Outsourcing Surveillance

'Outsourcing, Data Insourcing, and the Irrelevant Constitution' by Kimberly N. Brown in (2015) 49(3) Georgia Law Review comments

Once the stuff of "paranoid fantasy,"· the era of ubiquitous government surveillance has arrived in large part due to the expansion of advanced technology and bulk data in private hands. Gone are the days in which cutting-edge clandestine surveillance was conducted through direct-yet relatively exceptional-methods like court ordered wiretaps. The government now carries out much of its surveillance by applying mathematical algorithms to huge sets of data that customers willingly turn over to third-party sources such as Verizon and Google. Privately-sourced phone, e-mail, and IP address information is then paired with so-called "enrichment data" from Facebook, credit card companies, airline manifests, voter registration rolls, GPS devices, aerial and closed-circuit camera photos, facial recognition systems," embedded microchips, and web-tracking technologies to create intimate personal dossiers of unsuspecting individuals who have broken no laws.

Such data insourcing for purposes of surveillance is of a piece with the government's widespread practice of outsourcing sovereign responsibilities to third parties through service contracts and other devices that effectively transfer public power to private hands. In both circumstances, existing law is not up to the task of ensuring that government officials remain accountable to the populace for sponsored activities. Statutory surveillance law and Fourth Amendment doctrine were crafted in the pre-digital age, when unconsented monitoring by the government was the greatest threat to privacy. Yet today, private industry parses and stores personal information on a scale that is exponentially greater than that which the government can aspire to on its own. The government capitalizes on such troves of private sector information for its own surveillance. It also hires private parties for military combat operations, nuclear weapons management, municipal policing, prison administration, policy planning and rulemaking, public benefits determinations, international relations work, and its own personnel management.

Because the Constitution only applies to state action, the government's use of private sources to conduct its work evades constitutional barriers that would otherwise operate to ensure accountability to the people. Outsourcing and data insourcing occupy what amounts to a pocket of constitutional immunity as an accident of doctrinal shortsightedness." Numerous scholars have outlined legislative proposals for addressing private sector involvement in government practices. This Article seeks to establish that, in spite of the many shortfalls in prevailing doctrine, recognition of constitutional limits on the government's use of insourcing and outsourcing to perform sovereign functions is - or should be - inexorable. Such limits can be derived from the Constitution's structure, which assumes that the government remains ultimately accountable to the people for the exercise of its functions. With an eye towards creative litigation, this Article recasts state action, private delegation, and Fourth Amendment doctrine in ways that enable judicial review of whether the government has structured its outsourcing and data insourcing.

Disability

In Ingram v QBE Insurance (Australia) Ltd (Human Rights) [2015] VCAT 1936 the Victorian Civil and Administrative Tribunal has dealt with a claim of direct discrimination regarding the provision of services based on the inclusion of a mental illness exclusion in a travel insurance policy and regarding provision of services when indemnity was denied in reliance on a mental illness exclusion in a travel policy.

The VCAT decision is specific to the particular claims and should be read with care.

The report states

In late 2011, during the course of her year 11 studies, Ms Ella Ingram and her mother decided she could join a school tour to New York scheduled for 30 March to 11 April 2012. The required deposit and subsequent instalments were all paid. Some of the costs were applied to a travel insurance policy issued by QBE Insurance (Australia) Ltd (QBE) on 8 December 2011.

In about January 2012, for the first time in her life, Ms Ingram experienced symptoms of depression. Over the course of the following months she was diagnosed with that illness and received treatment. In consultation with her doctors and mother, Ms Ingram decided not to go on the planned school trip, in the interests of her health.

In about April 2012, Ms Ingram’s mother made enquiries about claiming the cost of the trip on the QBE policy. The claim for $5,860 was lodged in May 2012 and was denied by QBE on 17 August 2012. The refusal was confirmed by a further letter sent on 4 December 2012.

In rejecting the claim, QBE relied upon a general exclusion that said, in summary, there is no cover where the claim arises directly or indirectly due to mental illness. There is no dispute that the definition of mental illness in the policy includes depression. In its 4 December 2012 correspondence to Ms Ingram’s mother, QBE said that the decision to refuse the claim was based on detailed statistical modelling and analysis of claims arising from a range of causes including mental illness. QBE said that mental illness is excluded from the policy because its statistics demonstrated that in travel policies there is a high risk of cancellation because of mental illness.

Ms Ingram said by including the mental illness exclusion in the policy, QBE treated her unfavourably because of her disability and directly discriminated against her in the terms on which it provided the service of travel insurance. Ms Ingram said that conduct was a breach of section 44(1)(b) of the Equal Opportunity Act 2010 (Vic) (EOA). Ms Ingram further said that, by refusing to indemnify her in August and December 2012 on the basis of her mental illness, QBE treated her unfavourably because of her disability and so directly discriminated against her contrary to section 44(1)(a) of the EOA.

Ms Ingram has sought a declaration that QBE unlawfully discriminated against her, compensation for economic loss and the damage of hurt and humiliation suffered by her and costs. The economic loss claimed is $4,292.48 which takes account of a flight costs refund. Ms Ingram sought $20,000 in compensation for hurt and humiliation.

QBE denied discriminating against Ms Ingram. In its defence it said that it did not refuse to provide insurance to Ms Ingram because of her disability. Rather, the policy wording contained an exclusion for mental illness. [1] Further or alternatively, QBE said that, if it did discriminate against Ms Ingram in either of the ways alleged, that discrimination was lawful because an EOA and/or a Disability Discrimination Act 2004 (Cth) (DDA) exception applied.

 In its summary VCAT (single member) states

At the relevant points in time, Ms Ingram had a ‘disability’ within the meaning of that term in the EOA;

QBE engaged in direct discrimination in breach of section 44 of the EOA first, when it issued her with a policy which included the mental illness exclusion and second, when it refused her indemnity relying on the terms of that exclusion;

QBE cannot rely upon the statutory exceptions to excuse the discrimination. That is because QBE has not produced evidence to prove it is more probable than not that:

• At the relevant points in time, the acts of discrimination by QBE were based on actuarial or statistical data. I have found I cannot infer otherwise. Accordingly, the exception contained in section 47(1)(b) of the EOA and section 46(2)(f) of the DDA which depend on such data do not apply;

• It would have suffered unjustifiable hardship if it had not included the mental illness exclusion in the policy issued to Ms Ingram. Accordingly, the exception contained in section 29A of the DDA does not apply;

As a consequence, QBE engaged in unlawful discrimination when it included the mental illness exclusion in the policy issued to Ms Ingram and when it denied her indemnity relying on that exclusion;

Ms Ingram is entitled to economic loss in the sum of $4,292.48, being the value of her cancelled trip;

Ms Ingram is entitled to non-economic loss in the sum of $15,000 for hurt and humiliation; and Ms Ingram is entitled only to the costs associated with her expert being required for one additional day.

Importantly, VCAT states

Ms Ingram applied for a declaration that QBE had engaged in unlawful discrimination.

I have declined Ms Ingram’s application to ensure that an impression is not given that my decision automatically applies beyond the dispute between these parties and, in particular, to avoid any impression that it applies to all insurers.

GMO Bugs

The House of Lords Science and Technology Committee has released its upbeat report on Genetically Modified Insects, stating

The problems caused by infectious disease and agricultural pests are real. Genetically modified (GM) insects have the potential to address both these problems. The UK is a world leader in the development of this technology. The European Union’s regulatory process, however, is likely to hold back progress. There is a moral duty to test the potential of the technology. We therefore support further research and call for action to test the efficiency of the EU process via a trial which should also be used to drive public engagement.

The world’s fastest growing insect-borne disease is dengue. The global incidence of dengue has grown dramatically in recent decades and about half of the world’s population is now at risk. Dengue can be found in tropical and sub-tropical climates across the world. The possibility of an outbreak of dengue, however, now exists in Europe. This mosquito-borne viral infection causes a flu-like illness, and can develop into a potentially lethal complication named severe dengue. Severe dengue is a leading cause of hospitalization and death among children in many Asian and Latin American countries. A recent study estimated there to be 390 million dengue infections per year.

