Health Data Sharing

Share, but respectfully and with conditions. That's one conclusion from 'Patients’ and public views and attitudes towards the sharing of health data for research: a narrative review of the empirical evidence' by Shona Kalkman, Johannes van Delden, Amitava Banerjee, Benoît Tyl, Menno Mostert and Ghislaine van Thiel in (2021) 48(1) Journal of Medical Ethics, abstracted as 

Introduction International sharing of health data opens the door to the study of the so-called ‘Big Data’, which holds great promise for improving patient-centred care. Failure of recent data sharing initiatives indicates an urgent need to invest in societal trust in researchers and institutions. Key to an informed understanding of such a ‘social license’ is identifying the views patients and the public may hold with regard to data sharing for health research.  We performed a narrative review of the empirical evidence addressing patients’ and public views and attitudes towards the use of health data for research purposes. The literature databases PubMed (MEDLINE), Embase, Scopus and Google Scholar were searched in April 2019 to identify relevant publications. Patients’ and public attitudes were extracted from selected references and thematically categorised. Twenty-seven papers were included for review, including both qualitative and quantitative studies and systematic reviews. Results suggest widespread—though conditional—support among patients and the public for data sharing for health research. Despite the fact that participants recognise actual or potential benefits of data research, they expressed concerns about breaches of confidentiality and potential abuses of the data. Studies showed agreement on the following conditions: value, privacy, risk minimisation, data security, transparency, control, information, trust, responsibility and accountability. Our results indicate that a social license for data-intensive health research cannot simply be presumed. To strengthen the social license, identified conditions ought to be operationalised in a governance framework that incorporates the diverse patient and public values, needs and interests.

 The authors argue 

Large-scale, international data sharing opens the door to the study of so-called ‘Big Data’, which holds great promise for improving patient-centred care. Big Data health research is envisioned to take precision medicine to the next level through increased understanding of disease aetiology and phenotypes, treatment effects, disease management and healthcare expenditure.  However, lack of public trust is proven to be detrimental to the goals of data sharing. The case of care.data in the UK offers a blatant example of a data sharing initiative gone awry. Criticism predominantly focused on limited public awareness and lack of clarity on the goals of the programme and ways to opt out. Citizens are becoming increasingly aware and critical of data privacy issues, and this warrants renewed investments to maintain public trust in data-intensive health research. Here, we use the term data-intensive health research to refer to a practice of grand-scale capture, (re)use and/or linkage of a wide variety of health-related data on individuals. 

Within the European Union (EU), the recently adopted General Data Protection Regulation (GDPR) (EU 2016/679) addresses some of the concerns the public may have with respect to privacy and data protection. One of the primary goals of the GDPR is to give individuals control over their personal data, most notably through consent. Other lawful grounds for the processing of personal data are listed, but it is unclear how these would exactly apply to scientific research. Legal norms remain open to interpretation and thus offer limited guidance to researchers. In Recital 33, the GDPR actually mentions that additional ethical standards are necessary for the processing of personal data for scientific research. This indicates a recognised need for entities undertaking activities likely to incite public unease to go beyond compliance with legal requirements. Complementary ethical governance then becomes a prerequisite for securing public trust in data-intensive health research. 

A concept that could be of use in developing ethical governance is that of a ‘social license to operate’. The social license captures the notion of a mandate granted by society to certain occupational groups to determine for themselves what constitutes proper conduct, under the condition that such conduct is in line with society’s expectations. The term ‘social license’ was first used in the 1950s by American sociologist Everett Hughes to address relations between professional occupations and society. The concept has been used since to frame, for example, corporate social responsibility in the mining industry, governance of medical research in general and of data-intensive health research more specifically. As such, adequate ethical governance then becomes a precondition for obtaining a social license for data sharing activities. 

Key to an informed understanding of the social license is identifying the expectations society may hold with regard to sharing of and access to health data. Here, relevant societal actors are the subjects of Big Data health research, constituting both patients and the general public. Identification of patients’ and public views and attitudes allows for a better understanding of the elements of a socially sanctioned governance framework. We know of the existence of research papers that have captured these views using quantitative or qualitative methods or a combination of both. So far, systematic reviews of the literature have limited their scope to citizens of specific countries, qualitative studies only or the sharing of genomic data. Therefore, we performed an up-to-date narrative review of both quantitative and qualitative studies to explore predominant patient and public views and attitudes towards data sharing for health research.

