response to media and were perhaps motivated by an interest in raising the profile of data breaches in Australia to support the introduction of a mandatory notification scheme. Whether this is in fact correct or not, there are clearly issues with the process followed in each investigation. In all of the OMIs, an ‘on the papers’ approach was used, based on written responses to largely generic requests for information. There was virtually no second-round questioning, independent evidence gathering or confirmation of the facts as asserted by the respondents, whether directly or via third-party investigation reports commissioned by the respondents. The decision-making process used is also not clear. The change in the outcome of the Medvet investigation, after the initial outcome was communicated to the respondent, in particular raises issues as to the basis for the OAIC’s decision-making in these cases. 

We assert that these issues arise, in part, as a consequence of the limited powers, skills and resources available to the OAIC at the time. Given the OAIC’s new powers and increased accountability, these issues may be addressed in future Commissioner-initiated investigations. However, without the allocation of significant additional resources, it seems unlikely that there would be any significant change in process. Reliance on third-party investigation reports commissioned by the respondent in a future investigation may not be an appropriate resolution. 

The OAIC is right to emphasise that the problem of data breaches is likely to remain. However, the examination of the six OMIs reveals that the investigatory approach adopted can lead to the situation where the OAIC investigators are simply going through the motions. On that note, given the issues we highlight in this article, the OAIC’s data breach investigations as a body of work are unlikely to be of assistance in regulatory efforts to prevent data breaches, unless significant changes are undertaken. Such changes would herald a major policy shift regarding the role of the OAIC, characterised by the need for a supported, adequately resourced and thus proactive Australian privacy regulator. In that regard, our examination of six relatively recent OMIs sounds a warning not just as to what has happened, but also for the future.

Alas, what was past is present. The OAIC's statement yesterday reads

The Australian Information and Privacy Commissioner is currently investigating the publication of the Medicare Benefits Schedule (MBS) and Pharmaceutical Benefits Scheme (PBS) datasets on data.gov.au. The investigation was opened under section 40(2) of the Australian Privacy Act 1988 (Privacy Act) in late September 2016 when the Department of Health notified the OAIC that the datasets were potentially vulnerable to re-identification. 

Given the investigation into the MBS and PBS datasets is ongoing, we are unable to comment on it further at this time. However, the Commissioner will make a public statement at the conclusion of the investigation. 

Realising the value of public data to innovations that benefit the community at large is dependent on the public’s confidence that privacy is protected. The OAIC continues to work with Australian Government agencies to enhance privacy protection in published datasets.

A different perspective is provided in the US World Privacy Forum report by Pam Dixon and John Emerson on The Geography of Medical Identity Theft, presented at the Federal Trade Commission Workshop on Informational Injury

The report comments

Medical identity theft has existed in various forms for decades, but it was in 2006 that World Privacy Forum published the first major report about the crime. The report called for medical data breach notification laws and more research about medical identity theft and its impacts. Since that time, medical data breach notification laws have been enacted, and other progress has been made, particularly in the quality of consumer complaint datasets gathered around identity theft, including medical forms of the crime. This report uses new data arising from consumer medical identity theft complaint reporting and medical data breach reporting to analyze and document the geography of medical identity theft and its growth patterns. The report also discusses new aspects of consumer harm resulting from the crime that the data has brought to light.

The authors ague

medical identity theft is growing overall in the United States, however, there’s a catch. The consumer complaint data suggests that the crime is growing at different rates in different states and regions of the US, creating medical identity theft “hotspots.” Populous states such as California, Florida, Texas, New York, and to a lesser degree, Illinois, often have high consumer complaint counts, which can result from population effects. Based on data analysis of “rate per million” so as to equalize for population, strong additional patterns emerge from the complaint data. Notably, a large cluster of southeastern states emerge as a regional hotspot for medical identity theft, with steady growth patterns. Medical identity theft hotspots have also occurred in a dispersed mix of less populous states. 

In addition to documenting geographic and growth patterns, the complaint data also documented significant and heretofore largely unreported patterns of harm related to debt collection resulting from medical identity theft, including debt collections documented to be one to three years in duration. 

The documentation of debt collection impacts on victims of medical identity theft is new information, and needs to be added to the understanding of how medical identity theft impacts victims of the crime. Although impacts and modalities will be discussed in detail in Part 3 of this report series, this report touches on this research as it represents a significant adjacent finding.