In 2015 there have been approximately 214 million cases of malaria and 438,000 deaths. Sub-Saharan Africa is particularly affected; so far this year, the region has been home to 89% of malaria cases and 91% of malaria deaths. Malaria is both preventable and curable, and increased efforts have seen significant reductions in malaria incidence (the rate of new cases) and deaths. Nevertheless, about 3.2 billion people, nearly half of the world’s population, live in countries, territories and areas where malaria is endemic.

By 2050 the world’s population will likely increase by more than a third to over 9 billion people. World food production will be required to increase by 70% to feed this larger, more urban and richer population. Insect pests affect all aspects of food production, storage, transport and waste. Agricultural losses due to insect damage are high. For example, insect pests cause an average annual loss of 7.7% in production in Brazil, a reduction of approximately 25 million tons of food, fibre and biofuels, with total annual economic losses reaching around US$ 17.7 billion. Insect-borne diseases also have a heavy impact on livestock. Research conducted at the Pirbright Institute in the UK prevented Bluetongue disease becoming endemic in UK sheep and cattle, an estimated saving to the UK economy of £480 million in 2008 alone.

The development and use of GM insects offers significant potential for both the control of infectious diseases and the management of agricultural pests. It is possible to manipulate an insect’s DNA in order to alter its function or reduce its fitness. In this way, insects which transmit diseases or damage crops can be modified. GM insect technologies are a potential form of biological control, in contrast to the use of chemical controls, such as insecticides, which can be harmful to people and the environment.

GM insect technology has already been trialled for dengue transmitting mosquitoes. Developed by the UK company Oxitec Ltd., field evaluations have seen a >90% reduction in numbers of the target species in the Cayman Islands and a 96% reduction in Brazil, which is argued to be sufficient to prevent endemic dengue fever anywhere in the world. From the evidence we heard, it may be the case that GM insect technology is more suited to tackling dengue than malaria.

In November 2015, scientists announced that they had successfully used GM insect technology so that a modified mosquito passes on genes conferring resistance to a pathogen (an organism that causes disease) to almost all of its offspring, not just half, as would normally be expected. This offers the possibility of a gene resistant to the parasite that causes malaria being able to spread quickly through a wild population of mosquitoes. In early December 2015, scientists, including Professor Austin Burt who gave oral evidence to our inquiry, announced findings that could speed up the development of techniques to suppress mosquito populations to levels that would not support malaria transmission.

The potential of GM insect technologies, however, should not be over-stated; an arsenal of strategies is required to tackle insect-borne diseases and crop pests. GM insect technologies do not represent a panacea. They are one of a number of experimental techniques being investigated in order to control insect-borne diseases and reduce agricultural pests.

Nevertheless, despite inevitable uncertainties, we conclude that GM insect technologies should be afforded an opportunity to play a complementary role in helping to meet the global challenges of disease control and food security. The UK, moreover, is a world leader in this area and hosts the only company in the world producing and distributing GM insects (Oxitec Ltd.). Unfortunately, we are very concerned that the benefits offered by GM insects may not be realised. The EU regulatory regime for genetically modified organisms (GMOs) is not functioning effectively. Although no EU-level GM insect applications have been received to date, the regime has seen many applications for GM crops. In these cases, the regime is failing lamentably. The prescribed process is not being followed and the system is gridlocked. Strenuous efforts must be made to ensure that the system operates more efficiently and that future GM insect applications are not stymied unnecessarily. To this end, the UK Government must bring pressure to bear on the European Commission to ensure that the current regime works as intended.

However, ensuring that the current system works as intended is not sufficient. The EU regulatory regime does not take into account the benefits of a technology; regulation is entirely on the basis of risk. Any rational approach to deciding whether or not to pursue a given technology should include an assessment of its net benefits. At the moment, moreover, no consideration is given to the risks of alternatives to the GM application. A potential new GM insect technology to reduce an agricultural pest population, for example, would not be compared alongside the insecticide currently used to tackle the pest. As such, GMOs are effectively considered against an idealised, risk-free alternative. For many GM insect technologies, the alternative may present a number of risks and problems, and, in many cases, such risks and problems (the use of insecticides for instance) may be the imperative behind the development of the GM insect technology in the first place. Consideration of the benefits of a technology, and acknowledgment of the control methods currently in use, should be incorporated into the regulatory regime in order to address this illogical situation.

In order to attempt to break the current impasse, we recommend that the Government invests in a GM insect field trial to test fully the science of GM insects, regulatory processes and policies. This stimulus is required in order to move beyond the current stasis induced by the failings of the EU regulatory regime. Moreover, the pursuit of such a trial should be the catalyst for a public engagement exercise. It is imperative that the public is given the opportunity to understand the development of GM insect technologies in a transparent way so that the polarised debate which has enveloped GM crop technologies is avoided.

GM insect strategies for agricultural use are likely to have greater scope for application within the EU, though there may be future uses for public health purposes that could be applicable in Europe. In all likelihood, however, the main uses of GM insect technologies, particularly for public health purposes, will occur outside the EU. In this regard, we are concerned that the application of GM insect technologies in the countries whose need is greatest may be affected by a lack of international guidance and leadership on the governance and regulation of these technologies. We therefore recommend that the Government, in light of its strong commitment to international development, actively considers how these challenges of international guidance and leadership can be fully achieved.

The application of GM insect technology, together with advances in the broad area of biotechnology, has the potential to provide additional tools for the control of insect-borne diseases and crop pests. The conceivable prize is enormous and the opportunity must not be squandered. Our concern is that unless there is change, and an injection of momentum and urgency, it will be.

The report goes on to refer to "a bleak picture", stating

The process for GM crops is clearly failing lamentably. It is not working as intended. The new national derogations for commercial cultivation of GM crops, referred to by the Minister, are to be broadly welcomed as a potential means of breaking the gridlock, but only time will tell if they can have any effect.

Concerns expressed about the regulatory regime were voluminous, and extended beyond poor implementation, and the vagaries outlined by the Minister, to fundamental misgivings about the design of the regime. We heard repeatedly, from nearly all parties involved, that the system does not work as intended and is subject to excessive political interference once the scientific risk assessment has been completed by EFSA. Policy-makers should not ignore the scientific evidence base.

Further concerns highlighted to us also included: regulation was not designed with GM insect technologies in mind, but is rather an extension of the legislation for GM crops; regulation is entirely on the basis of risk, and benefits are not considered; the process is regulated rather than the product generated; and self-limiting population replacement strategies are considered in the same way as self-perpetuating population replacement strategies.

In the paragraphs that follow, we briefly catalogue the litany of criticism that was directed towards the regulatory regime. As Dr Jack Stilgoe, Senior Lecturer at the Department of Science and Technology Studies, University College London, put it to us: “I am afraid it is one of those situations where you could say ‘you wouldn’t start from here’.” We agree, but we have, of course, no choice, and if the potential of GM insects is to be realised, then urgent actions are required.

As we have noted, the regulatory regime covers all GMOs including both GM crops and GM insects. Although it does remain to be seen if GM insect applications would be subject to regulatory difficulties resulting from part C of directive 2001/18/EC, all the experience of GM crops would seem to point to it. Professor Rosemary Hails, Chair, Advisory Committee on Releases to the Environment (ACRE), stated: “in the EU we do not have a functioning system for GM crops.”83 Camilla Beech, Head of Regulatory Affairs at Oxitec Ltd., gave a clear view from the commercial sector: “As an applicant we believe that the European system does not work because it is just not predictable. You put an application in and you can never predict when you are going to receive a response. That is bad for innovation and it is bad for companies.”84 100.Innovate UK stressed that the deliberate release directive had not been designed with GM insect technologies in mind, but was rather an extension of the legislation for GM crops: “The current regulations pre-date the existence of GM insects and do not seem to effectively accommodate this technology.”85 George Eustice MP, however, disputed the view that the currently regulatory regime could not effectively accommodate GM insect technologies: “from a regulatory point of view, we do not see any reason why the GM process that exists for crops in the EU should not equally be applied to GM insects.”86 101.We heard repeatedly that there is currently no means to consider the potential benefits of GMOs within the regulatory regime. As such, decisions are made entirely on the basis of risk alone. The National Institutes of Bioscience (NIB) stated: “Without considering benefits, one is implicitly comparing the proposed action with a non-existent risk-free alternative—a Utopian fallacy. Benefits, and therefore risk-benefit, could be considered explicitly.”