In discussing Conditions for sharing the authors comment 

Widespread willingness to share data for health research very rarely led to participants’ unconditional support. Studies showed agreement on the following conditions for responsible data sharing: value, privacy, minimising risks, data security, transparency, control, information, trust, responsibility and accountability. 

Value 

One systematic review found that participants found it important that the research as a result of data sharing should be in the public’s interest and should reflect participants’ values.  The NICE Citizens Council advocated for appropriate systems and good working practices to ensure a consistent approach to research planning, data capture and analysis. 

Privacy, risks and data security 

The need to protect individuals’ privacy was considered paramount and participants often viewed deidentification of personal data as a top privacy measure. One survey among US patients with cancer found that only 20% (n=228) of participants found linkage of individuals with their deidentified data acceptable for return of individual health results and to support further research. Secured access to databases was considered an important measure to ensure data security in data sharing activities. A systematic review of participants’ attitudes towards data sharing showed that people established risk minimisation as another condition for data sharing. Findings by Mazor et al suggest that patients only support studies that offer value and minimise security risks. 

Transparency and control 

Conditions regarding transparency were information about how data will be shared and with whom, the type of research that is to be performed, by whom the research will be performed, information on data sharing and monitoring policies and database governance, conditions framing access to data and data access agreements, and any partnerships with the pharmaceutical industry. More generally, participants expressed the desire to be involved in the data sharing process, to be notified when their data are (re)used and to be informed of the results of studies using their data. Spencer et al identified use of an electronic interface as a highly valued means to enable greater control over consent choices. When asked about the use of personal data for health research by the NHS, UK citizens were typically willing to accept models of consent other than the ones they would prefer. Acceptance of consent models with lower levels of individual control was found to be dependent on a number of factors, including adequate transparency, control over detrimental use and commercialisation, and the ability to object, particularly to any processing considered to be inappropriate or particularly sensitive. 

Information and trust 

One systematic review identified trust in the ability of the original institution to carry out the oversight tasks as a major condition for responsible data sharing. Appropriate education and information about data sharing was thought to include public campaigns to inform stakeholders about Big Data and information communicated at open days of research institutions (such as NICE) to ensure people understand what their data are being used for and to reassure them that personal data will not be passed on or sold to other organisations. The informed consent process for study participation was believed to include information about the fact that individuals’ data could potentially be shared, the objectives of data sharing and (biobank) research, the study’s data sharing plans, governance structure, logistics and accountability. 

Responsibility and accountability 

Participants often placed the responsibility for data sharing practices on the shoulders of researchers. Secondary use of data collected earlier for scientific research was viewed to require a data access committee that involves a researcher from the original research project, a clinician, patient representative and a participant in the original study.  Researchers of the original study were required to monitor data used by other researchers. In terms of accountability, patient and public groups in Italy (n=280) placed high value on sanctions for misuse of data. Information on penalties or other consequences of a breach of protection or misuse was considered important by many. Discussion In this study, we narratively reviewed 27 papers on patients’ and public views on and attitudes towards the use of health data for scientific research. Studies reported a widespread—though conditional—support for the linkage and sharing of data for health research. The only outlier seems to be the finding that just over half (n=25) of the NICE Citizens Council answered ‘no’ to the question whether they had any concerns if NICE used anonymised data to fill in the gaps if NICE was not getting enough evidence in ‘the usual ways’. However, we hasten to point out that the question about willingness to share is different from the question whether people have concerns or not. In addition, after a 2-day discussion meeting Council members were perhaps more sensitised to the potential concerns regarding data sharing. Therefore, we suggest that the way and context within which questions are phrased may influence the answers people give. 