Their  recommendations include:

• The Department of Health and Human Services should facilitate the collection of follow up information from those affected by medical data breaches, specifically including data to document medical debt collection activity post-breach. 

• Policymakers and law enforcement agencies should take regional and state hot spots suggested by the data into account when planning resources for medical identity theft deterrence, prevention, and remedies. 

• Healthcare providers and related stakeholders need comprehensive risk assessments focused on preventing medical identity theft while protecting patient privacy. These risk assessments need to include specific plans for handling patient debt collection practices, and specific procedures that will prevent debt arising from medical identity theft to be passed to a collection agency. 

• Patients, medical data breach victims, and other identity theft victims should be aware of states where medical identity theft is more active. 

• The Consumer Financial Protection Bureau should monitor medical debt collection practices more closely and address abuses.

Reidentification of Australian Health Data

Recalling past items on health data sharing (eg here and here) and restrictions on reidentification (eg here) it is interesting to see a solid Australian study of reidentification.

 'Health Data in an Open World' by Chris Culnane, Benjamin I. P. Rubinstein and Vanessa Teague comments

With the aim of informing sound policy about data sharing and privacy, we describe successful re-identification of patients in an Australian de-identified open health dataset. As in prior studies of similar datasets, a few mundane facts often suffice to isolate an individual. Some people can be identified by name based on publicly available information. Decreasing the precision of the unit-record level data, or perturbing it statistically, makes re-identification gradually harder at a substantial cost to utility. We also examine the value of related datasets in improving the accuracy and confidence of re-identification. Our re-identifications were performed on a 10% sample dataset, but a related open Australian dataset allows us to infer with high confidence that some individuals in the sample have been correctly re-identified. Finally, we examine the combination of the open datasets with some commercial datasets that are known to exist but are not in our possession. We show that they would further increase the ease of re-identification.

The authors note

In August 2016, pursuing the Australian government’s policy of open government data, the federal Department of Health published online the de-identified longitudinal medical billing records of 10% of Australians, about 2.9 million people. For each selected patient, all publicly-reimbursed medical and pharmaceutical bills for the years 1984 to 2014 were included. Suppliers' and patients' IDs were encrypted, though it was obvious which bills belonged to the same person.

In September 2016 we decrypted IDs of suppliers (doctors, midwives etc) and informed the department. The dataset was then taken offline. In this paper we show that patients can also be re-identified, without decryption, by linking the unencrypted parts of the record with known information about the individual. Our aim is to inform policy about data sharing and privacy with a scientific demonstration of the ease of re-identification of this kind of data. We notified the Department of Health of these findings in December 2016.

Access to high quality, and at times sensitive, data is a modern necessity for many areas of research. The challenge we face is in how to deliver that access, whilst still protecting the privacy of the individuals in the associated datasets. There is a misconception that this is either a solved problem, or an easy problem to solve. Whilst there are a number of proposals (Australian Government Productivity Commission, 2017), they need further research, development, and analysis. 

One thing is certain: open publication of de-identified data is not a secure solution for sensitive unit-record level data.

Our motivation in this work is to highlight the challenges and demonstrate the surprising ease with which de-identification can fail. Conquering this challenge will require open and transparent discussion and research, in advance of any future releases. This report concludes with some specific alternative suggestions, including the use of differential privacy for published data, and secure, controlled access to sensitive data for researchers.

SUMMARY OF RESULTS

Our findings replicate those of similar studies of other de-identified datasets:

• A few mundane facts taken together often suffice to isolate an individual. 

• Some patients can be identified by name from publicly available information. 

• Decreasing the precision of the data, or perturbing it statistically, makes re-identification gradually harder at a substantial cost to utility.

STRUCTURE OF THIS PAPER 

We first examine uniqueness according to basic medical procedures such as childbirth. We show that some individuals are unique given public information, and show also that many patients are unique given a few basic facts such as year of birth and dates of childbirth.

Although the data is only a 10% sample, we can quantify the confidence of re-identifications, which can be high. We use a second dataset of population-wide billing frequencies, which sometimes shows that the person is unique in the whole population.

We then examine uniqueness according to the characteristics of commercial datasets we know of but do not have. We find high uniqueness rates that would allow linking with a commercial pharmaceutical dataset. We also explain that, consistent with the ``Unique in the shopping mall,” (de Montjoye, Radaelli, Singh, & Pentland, 2015) financial transactions in the dataset are sufficient for easy re-identification by the patient’s bank.