Furthermore, we were surprised to learn that new technologies are not evaluated alongside alternative means to address the problem. For example, a potential new GM insect technology to reduce an agricultural pest population would not be compared alongside the insecticide currently used to tackle the pest.

The current EU regime operates via a system of process-based regulation. That is to say, the trigger is the process by which a product is made rather than the nature of the product itself. In this regard, Camilla Beech, Head of Regulatory Affairs at Oxitec Ltd., offered the following analogy: “It is like reviewing a book as to whether it has been written on a typewriter or a computer and not on its content.”

This process-based system would consider population replacement and population suppression GM insect strategies in the same way. John Mumford, Professor of Natural Resource Management, Centre for Environmental Policy, Imperial College London, highlighted a fundamental conflict within the current framework when population replacement strategies were considered: “there are seven large areas of technical concern within the deliberate release directive, and persistence is one of those seven. Obviously, with the self-sustaining mode of action for some of these methods, you are starting from an assumption that the whole mode of action is a concern. That is an inherent conflict within the regulation.”  In this way, the deliberate release directive is fundamentally not designed to consider self-perpetuating population replacement strategies.

The criticism directed towards the regulatory regime raises the question of whether the focus should be on making the current system work better, or seeking to overhaul it entirely. Professor Rosemary Hails argued that there would be merit in trying to make the existing system work as it should: “We ought to be proactive on trying to make the current system work more effectively. In essence, we have the evidence that it works more effectively in other countries.”

The current system is framed around the implementation of the Precautionary Principle. On the use of this Principle, Professor Rosemary Hails stated: “the Precautionary Principle properly applied would also take into account the risks of not developing a particular technology and the benefits forgone. It is a misuse of the Precautionary Principle that has led us to this place.”

The Government maintains that the best course of action is to ensure that the regulatory environment works as it is written. George Eustice MP said: “All the EU has to do is not necessarily rewrite its process but just gain some credibility by sticking to the process that it has written down.”

George Freeman MP put it in the following terms: “GM technology is taking off across the world. The question is not whether we are going to stop it; the question is whether we are going to help contribute to leading it and getting the right regulatory framework in place.”

We welcome the Government’s endorsement of the potential of GM technologies and its recognition of the importance of a functioning regulatory environment. We are concerned, however, by its view that the most appropriate course of action is only to ensure that the current system proceeds as it is written. This is not sufficient.

GM insects have the potential to help in the control of both insect-borne diseases and agricultural pests, bringing both public health and economic benefits. The UK is a world leader in the development of GM insect technologies and the public good and the commercial opportunities are tangible. However the current EU regulatory regime for GMOs risks this opportunity being squandered. The regime is failing as applied to GM crops and the full potential of GM insects will not be realised if it continues to fail to function adequately.

We accept that there is some practical merit in the Government’s decision to work to ensure that the existing regulatory regime for GMOs at least functions as written. We ask the Government to set out clearly how it intends to do so and to publish annual updates on progress made in improving the operation of the system, starting in the summer of 2016. However, we do not accept that this is sufficient and we advocate a more radical review of the regulatory framework later in this Chapter.

International regimes

By way of comparison, we explored a number of international (non-EU) regulatory frameworks for GMOs in order to ascertain the characteristics of alternative regulatory regimes. Norway was cited as a notable example. Although a non-EU country, Norway is a member of the European Economic Area (EEA). As a member of the EEA, it has incorporated EU-based regulation but has also included an additional component. Professor Rosemary Hails told us: “Norway has some additional legislation—the Gene Technology Act 1993—where it considers the benefits also of a particular element to the community and the contribution to sustainable development, but that is in addition to the other regulations.”

Outside Europe, we were told that Canada has adopted a regime of trait-based regulation. This is effectively the reverse of the system in the EU whereby process-based regulation is used. Dr Jeremy Sweet, an Environmental Consultant with Sweet Environmental Consultants and member of the EFSA GMO panel, said of the Canadian system: “they do not discriminate GMOs from other types of engineering or manipulation or technologies. They look at the novelty of a product and say, ‘Are we concerned about this and do we need to look at it and regulate it?’”

Oxitec Ltd. highlighted the regulatory environment in Brazil. This regulatory system has been tested, unlike that in the EU, and the Brazilian authorities accepted a trial release of Oxitec GM mosquitoes. Oxitec suggested that this successful release in Brazil was due to “a clear regulatory framework based on plausible scientific pathways to harm and subsequent evaluation allowed the assessment of the dossier for commercial release in approximately 9 months from submission to approval.” From what we heard of the EU regulatory system, such efficiency would seem highly unlikely were a similar application to be received.

Oxitec also highlighted the regulatory environment in the USA where, under the National Environmental Policy Act, agencies are required to issue an Environmental Assessment that takes into consideration the alternatives available alongside the GMO application. Thus, GM insects are not considered against an idealised ‘risk-free’ alternative.

The joint submission received from a grouping of eminent Brazilian scientists—Dr Amaro de Castro Lira Neto, Dr Marcia Almeida de Melo and Professor Paulo Paes de Andrade—also highlighted the US system of regulation. They suggested that the main point of success of the US system is: “the full independence of the risk assessment procedure against the other risk analysis steps, i.e., risk management and risk communication, and ultimately against political decisions.” Furthermore they stressed that: “No political interference is allowed, at least under normal circumstances.”

This independence of the risk assessment procedure from political decision-making presents a stark contrast to the picture painted for us of the EU regulatory system. This group of Brazilian scientists also suggested that this independence is the cause of rapid adoption of biotechnology in Brazil and, to a certain extent, in Argentina, Australia and Canada as well.

Alternative regulatory protocols

We were presented with a number of alternative regulatory models that may allow for more effective incorporation of GM insects into the general GMO regulations. A number of these have been touched on above. Warnings were issued, however, about the pursuit of a new regulatory regime. George Eustice MP stressed to us: “with any European process you always have to be conscious that by taking the lid off things and trying to play around with the wiring, you might end up with something worse. It is a terrible thing to say, but I am afraid there is a track record of trying to tamper with things in Europe that are not quite right, and they end up worse than ever.”

.Although a radical overhaul of the current regulatory process may be unlikely or undesirable at this time, a number of potential alterations to the regulatory process were highlighted to us.

A trait-based approach

A trait-based approach to regulation was raised as a sensible, scientifically-sound alternative to the current process-based regulatory system. In this case, the product, rather than the means by which it has been formed, is considered. This system is in operation in Canada. Professor Rosemary Hails indicated that ACRE would deem this approach to be more scientifically defensible and “more scientifically rational now.” Dr Jeremy Sweet also highlighted that trait-based regulation is a “science-based approach”.

.A move to a trait-based system would allow separate consideration of GM insects created via population suppression and population replacement strategies. It would also result in population suppression approaches such as Oxitec’s genetic-equivalent of the SIT being considered in the same way as traditional irradiation-based SIT approaches. This may be more rational as the nature and implications of the end products are arguably the same; it is simply that the process to create them is different.

Not all the evidence we heard suggested that trait-based regulation is superior to process-based regulation. Dr Jack Stilgoe warned us that there may be good reasons for a process-based system: “They are to do with the uncertainties that we might be unable to predict in terms of the products, whether those are the products themselves or the products of that particular innovation in terms of the consequences and ramifications of those traits, and actually paying attention to the processes might better take you into a precautionary approach to governing those uncertainties.”

New technological developments may be captured within a system of trait-based regulation. For example, both transgenic and cisgenic GMOs would be included. Dr Jeremy Sweet indicated that it is becoming increasingly difficult to draw a distinction between “GM” and “non-GM”. He emphasised to us that: “We are getting into a bigger and bigger mess by basing the regulation around the technology.”