Overall, people expressed similar motivations to share their data, perceived similar benefits (despite some variation between patients and citizens), yet at the same time displayed a range of concerns, predominantly relating to confidentiality and data security, awareness about access and control, and potential harms resulting from these risks. Both patient and public participants conveyed that certain factors would increase or reduce their willingness to have their data shared. For example, the presence of privacy-protecting measures (eg, data deidentification and the use of secured databases) seemed to increase willingness to share, as well as transparency and information about data sharing processes and responsibilities. The identified views and attitudes appeared to come together in the conditions stipulated by participants: value, privacy and confidentiality, minimising risks, data security, transparency, control, information, trust, responsibility and accountability. 

In our Introduction, we mentioned that identifying patients’ and public views and attitudes allows for a better understanding of the elements of a socially sanctioned governance framework. In other words, what work should our governance framework be doing in order to obtain a social license? This review urges researchers and institutions to address people’s diverse concerns and to make an effort to meet the conditions identified. Without these conditions, institutions lack trustworthiness, which is vital for the proceedings of medicine and biomedical science. As such, a social license is not a ‘nice to have’ but a ‘need to have’. Our results also confirm that patients and the public indeed care about more than legal compliance alone, and wish to be engaged through information, transparency and control. This work supports the findings of a recent systematic review into ethical principles of data sharing as specified in various international ethical guidelines and literature.  What this body of research implies is considerable diversity of values and beliefs both between and within countries.   

The goal of this narrative review was to identify the most internationally dominant, aggregated patient and public views about the broad topic of data sharing for health research. We deliberately opted for the methodology of a narrative review rather than a systematic review. Most narrative reviews deal with a broad range of issues to a given topic rather than addressing a particular topic in depth.  This means narrative reviews may be most useful for obtaining a broad perspective on a topic, and that they often are less useful in generating quantitative answers to specific clinical questions. However, because narrative reviews do not require specification of the search and selection strategy and the way of critically appraising literature can be variable, the connection between evidence generated by narrative reviews and (clinical) recommendations is less rigorous and risk of bias exists. This is something to take into account in this study. A risk of bias assessment was not possible due to the heterogeneity of the findings. We acknowledge that our methodological choices may have affected the discriminative power or granularity of our findings. For example, there is a difference between sharing of routinely collected health data versus secondary use of health data collected for research purposes. And we can only make loose assumptions about potential differences between patient and public views. 

In addition, we should mention that this work is centred around studies conducted in Western countries as the whole Big Data space and literature is dominated by Western countries, higher socioeconomic status and Caucasians. However, most of the disease burden globally and within countries is most probably not represented in the ‘Big Data’ and so we have to stress the lack of generalisability to large parts of the world. 

Nevertheless, we believe our findings point towards essential elements of a governance framework for data sharing for health research purposes. If we are to conclude that the identified conditions ought to act as the pillars of a governance framework, the next step is to identify how these conditions could be practically operationalised. For example, if people value information, transparency and control, what type of consent is most likely to valorise these conditions? And what policy for returning research results would be desirable? Once we know what to value, we can start thinking about the ways to acknowledge that value. A new challenge arising here, however, is what to do when people hold different or even conflicting values or preferences. Discrete choice experiments could help to test people’s preferences regarding specific topics, such as preferred modes of informed consent. Apart from empirical work, conceptual analysis is needed to clarify how public trust, trustworthiness of institutions and accountability are interconnected.

Fake COVID Certs

Another instance of fake vax certificates in Mr David Brownbill v O&M Pty Ltd [2021] FWC 6635, with the Fair Work Commission noting that on 8 December Brownbill made an application to the Commission under section 526 of the Fair Work Act 2009 (Cth) alleging he had been unlawfully stood down from employment with O&M Pty Ltd. 

The hearing was via Microsoft teams. O&M raised the question of Brownbill’s COVID-19 vaccination status, arguing that Brownbill was a casual employee, Brownbill had not been stood down and that as result of a Direction of the state's Acting Chief Health Officerit could not place its employees on a certain client site unless they had proof of vaccination or a first vaccination dose or had a booking to receive a first vaccination dose. O&M asserted that Brownbill had not supplied the requisite proof; accordingly it was unable to use his services from 14 October 2021. 