Government Ministers also highlighted to us that new emerging technologies are serving to blur the boundaries between GM and non-GM. However, on the prospect that trait-based regulation could incorporate new (cisgenic) technologies and remove the need for such arbitrary classifications, George Eustice MP stated: “We would not want those [emerging technologies] to be treated as GM, otherwise you are going to hold back the development of a very exciting new area.” He continued: “Once you start talking about trait-based approaches to this, I think there is a danger that you start to tip some of those other novel techniques too closely to the GM regulatory regime, which is the worst of all worlds, because then you have other exciting new technologies that we hope to protect from this and to maintain an understanding that they are not GM, and get muddled up in this unsatisfactory regime as well.”

At present, cisgenic organisms, such as those created using gene-editing techniques, including CRISPR, are not considered within 2001/18/EC. We consider this to be correct. We heed the warning that a move to trait-based regulation would alter this situation. However, while we agree with the Minister that new emerging technologies should not be stifled by a failing regulatory system, we do not think it appropriate to ignore the deficiencies of the regulatory regime for other developing (transgenic) technologies.

We urge the Government to monitor the development of new genetic technologies, including GM insects, in order to ensure that the regulatory regime is fit-for-purpose. We recognise that a move to a trait-based system may not currently be appropriate. We see the risk that a move to a trait-based system may be counter-productive in the short term. We acknowledge, however, that trait-based regulation may be a valid long-term aim in order to develop a more scientifically robust, overarching regime once current regulatory barriers within 2001/18/EC have been addressed. Monitoring and surveillance of persisting GMOs

.Persistence is not currently accounted for within the directive 2001/18/EC. The Institute for Science, Innovation and Society at the University of Oxford highlighted that ‘future-proofing’ would be needed in light of the development of self-sustaining, persistent gene-drive techniques: “These ‘second generation’ varieties will present a radical challenge to existing regulatory frameworks. For one, they will likely require forms of pre-release testing and post-release monitoring yet to be developed.”

.Mechanisms will be required in order to allow for effective post-release monitoring and tracking of new genetic material promoted via gene drives, and designed to persist in the environment, particularly as these may not be included within 2001/18/EC. This could include means to implement both ecological monitoring and GM screening. The Institute for Science, Innovation and Society continued: “We need better tools for the monitoring of GM insects in the environment, and the development of these tools needs to be addressed in a public and straightforward manner by the relevant scientific and regulatory institutions.” We are persuaded by these arguments.

The ecological impact of GMOs designed to persist in the environment presents a new regulatory challenge. In light of the advances in gene-drive research, we conclude that underpinning research is required in order to allow effective monitoring and tracking of this new generation of genetic modifications. The regulatory framework should take persistence into account and stipulate appropriate monitoring requirements. Consideration of benefits and evaluation alongside alternatives

We heard a number of times that taking into account the benefits of a technology could be a desirable addition to the current regulatory process. ACRE has given thought to how this could work within the existing framework. Professor Rosemary Hails explained to us that: “For example, in the whole risk assessment process, the very last question is to characterise the overall risk of a GM organism. Additional information could be provided on context under that question and that context could include benefits also. The reason why that does not happen routinely is the questions leading up to that final question do not put in the building blocks for benefits in the same way as they do for risks.”

Although any rational approach to deciding whether or not to pursue a given technology would include an assessment of its net benefits, the key element must first be sound scientific risk assessment. Professor John Mumford stated: “the risk assessment stage should be independent of values such as benefits. Those may enter at a later stage at the risk management stage, where a decision is made, but not at the assessment stage. Assessment should be objective and management should focus on performance and benefits.”

We heard different views on how benefits might be considered. Benefits and risk are often considered as opposites. However, Sir Roland Jackson, Executive Chair, Sciencewise, questioned this linkage and stressed that benefit is not the opposite of risk. He urged that benefits and dis-benefits be considered alongside each other. Risks and dis-benefits must not be conflated. He provided us with the following clarification: “Questions of benefits encompass a much wider range of issues than the question of science-defined risk. If you are to have a system that looks at benefits as well as risk, you have to look at wider dis-benefits—things like impacts on employment, ways of farming or landscapes, which are not dealt with in a risk assessment.”

Benefits must be considered at an appropriate stage of the regulatory process and not confused with scientific risk assessment. We consider that benefits and dis-benefits should be considered after the process of scientific risk assessment has taken place, at the risk management stage.

As well as confusion surrounding benefits and dis-benefits, more clarity is needed in considering hazard, exposure, risk, and vulnerability. In the Government Chief Scientific Advisor’s 2014 annual report Innovation: managing risk, not avoiding it, Sir Mark Walport argued that it is vital that these terms are understood.

Hazard is frequently equated or confused with risk, and this leads to poor debate, confused communication and flawed decision-making.

.Professor Austin Burt highlighted the potential perversity in not including consideration of the benefits of a GM insect strategy. He stated: “I would not go to a Government in sub-Saharan Africa with this idea of a genetically modified mosquito and not talk about malaria. That does not make sense.”

Professor Luke Alphey reiterated this view: “If you are not talking about the benefits and the reasons why you are doing it, how will you persuade anybody it is worth doing? At that level it does not make any sense.”

The Government do not think that considering benefits should be pursued, despite appreciating the logic behind these arguments. George Eustice MP suggested that such a move would be unlikely to make a significant change in ameliorating the current major problems at the EU level: “My argument would be if the problem is a political barrier and an overly cautious political culture, to say that we are just going to balance the risk against benefits does not do much to reassure that problem.”

Dr Ladislav Miko, Deputy Director-General in the DG for Health and Food Safety at the European Commission, corroborated this perspective: “In my view, all the experience we have shows that the position of member states which are not supporting the GMs will not be dramatically changed by any socio-economic analysis.”

Benefits were not the only additional consideration that we were told ought to be incorporated into the regulatory regime. As previously highlighted, in the current regime GMOs are effectively considered against an idealised, risk-free alternative. Obviously such an alternative does not exist. Furthermore, for many GM insect technologies, the alternative presents a number of risks and problems. In many cases, this is the imperative behind the development of the GM insect technology in the first place. A clear example is insecticides.

The Institute for Science, Innovation and Society called for evaluation of GM insects alongside alternative approaches to the problem in question. They stated that: “Application of genetic methods of insect control should be evaluated alongside alternative courses of action.” While the existing plausible pathways to harm requirements go some way towards acknowledging this, we perceive it to be vital that, on a case-by-case basis, appropriate comparators are used.

We consider the argument for including the benefits of a technology within the regulatory process to be entirely valid. Furthermore, we do not agree with the stance of the Government and the European Commission that there would be little to gain in modifying the current framework to include consideration of benefits. We recommend that consideration of benefits and dis-benefits be incorporated into the regulatory regime once the scientific risk assessment has taken place, during the risk management stage.

Furthermore it is inappropriate that new GMO technologies are considered in relation to an unrealistic, risk-free alternative. We recommend that the regulatory process should acknowledge control methods currently in use, such as insecticides, which a new technology may replace.

It is clear to us that the regulatory regime is failing as it is currently applied to GM crops. Furthermore, we envisage that these failings would likely affect GM insect applications. Views on how the regime could be improved are numerous. Action, as we recommended earlier in this chapter, needs to be taken to try and improve the current system, but this is only sufficient as a first step.

We are concerned that a situation has arisen whereby applications are not received due to concerns over the regulatory framework, yet the regulatory framework cannot be tested nor improved until such an application materialises. There are concerns that GM insect applications would likely be subjected to the considerable delays experienced by crop applications. The Minister, George Eustice MP, described such applications to us as being “stuck in limboland.”

Action needs to be taken to try and breathe new life into this policy area and provide some momentum and a focus for activity. It is with this in mind that we think the Government should initiate an insect trial akin to the Farm Scale Evaluations of new GM crop technologies. In our view, this would represent a positive means of trying to break the regulatory deadlock.

Privacy Sales

'Shopping for privacy: Purchase details leaked to PayPal' by Sören Preibusch, Thomas Peetz, Gunes Acar and Bettina Berendt in Electronic Commerce Research and Applications comments

We present a new form of online tracking: explicit, yet unnecessary leakage of personal information and detailed shopping habits from online merchants to payment providers. In contrast to the widely debated tracking of Web browsing, online shops make it impossible for their customers to avoid this dissemination of their data. We record and analyse leakage patterns for the 881 most popular US Web shops sampled from actual Web users’ online purchase sessions.