[3] During the conference, it was asserted by Mr Brownbill that he had supplied proof of having been vaccinated to the Company on 22 November 2021. The Company held some concerns about the vaccination certificate produced by Mr Brownbill. I requested a copy of the email Mr Brownbill had sent to the Company on 22 November 2021. It was provided. 

[4] The email dated 22 November 2021 contained within it the following hyperlink: [omitted here] 

[5] Having clicked on the hyperlink, it appeared to me that the means by which the vaccination certificate had been procured by Mr Brownbill may have been fraudulent and that the certificate he produced may be a fraud. 

[6] I expressed this view to the parties. 

[7] If the vaccination certificate is a fraud and has been fraudulently obtained via an illegitimate hyperlink on the internet, this would be a matter of extremely serious public policy concern. I invite the relevant public authorities to investigate further. 

[8] During a further exchange with Mr Brownbill about a separation certificate he says he was sent to him by the Company, he terminated his involvement in the conference by stating: “[expletive], I’m not wasting any more time with you corrupt idiots.” 

Brownbill left the conference.  

[9] From this, I have taken Mr Brownbill to have discontinued his application pursuant to Rule 10(2)(c) of the Fair Work Commission Rules 2013. The Commission’s file will now be closed.

The 'gimme a fake vax cert' site states "Welcome to the Medicare vaccine pass generator. Please input the data needed to make the pass here", with users needing to input their name and date of birth and fake vaccination details, alongside guidance (“Make sure your dose dates add up. Remember, 12 weeks between AZ and 5 (give or take 1) between Pfizer") about how to make the fake certificate appear more authentic.

'COVID-19 Vaccination Certificates in the Darkweb: A Preprint' by Dimitrios Georgoulias, Jens Myrup Pedersen, Morten Falch and Emmanouil Vasilomanolakis comments 

COVID-19 vaccines have been rolled out in many countries and with them a number of vaccination certificates. For instance, the EU is utilizing a digital certificate in the form of a QR-code that is digitally signed and can be easily validated throughout all EU countries. In this paper, we investigate the current state of the COVID-19 vaccination certificate market in the darkweb with a focus on the EU Digital Green Certificate (DGC). We investigate 17 marketplaces and 10 vendor shops, that include vaccination certificates in their listings. Our results suggest that a multitude of sellers in both types of platforms are advertising selling capabilities. According to their claims, it is possible to buy fake vaccination certificates issued in most countries worldwide. We demonstrate some examples of such sellers, including how they advertise their capabilities, and the methods they claim to be using to provide their services. We highlight two particular cases of vendor shops, with one of them showing an elevated degree of professionalism, showcasing forged valid certificates, the validity of which we verify using two different national mobile COVID-19 applications. 

The darkweb has been actively serving as a platform where cybercriminals can carry out their operations, since the founding of the Farmer’s Market (2010) (18) and Silk Road (2011) (4). Both of these marketplaces, operated via Tor hidden services, which is still the most popular anonymization network to this day. While these marketplaces started off with a heavy focus on drugs, though the years such platforms have evolved, providing a large variety of products and services (e.g. firearms, botnet services, malware, stolen bank credentials). The COVID-19 pandemic has had a great impact on millions of people around the globe, affecting many different aspects of their lives. In order to reverse the worldwide disruption that the virus has caused, vaccines were developed, aiming towards protecting the population and halting the spread of the virus. 

Trading platforms on the darkweb were very quick to take advantage of the pandemic situation. Vendors started offering vaccines on several marketplaces, or on their own independent vendor shops (2). After the vaccine development, the next step was monitoring the vaccination status of the population, which was achieved through the issuance of vaccination certificates, in physical or digital form. In several countries, not being vaccinated is bound to cause implications in people’s social and work life, often excluding them from some activities, and making daily tasks harder to carry out. For example, the non-vaccinated population needs COVID tests frequently, might be denied indoor access to restaurants, or have challenges while traveling. Since vaccinations can play such an important role in certain countries, a new market has emerged on the darkweb. Marketplaces and vendor shops are currently offering both physical and digital certificates, from a variety of countries, or fake PCR test results as an alternative, with non-vaccinated people as the target client group. Individuals that do not wish to be vaccinated, but want the convenience of owning a vaccination certificate, can visit the darkweb and purchase one on a number of different platforms. 