More than half of the sites we analysed shared product names and details with PayPal, allowing the payment provider to build up fine-grained and comprehensive consumption profiles about its clients across the sites they buy from, subscribe to, or donate to. In addition, PayPal forwards customers’ shopping details to Omniture, a third-party data aggregator with even larger tracking reach than PayPal itself. Leakage to PayPal is commonplace across product categories and includes details of medication or sex toys. We provide recommendations for merchants.

The authors conclude -

We presented a new species in the zoo of online tracking systems: explicit leakage of personal information and detailed shopping habits from online merchants to payment providers. In contrast to the widely debated tracking of Web browsing, online shops make it impossible for their customers to avoid this proliferation of their data.

By mediating online payments between merchants and buyers, payment providers are in a position to access sensitive payment details that can be used to build a detailed profile of shopping habits. Being the most popular payment provider, PayPal learns how much money its 152 million customers are spending and where. These customers are identified by name, email and postal address and through their bank details. We have demonstrated that merchant Websites are unnecessarily forwarding product details to PayPal that give a detailed view on consumers’ purchases.

According to the 881 sites studied in our analysis, 52% of the most popular US Web shops shared product names, item numbers and descriptions with PayPal. Besides the negative privacy impact, consumers whose data are proliferating could suffer from less favourable payment terms (e.g., unavailable payment methods of higher interest rates on consumer loans based on their purchase patterns). On the other hand, the remaining 388 sites did not share any purchase details except the amount to be paid, confirming that sharing sensitive details is not necessary for electronic retailers.

Further, we reported on the PayPal’s use of the tracking service Omniture, which amplifies the privacy concerns by exposing transaction details to a widely deployed third-party tracker. A third-party tracker that has access to general Web tracking information, as well as to the details of successfully completed transactions, is in a particularly privileged situation to monitor consumption choices at large.

Web shops that use the technically more advanced token-based integration are often more privacy-friendly. Also, less popular sites are significantly more often among those that leak more personal information. There are no systematic differences across product categories, meaning that all kinds of shoppers are exposed.

To the extent that PayPal, as an example of payment providers in general, collects personal information at scale, it becomes a constituent part of the online shopping experience: neither researchers nor enforcement authorities can reduce its role to a passive intermediary when assessing the privacy impact of e-commerce transactions.

By exploring the alternative privacy preserving practices that can be followed by Web shops, we distilled the following suggestions for merchants:

(1) apply data minimization principle—do not leak information that is not required for processing the transaction;

(2) inform customers about the data sharing in your privacy policy;

(3) offer alternative, privacy-friendly payment methods, such as direct debit or pre-payment;

(4) use a payment gateway to prevent leakage of product URL via referrer header.

Future research through qualitative interviews with decision-makers and engineers at merchants should look at the drivers and motives behind PayPal integration choices and their privacy consequences. On the technical side, expanding the scope to mobile and in-app payments promises valuable for these growing, yet opaque transactions. Better privacy practices for handling online payments are not only desirable for end users, but also for the merchants and payment providers whose businesses depend on the users’ trust.

At times when personal information is said to be new currency on the Web, it seems unfair that consumers are charged twice during checkout.

Parental Rights?

'Against Parental Rights' by Samantha Godwin in (2015) 47 Columbia Human Rights Law Review 1  advances

an interpretive account of parental rights and builds a normative case against them. This normative account considers how parental rights function in existing constitutional and family law, and assesses theoretical arguments that seek to justify them.

This article begins by describing the most common, child-centered justification for parental rights: that parents are empowered in order to protect children’s best interests. I argue that these child-centered accounts do not justify the current legal regime governing parental rights. Instead, current parental rights are better understood as quasi-property interests, residual from historical traditions where children were more explicitly regarded as their parents’ property.

The middle part of this article advances the thesis that the quasi-property functioning of parental rights is not a contingent feature of American law of parents and children. It is instead characteristic of granting parents separate autonomy interests in determining the path of their children’s lives. Parental autonomy rights displace and diminish consideration for children’s interests and objectify children.

This article introduces the concept of “desire-contingent goods” and argues that parental autonomy rights are paradigmatically the right to choose desire contingent goods for children regardless of whether they are desired or not. This denies the equal importance of children’s desires, subjective experiences and perspectives on their own lives. As a consequence, basic doctrines in constitutional and family law cannot be reconciled with liberal and egalitarian commitments.

The second half of this article evaluates alternative theoretical justifications for parental rights. These include constitutional and philosophical arguments based on personal liberty and family privacy, as well as philosophical arguments based on relational rights, ethics of care, and the Lockean labor theory of value. These arguments all fall short and, in crucial ways, rely on denying children equal moral consideration. The article concludes with recommendations for legal reform.

Apologies

The Tasmanian Attorney-General has announced that the state Government will introduce legislation in 2016 to expunge historic criminal records for consensual homosexual sexual activity.

The announcement indicates that

The Tasmanian Liberal Party, both in Opposition and in Government, has supported expunging historic criminal records for homosexual activity which was previously illegal.

Additionally, a formal apology to those affected, including families and loved ones of those who are deceased, will be made when the legislation is introduced in the house.

The legislation will expunge convictions for the following offences:

Section 122(a) – sexual intercourse against the order of nature;

Section 122(c) – consensual sexual intercourse between males; and

Section 123 – indecent practices between males.

These sections of the Tasmanian Criminal Code were repealed in 1997 after homosexuality was decriminalised in Tasmania but the repeal did not address the implications for those with existing criminal records pertaining to consensual homosexual activity.

The legislation will ensure that any individual prosecuted under these offences will no longer suffer distress or be disadvantaged by a criminal record in relation to travel, employment, and volunteering.

The legislation will also allow other offences under which people may have been charged for consensual homosexual activity to be added by regulation at a later date so these historical offences can also be expunged from a person’s criminal record.

I thank the Anti-Discrimination Commissioner for her report titled ‘Treatment of historic records for consensual homosexual sexual activity and related conduct’, which has helped to progress this important issue.

The Government has approved some variations from the model for expunging offences proposed by the Anti-Discrimination Commissioner, in order to allow us to implement legislation and open the scheme to expunge offences as efficiently and as soon as possible.

Rather than requiring the establishment of a Historic Criminal Records Expert Panel as proposed by the Commissioner, applications will be processed through the Secretary of the Department of Justice, consistent with how other jurisdictions manage this process.

The Anti-Discrimination Commissioner's April 2015 report [PDF] has the following recommendations

R1 A dedicated scheme is established to enable historic criminal and related records relating to homosexual activities or activities arising because of a person’s diverse sexual orientation or gender identity to be expunged.

R2 All criminal and related records arising from consensual sexual activity and related conduct in situations where the applicant would not have been dealt with by police but for the fact that the applicant was suspected of engaging in sexual activity of a homosexual nature or because of their sexual orientation or gender identity are covered by the scheme, including:

(a) historic criminal records arising in relation to sections 122(a) and (c), and 123 of the Criminal Code involving consensual sexual activity;

(b) historic criminal records arising in relation to other repealed offences used to prosecute activity of a homosexual nature or because of a person’s sexual orientation or gender identity;

(c) historic criminal records arising in relation to associated offences where the applicant would not have been charged but for the fact that the applicant was being dealt with in relation to engaging in conduct of a homosexual nature or their sexual orientation or gender identity;

(d) historic criminal records related to any other offence by which homosexual and perceived homosexual conduct or conduct related to a person’s sexual orientation or gender identity could be punished that do not represent an offence under current law or with which a person could still be charged where a record would not have been arisen but for the fact that the applicant was suspected of engaging in sexual activity of a homosexual nature; and

(e) historic criminal records related to any offence of attempting, conspiring or inciting to commit any of the offences outlined above

R3 The scheme have the capacity for the expunction of historic criminal records of persons of diverse sexual orientation or gender identity in all circumstances where the conduct was otherwise lawful for those in the broader community.

R4 The scheme has the capacity for the expunction of historic criminal records for offences that took place in association with the primary offence and/or records for inchoate offences relating to the primary offence.

R5 Where age is relevant to consideration of whether an act is eligible to be permanently disregarded, the test to be used is whether the same behaviour between males and females would be considered lawful or unlawful in the circumstances.