In this paper, we focus on the COVID-19 vaccination certificate darkweb market, with an emphasis on the EU Digital Green Certificate (DGC). We investigate 17 marketplaces and 10 vendor shops that list physical or digital proofs of vaccination as available products, with the purpose of documenting the different aspects that compose this specific type of illegal trading. This includes elements such as countries of origin, countries that the certificate is valid in, shipping, means of communication with the vendors, as well as how these items find their way to the sellers. We then demonstrate examples of such sellers and emphasize on two interesting cases in which the vendors provide valid EU digital certificates as proof of their service’s legitimacy. Notably, one of the shops presents a very high degree of professionalism. We confirm the validity of these certificates, and examine their details. 

The remainder of this paper is structured as follows. In Section 2, we give an overview of the methods used to carry out our research for the purposes of this paper. Section 3 provides background information on the issuance and the verification of vaccination certificates, and discusses the related work. In Section 4, we dive into the mapping of the certificate market of the darkweb. Section 5 is dedicated to investigating the legitimacy of the listings we found. Lastly, Section 6 concludes this paper.

Copyright Reform

Just in time for Christmas (amid a tsunami of other consultations) the government has released a discussion paper on the Exposure Draft Copyright Amendment (Access Reform) Bill 2021 and on the Review of Technological Protection Measures Exceptions. Submissions are due 11 February. 

The discussion paper indicates that the Exposure Draft of the Copyright Amendment (Access Reform) Bill 

 aims to simplify and update provisions of the Copyright Act 1968 (the Act) to better support the needs of Australians accessing content in the digital environment. The Bill builds on the Copyright Amendment (Disability Access and Other Measures) Act 2017 and the Copyright Amendment (Service Providers) Act 2018 by providing reasonable and practical measures that reflect contemporary use of copyright material in the public interest, while maintaining appropriate protections and incentives for content creators. The Government has released the Bill, and this discussion paper, so that interested individuals and organisations can have their say on these proposed reforms. The Government is also conducting a review of the technological protection measure (TPM) exceptions in section 40 of the Copyright Regulations 2017

It states that the Australian copyright framework

has been subject to extensive review over recent years. These reviews have assessed how copyright is adapting to the modern challenges of evolving technology, changing consumer usage patterns and broader global trends. They have consistently highlighted the need for a more flexible and adaptive framework to facilitate access to, and dissemination of, creative content in the digital environment. Copyright law is essential in incentivising creators and their industries to produce Australian content and receive payment for their creativity. At the same time, allowing reasonable access to that creative content is critical to enhance learning and Australian culture, and driving new creativity and innovation. The Act seeks to balance the rights of copyright owners to manage and protect their content with the public interest to access that content. It is also important that the Act gives creators, copyright owners and users certainty about the scope of rights and the permissible use of copyright material. A key issue is how to introduce more flexibility in the Act to allow clear and reasonable access to content in the public interest in an increasingly digital world, while maintaining appropriate safeguards to protect copyright owners’ commercial interests.

The Productivity Commission’s 2016 Intellectual Property Arrangements inquiry and Australian Law Reform Commission’s 2013 Copyright and the Digital Economy inquiry recommended adopting a broad ‘fair use’ copyright exception to replace Australia’s narrower, purpose-based ‘fair dealing’ exceptions and some other specific exceptions. 

A ‘fair use’ system (such as in the United States) is a principles-based system that allows the use of copyright material if it is ‘fair’. By contrast, a ‘fair dealing’ exception regime allows the use of copyright material for certain purposes specified in the legislation. Proponents of fair use argue that it is a more flexible legal tool, capable of accommodating new and valuable fair uses of copyright material without waiting for legislative change. The PC inquiry overlapped with copyright reforms that were already being developed by the Government. These reforms resulted in the Copyright Amendment (Disability Access and Other Measures) Act 2017 that improved the workability of the Act for the disability, library and archives, and education sectors and included:

• technology neutral exceptions that facilitate access to copyright material for people with a disability, on par with the general community • updated preservation provisions for libraries and archives and other key cultural institutions • new standard terms of copyright protection for works, sound recordings and films, including unpublished material, and • streamlined education statutory licence.