R6 Any conviction of a young person (and related records), in circumstances where they were the subject of non-consensual sexual abuse by an older person, also be eligible to be permanently disregarded.

R7 The scheme enable a spouse, domestic partner, child, parent, sibling, personal representative or other appropriate representative to seek the posthumous expunction of relevant historic criminal records.

R8 The Government consider issuing a formal apology to those who have suffered because of actions by authorities resulting in a historic criminal record and to the family and loved ones of those who are deceased.

R9 The Government seek the grant of a royal pardon to deceased persons who were convicted under relevant sections of the Tasmanian Criminal Code and other Tasmanian or colonial laws who, as a result of the time that has elapsed since their death, no longer have a spouse, domestic partner, child, parent, sibling or personal representative to make application for a conviction to be disregarded.

R10 Legislation be prepared to establish a dedicated scheme to enable historic criminal records to be expunged with the effect of:

(a) restoring all legal rights as if the historic criminal record had not been made;

(b) providing the right of non-disclosure of all expunged records under all circumstances;

(c) separating all expunged criminal and related records (and all references to them) from a person’s criminal and other records and empowering the Registrar to have custody of those records;

(d) destroying all duplicates of all expunged relevant criminal and other records;

(e) ensuring that the applicant’s privacy and that of any other relevant person are respected; and

(f) prohibiting the disclosure of any information relating to the conviction or related material.

R11 A Historic Criminal Records Expert Panel (HCREP) be established comprising the Anti-Discrimination Commissioner, the Registrar under the Working with Vulnerable People Act 2013 and the Dean of Law at the University of Tasmania. The Panel be authorised authority to make decisions, including binding orders, on applications for expunction of relevant records.

R12 The Anti-Discrimination Commissioner be appointed as Registrar of the scheme.

R13 The Historic Criminal Records Expert Panel be empowered to request and receive all record s considered relevant to assessing an application.

R14 A person who believes they have a historic criminal record that should be permanently disregarded be required to complete an application form, providing details of relevant records and offences, including information relating to the incidents leading to the conviction or other police action.

R15 The application form should authorise the conduct of a police record search and consent to access any other relevant records.

R16 The Registrar be authorised to provide the applicant with access to any records on the basis that any information contained within the records related to the identity or personal details of any person other than the applicant not to be disclosed.

R17 It be an offence to knowingly give the Historic Criminal Records Expert Panel false or misleading information.

R18 If the Historic Criminal Records Expert Panel is satisfied that an order to permanently disregard a historic criminal record was based on false or misleading information or documents that are false or misleading, the Historic Criminal Records Expert Panel be empowered to determine that the historic criminal record is no longer to be disregarded and the record reinstated; with such decisions to be subject to the same review rights as a decision not to order a record be permanently disregarded.

R19 Information provided to the Historic Criminal Records Expert Panel as part of the application and during subsequent investigation not be capable of being used in any proceedings for perjury or similar offences related to statements or evidence given at the time of the original offence.

R20 Decisions to expunge relevant records be binding on all authorities.

R21 A decision that a historic criminal record is not eligible to be disregarded or to reinstate a permanently disregarded record be reviewable by a magistrate in private session under amended provisions of the Magistrates Court (Administrative Appeals Division) Act 2001 (Tas).

R22 Relevant authorities are required to notify the record holder prior to decision or the release of information for other purposes where a record is identified that may be eligible to be expunged. This includes procedures for the conduct of police record checks and the assessment of applications for registration under the Registration to Work with Vulnerable People Act 2013 (Tas).

R23 An order for expunction is to apply to all government records, including official police records, general police records, court documents and general government records.

R24 Expunged historic records be permanently held by the Registrar of the scheme, with all remaining records to contain no indication of the nature of the amendment.

R25 Secondary records or duplicate files held in paper or electronic format related to historic criminal records that are to be expunged should be destroyed.

R26 Where the Historic Criminal Records Expert Panel has ordered that a record be expunged, disclosure of information regarding that record be an offence carrying a  serious penalty and the mechanism for investigation and prosecution of such an offence is specified clearly in the legislation.

R27 The Attorney General liaise with the Attorneys General of the Commonwealth and other states and the territories to establish a mechanism for the identification and expunction of all relevant records that have been pro vided to or received from another jurisdiction.

R28 Consequential amendments be made to the Archives Act 1983 (Tas) to give effect to the intent of the scheme.

R29 The definition of ‘irrelevant criminal record’ in section 3 of the Anti-Discrimination Act 1998 (Tas) be amended to included records expunged under the scheme.

R30 Consequential amendments be made to the Annulled Convictions Act 2003 (Tas) and related legislation to provide for the non-disclosure of expunged historic criminal records.

R31 The Registration to Work with Vulnerable People Act 2013 (Tas) be amended as necessary to prohibit consideration of any records expunged under the scheme.

R32 The Registrar of the scheme have authority to release expunged records in specific circumstances.

R33 Arrangements are established to enable, including through an application costs reimbursement mechanism, necessary assistance to be provided to applicants by Community Legal Centres in Tasmania together with bodies in other states and territories such as the Human Rights Law Centre and the Public Interest Advocacy Centre.

R34 Additional resources are made available to the Anti-Discrimination Commissioner to cover the one-off establishment activities for the scheme and the ongoing administrative, investigative and communication activities

Up to a point, Lord Copper

When contextualised with Government practice over the past decade the preliminary Privacy Impact Assessment for the National Facial Biometric Matching Capability (NFBMC), noted here, is problematical.

It's a bland "up to a point, Lord Copper" document with recommendations that will either be expressly ignored or - as importantly - disregarded through lip service. As I noted at last night's Open Government Partnership consultation in Canberra, there's been no clear commitment on the part of Government to abandon plans to abolish the OAIC (let alone meaningfully resuscitate that rather moribund, timid and grossly underfunded body), so we might be sceptical about bureaucratic embrace of references to "the people's voice" and funding of privacy governance.

The report states

The Attorney-General’s Department (AGD) engaged Information Integrity Solutions Pty Ltd (IIS) to undertake a privacy impact assessment (PIA) during the early design stage of the Central Interoperability Hub (the Hub) of the forthcoming National Facial Biometric Matching Capability.

Importantly

IIS has not been asked to assess or comment on the potential privacy impact of the concept of the NFBMC as such, or its overall operation. Rather, IIS has been asked to focus its findings on the Hub design and its initial operation and governance, taking account of the NFBMC’s vision and aims.

A more meaningful PIA would have taken place at the beginning of the design process, would actually look at "the potential privacy impact of the concept of the NFBMC as such" and at "its overall operation", and would move beyond noting that the Hub is legal (the latter is essence having a sufficient number of under-briefed MPs)

The report states 

Government agencies are increasingly using facial biometric systems for a range of law enforcement, national security and identity assurance purposes and in these contexts are sharing biometric information. However, the current arrangements tend to be ad hoc and limited by legal or technical incompatibilities. The NFBMC is intended to facilitate secure, accountable sharing of facial images and other relevant information to prevent fraud, support law enforcement, promote national security, and streamline service delivery. Subject to inter-governmental and inter-agency agreements, the Hub will transmit facial biometric and biographic information between participating agencies in compatible formats.

The Hub is intended to be ‘neutral’ – participating agencies remain responsible for their information, the application of biometric technologies and decisions about whether or not images match. The Hub will store some transaction metadata but does not store any of the biometric or biographic information it transmits. Biometric information is widely considered to be intrinsically sensitive and agencies’ use of biometric matching techniques, if not well managed, could cause significant problems for individuals through mismatches, stigmatisation and inability to gain easy redress.

The report goes on to explain -

Privacy by Design (PbD) is based on seven principles which include ‘Privacy Embedded into Design’ and ‘End - to - End Security’. The application of these principles in this case have resulted in decisions to adopt the hub and spoke architecture and for the Hub to store minimal information.  This PIA focuses on only one element of the NFBMC. Its scope is limited to the Hub design and governance.

No indication of benchmarks in discussing the design and as noted above no consideration of context.

AGD indicates that all Commonwealth, State and Territory participating agencies will be required to undertake further PIAs that focus on their use of the NFBMC as it develops. These would address, for example, participating agencies use of the Hub and the proposed driver licence facial recognition solution.

This PIA analysis recognises the steps AGD has taken so far to minimise privacy risks and to design - in strong security measures. It also takes account of the benefits that the Hub could deliver, including in addressing identity fraud and theft, which is having an increasing impact on individuals.

No great surprises with the statement that -

IIS considers that it is important to recognise that the Hub will have an impact on the circumstances in which facial biometric information is shared, by whom and the volume of images shared, and these risks will have to be actively managed. There is also the risk, which IIS considers is low, that the Hub and the metadata generated by transactions performed through it could potentially allow for some tracking or surveillance of individuals’ everyday activities. However, it is the view of IIS that the privacy impacts of the whole system could well be greater than the risks at individual agency or Hub level. As such, IIS considers that strong, widely respected governance of the system as a whole, particularly as it evolves over time, is equally and potentially more important than governance of the individual participating agencies and the Hub

The authors state that-

AGD’s approach to the Hub design process has been generally consistent with the requirements of the Australian Privacy Principles (APPs) in the Privacy Act 1988. IIS has not identified any significant risks or privacy issues in the Hub design. IIS has identified areas where it considers some extra steps are needed to maintain the focus on privacy and good privacy practice. These include:

• The ongoing management of privacy in the Hub design 

• The metadata the Hub will generate about transactions 

• The Hub access and security arrangements.

IIS also considers that AGD’s approach to the Hub’s operation and the likely governance arrangements is also consistent with the APPs and it has not identified any significant compliance risks. IIS has made a number of recommendations to strengthen privacy practices. These recommendations take account of the multi-jurisdictional nature of the NFBMC and aim to promote continued privacy good practice to help ensure the aspiration of ‘robust privacy safeguards’ is delivered.

The areas in which IIS considers there are potential privacy risks include:

• The scope of the NFBMC 

• AGD’s privacy management framework for the Hub 

• The extent to which the development and operation of the Hub is conducted openly and transparently 

• The NFBMC Governance arrangements including the governance of change.

Recommendations are as follows

1 Recommendations for Hub Design

1. APPs to apply to information the Hub collects, transmits or holds

IIS recommends that AGD in its role as Hub manager commit to complying with the APPs, whether or not the Hub is legally considered to collect or hold personal information.

2. Hub design informed by a broad view of privacy and the potential overall impact of the NFBMC

a) IIS recommends that AGD ensure that its further development of the Hub, and the governance arrangements for the operations of the Hub, reflect a broad view of the concept of privacy, as opposed to a strict legal compliance view.

b) IIS recommends that the Hub design and governance arrangements should, from the outset, take into account the Hub’s likely future use, both in terms of the number and nature of participating organisations, as well as the volume and nature of information exchanged and the potential impacts on privacy.

3. Limit metadata to that needed for operational purposes and agency audits or investigations

(a) IIS recommends that AGD ensure the metadata generated by the Hub is the minimum needed to:

(i) Effectively manage the Hub

(ii) Provide assurance that acce ss to the Hub is for legitimate and appropriate purposes

(iii) Ensure participating agencies can monitor their access to the Hub and undertake investigations of possible nefarious staff activities.

(b) IIS recommends that the nature of metadata generated, and the period for which metadata will be retained be transparent to citizens.

(c) IIS recommends that metadata generated by the Hub be retained for the minimum period needed to support the purposes for which it is generated.

4. Records of authority to release information

IIS recommends that AGD ensure the Hub design supports agencies’ ability to make well - informed decisions to release images or biographic data based on a clear understanding of the purpose and authority for the request.

5. Strengthening of some security measures

(a) IIS supports the access management approach proposed by AGD and recommends disabling and re-authorising all users and their level of authority at regular short, for example, three monthly intervals.

(b) IIS supports the Hub project emphasis on training and standards and recommends that AGD ensure these address:

(i) Appropriate personnel access to and use of the Hub (ii) Policy and procedures on the issue of image caching by agencies’ online systems.

(c) IIS recommends that AGD, in developing interagency templates, ensure they

(i) Include strong controls for ensuring that only authorised individuals, cleared to Protected or higher as needed, can gain access to the system and only be authorised to undertake activity that reflects their level of authorisation

(ii) Require the auditing of such access and provision of assurance about the appropriateness of access to biographic or biometric data to the holding agency.

6. Access to the Hub to identify individuals to be strictly controlled

(a) IIS supports the approach proposed by AGD and recommends that access to one-to-many matching be tightly controlled and limited to a few law enforcement agency uses (service delivery agencies should not have this access).

(b) IIS also supports AGD’s general approach of limiting and controlling access to the Hub based on assessed risks in matching processes.

2 Recommendations for Hub operation and governance

7. Proactive privacy management IIS recommends that AGD ensure that it has in place a privacy governance framework both to manage the Hub as it moves to BAU and when it is fully incorporated into BAU, which takes a broad view of privacy and commits to privacy best practice.

8. Benefits assessment to take account of privacy governance costs

(a) IIS recommends that in developing the methodology for identifying and costing benefits AGD and participating agencies should also bring into account all costs involved, including costs of privacy governance, such as:

(i) Participating agency compliance, and regular monitoring and audit costs

(ii) Resourcing of privacy regulators and other oversight bodies

(iii) Assistance to individuals and the community and complaint handling.

9. Project to be conducted transparently

(a) IIS recommends that AGD ensure that as soon as possible, and to the extent possible, information about the NFBMC and the Hub is in the public domain.

(b) IIS recognises AGD’s intention to circulate and publish this PIA and recommends that it be published as soon as practicable.

(c) IIS recommends that AGD design and implement a proactive and transparent community engagement approach to support the introduction of the Hub.

10. Transparency in Hub use and intergovernmental agreements

(a) IIS recommends that all of the interagency agreements between participating agencies authorising information sharing via the Hub should be included in a register.

(b) IIS also recommends that the register be available for public inspection or that the interagency agreements are otherwise published and that all this documentation be easily available from the one source.

11. NFBMC scope

IIS recommends that AGD’s documents and communications in relation to the NFBMC, including design specifications, undertakings and governance proposals, make clear the limits on the initial scope of the NFBMC.

It must be made clear that if any change occurs in either the number or type of participating agencies, in the nature of the biometric and/or biographic information transmitted, or the information held in the Hub, this would constitute a move beyond the initial scope and therefore trigger further privacy assessments.

12. The people’s voice in governance arrangements

IIS recommends that the membership of governance bodies with a role in monitoring the operations of the NFBMC or in making decisions about changes in its scope or operations include an independent representative able to present individuals’ perspectives.

13. Matters to be addressed in high-level intergovernmental agreement covering the NFBMC

(a) IIS recommends that the inter-governmental agreement that will set the framework for cross-jurisdictional sharing of biometric data via the Hub should:

(i) Ensure that privacy interests are appropriately represented on the body tasked with being accountable for the delivery and management of the Capability.

(ii) Require the receiving agencies to resource compliance audits by both themselves and the holding party or pay for independent audits to provide assurance to data holders

(iii) Require holding and receiving agencies to retain information that facilitates audits of the use of the Hub and regular systemic reviews of the system

(iv) Ensure resourcing for external oversight of the Hub by privacy regulators, Ombudsmen or anti-corruption bodies is commensurate with data flows and that there are no impediments to cooperation and information sharing between oversight bodies where information is shared between jurisdictions

(v) Require participating agencies to have in place well-resourced ‘safety net’ mechanisms to effectively support individuals who may be adversely affected by agencies’ use of the Hub and to respond efficiently and respectfully to any complaints.

14. AGD or Independent approval of agreements between participating agencies

(a) IIS recommends that the Interagency Agreements between participating agencies, together with the IGA that will authorise information sharing via the Hub, should be subject to approval by AGD or by another independent body such as the Australian Privacy Commissioner before use of the Hub can proceed. If a body such as the Privacy Commissioner has this role, it should receive dedicated resourcing for this function.

(b) IIS further recommends that AGD take steps to ensure that the number of agreements does not reach the point where the sheer number adversely impacts transparency and community understanding of the system as a whole. These steps could include, as AGD is contemplating, standard agreements for groups of participating agencies or specifying the requirements in legislation rather than agreements.

15. Regular systemic review of the Capability and associated information sharing arrangements

(a) IIS recommends that there is at least a three-yearly systemic review of privacy impacts around the sharing of facial biometric information by participating agencies through the Hub. The findings of the review should be made public to the extent possible. The review should:

(i) Include the activities of the Hub and the participating agencies at both individual agency level and holistically

(ii) Quantify the increase in the use of facial biometrics amongst those agencies with legal authority to use the system

(iii) Quantify actual benefits realisation

(iv) Assess the extent to which the Hub itself is affecting privacy outcomes, including because the system performs less well than expected or has been subject to any significant data security breaches

(v) Assess the efficacy of responses to citizen issues with data accuracy and use, including but not limited to experiences with complaint handling

(vi) Assess the extent of community knowledge of the system, community reactions and impacts on privacy viewed broadly

(vii) Assess the effectiveness of the governance arrangements, particularly in relation to decision-making, oversight and accountability

(viii) Assess if the relevant oversight bodies are resourced for the functions and report if they are able to cooperate effectively.

16. Governance of changes to the Hub and associated information flows

(a) IIS recommends AGD, the National Identity Security Coordination Group or the Ministerial Law Crime and Community Safety Council, develop a governance process that would be triggered by any proposals that represent a significant change in the scope or operation of the Hub.

The process should include:

(i) A broad consideration of costs as well as benefits

(ii) A commitment to a wide consultation process, including public consultations, to the extent possible

(iii) The inclusion of citizen perspectives beyond law, justice and national security agencies

Biometrics Hub

The national Minister for Justice has released the bland and egregiously narrow 47 page preliminary Privacy Impact Assessment (PIA) [PDF] for the National Facial Biometric Matching Capability, aka the system.

That PIA is discussed here. The Minister states -

This system will help government agencies combat identity crime, organised crime and terrorism. It enables law enforcement and selected government agencies to share and match photographs on identity documents such as passports to strengthen identity-checking processes, while maintaining strong privacy safeguards.

The release of this PIA coincides with yesterday's first anniversary of the Martin Place Siege. It marks a significant step in the implementation of the capability, which was one of the recommendations of the Martin Place Siege: Joint Commonwealth – New South Wales review. This review recommended greater use of biometrics to address vulnerabilities in current name-based identity checking arrangements that can enable people to use multiple identities when dealing with government agencies.

At last month's Law, Crime and Community Safety Council (LCCSC) meeting, Ministers noted the outcomes of the PIA and committed to progress the development of an intergovernmental agreement on state and territory participation in the system, in consultation with transport ministers, for signature in early 2016. This independent PIA supports the 'hub and spoke' design of the system, which enables agencies to share facial images from their existing holdings without creating a new centralised database.

The Minister goes on to state-

All the recommendations made in the PIA report have been accepted in part or full. Some of these recommendations go to issues of broader national information sharing that are being progressed with the states and territories via the LCCSC.

The preliminary assessment is the just the first of a series of PIAs that will be conducted throughout the design and implementation of the system, which is expected to commence initial operation in mid-2016.

In September this year the Minister announced

the Australian Government's investment of $18.5 million to develop a National Facial Biometric Matching Capability.

This system is designed to complement the existing Document Verification Service (DVS) to help combat identity crime.

This system will facilitate the secure, automated and auditable sharing and matching of facial images between participating government agencies which have a lawful basis to collect and use facial images. It is being built around a central hub that acts as a router to enable agencies to exchange information on a 'query and response' basis.

The hub is not a centralised database, it will not conduct any matching and it will not store any personal information. Participating agencies will also be subject to audits and independent oversight by a range of external bodies.

Directors' Duties and the DIN

'The Origins of Company Directors’ Statutory Duty of Care' by Rosemary Langford, Ian Ramsay and Michelle Welsh in (2015) 37(4) Sydney Law Review 489-518 investigates

 the origins of company directors’ statutory duty of care. The findings of their archival research include that, contrary to what is said in some court judgments and corporate law commentaries, the first statutory duty of care in Australia, and arguably the common law world, was introduced in the State of Victoria in the Companies Act 1896 (Vic). A later version of the duty, in the Companies Act 1958 (Vic), introduced public enforcement of the duty. Although the implications of this development may not have been appreciated by those participating in the debates regarding the introduction of the 1958 Act, the authors show, through discussion of recent cases involving the statutory duty of care, how the Australian Securities and Investments Commission (ASIC) is now influencing governance standards in Australian boardrooms through the litigation it commences. ASIC is not only an active plaintiff in cases based on the statutory duty of care — using it more than private plaintiffs — but it also typically pursues a public interest agenda in these cases in terms of the remedies it seeks against defendant directors.

The Senate Economics References Committee report 'I just want to be paid': Insolvency in the Australian construction industry endorses the Director Identification Number (DIN) discussed in the Productivity Commission report noted earlier this month.

The Committee states

 To register a company a person must lodge an application with ASIC. Under section 117(2) of the Corporations Act, the application must include the name and address of each director of the company. However, little is done to verify that information and consequently there is a lack of transparency surrounding the identity of company directors. The inability of regulators and participants in the building and construction industry to identify and track individuals suspected of illegal activity is a significant cause of the incidence of illegal phoenix activity. A lack of transparency around company directors means that regulators are slower in clamping down on illegal phoenix operators and therefore more innocent participants are caught up in schemes, suffering significant economic and social effects.

The committee's report includes two recommendations in relation to Director Identification Numbers (DIN) -

Recommendation 36 

The committee recommends that section 117 of the Corporations Act 2001 (Cth) be amended to require that, at the time of company registration, directors must also provide a Director Identification Number. 

Recommendation 37 

The committee recommends that a Director Identification Number should be obtained from ASIC after an individual proves their identity in line with the National Identity Proofing Guidelines. 

Open Data and Consent

With Australia's newfound enthusiasm for the Open Government Partnership it is interesting to see 'Open Data, Privacy, and Fair Information Principles: Towards a Balancing Framework' by Frederik J. Zuiderveen Borgesius, Mireille Van Eechoud and Jonathan Gray in Berkeley Technology Law Journal (Forthcoming) comments

Open data are held to contribute to a wide variety of social and political goals, including strengthening transparency, public participation and democratic accountability, promoting economic growth and innovation, and enabling greater public sector efficiency and cost savings. However, releasing government data that contain personal information may threaten privacy and related rights and interests. In this paper we ask how these privacy interests can be respected, without unduly hampering benefits from disclosing public sector information. We propose a balancing framework to help public authorities address this question in different contexts. The framework takes into account different levels of privacy risks for different types of data. It also separates decisions about access and re-use, and highlights a range of different disclosure routes. A circumstance catalogue lists factors that might be considered when assessing whether, under which conditions, and how a dataset can be released. While open data remains an important route for the publication of government information, we conclude that it is not the only route, and there must be clear and robust public interest arguments in order to justify the disclosure of personal information as open data.

The enthusiasm doesn't go as far as a statement that the Government will walk away from its commitment to abolish the Office of the Australian Information Commission and will abandon the Hawke Report about winding back the FOI regime.

'Informed Consent: We Can Do Better to Defend Privacy' by Frederik Zuiderveen Borgesius in (2015) 13(2) IEEE 103-107 comments

We need to rethink our approach to defend privacy on the internet. Currently, policymakers focus heavily on the idea of informed consent as a means to defend privacy. For instance, in many countries the law requires firms to obtain an individual’s consent before they use data about her; with such informed consent requirements, the law aims to empower people to make privacy choices in their best interests. But behavioural studies cast doubt on this approach’s effectiveness, as people tend to click OK to almost any request they see on their screens. To improve privacy protection, this article argues for a combined approach of protecting and empowering the individual. 

This article, based on the author’s PhD thesis, discusses practical problems with informed consent as a means to protect privacy, and illustrates the problems with current data privacy rules regarding behavioural targeting. First, the privacy problems of behavioural targeting, and the central role of informed consent in privacy law are discussed. Following that, practical problems with informed consent are highlighted. Then, the article argues that policymakers should give more attention to rules that protect, rather than empower, people.