The Government response to the PC inquiry flagged that further consultation was necessary for certain recommendations given the complexity of the issues and different approaches available to address them. The Government’s subsequent Copyright modernisation consultations held in 2018 sought views on flexible copyright exceptions such as fair use and extended fair dealing exceptions; access to ‘orphan works’ (where the copyright owner cannot be found); and ‘contracting out’ of exceptions. ... 

The Copyright modernisation consultations highlighted that there is no clear case to move to a broad, principles based ‘fair use’ system. Stakeholders’ views remained polarised, and the evidence base for broader reform was not clear. A change to fair use would represent a significant departure from Australia’s current copyright system of fair dealing and specific exceptions. It would risk introducing ambiguity or uncertainty, which may be difficult and costly to resolve, and in some cases lead to litigation or people simply abandoning use of creative content. While there is no uniform international approach, the large majority of countries rely on copyright frameworks that include exceptions similar to Australia, rather than fair use. 

The Government has chosen, at this time, to undertake more specific, targeted reforms to the existing exceptions framework. This framework recognises that certain reasonable uses of copyright material in the public interest should be permitted without the consent of, or payment of money to, the copyright owner. ... incremental reform to this existing exceptions framework would avoid significant disruption to copyright owners’ commercial markets that sweeping reforms may cause. 

Shift in the digital landscape 

In recent years, the digital landscape has changed significantly with the rise of multinational digital platforms, driven by user-generated content. The Australian Competition and Consumer Commission’s 2019 Digital Platforms Inquiry final report reinforced copyright owners’ concerns that broad flexible exceptions could potentially result in content being exploited by digital platforms for commercial gain. At the same time, the access issues identified by the Government’s Copyright modernisation consultations, the PC inquiry and the ALRC inquiry remained. This COVID-19 pandemic has further highlighted these access issues, with the need for an urgent transition to widespread online and remote learning, and many public institutions having to move their services online. ... 

The reforms in the Bill target those sectors that serve important public interests, including the cultural, education, research and government sectors. It will make sure that they can provide their services effectively and efficiently in an increasingly digital environment and, in doing so, enhance access to the wider community. Recognising too the importance of copyright law in incentivising creators and their industries to produce Australian content and receive payment for their creativity, these reforms have been designed in a way to minimise the commercial impacts on copyright owners. For the most part, the reforms relate to non commercial use of copyright material or use that has a limited impact on the commercial market for the material. 

Open up access to ‘orphaned’ material 

Orphan works (copyright material where the copyright owner cannot be found), can be of great cultural, social or educational value but are generally underused. Many copyright owners cannot be identified or contacted to permit the use of material, even after time consuming and costly searches. This is a significant issue for Australia’s cultural institutions, as they hold huge amounts of orphaned material in their collections. There is a reluctance to use or allow others to access orphan works as there remains a risk the copyright owner could emerge and claim compensation for use of the material, or object to its use altogether. This could result in any new material that uses the orphan work being destroyed, withdrawn or modified at significant expense. 

Reduce time, costs and uncertainty of quotation for academics and researchers 

Seeking clearances of quotes of copyright material in publications and presentations, particularly when multiple copyright owners are involved, can represent a significant and disproportionate time and cost burden for academics, universities, libraries and archives and researchers. This can sometimes result in academics and researchers abandoning the use of material or risking using unlicensed material in their works. 

More certainty and efficiencies for cultural, education and government sectors 

The current copyright exceptions available to cultural and educational institutions, and the government statutory licensing scheme, originated in a paper-based era. Many provisions are outdated, narrow and overly prescriptive. This creates uncertainty and exposes our public sectors to a higher risk of legal liability, and imposes significant administrative burden. Many of the reforms aim to provide reasonable and practical measures to allow the use of copyright material fit for a contemporary digital-based society, and improve efficiencies.

The paper features the following questions - 

Q 1.1: Orphan works: Application to Copyright Tribunal to fix reasonable terms 

Part 11, Division 3 of the Copyright Regulations 2017 sets out the matters to be included in particular kinds of applications and references to the Copyright Tribunal. What matters do you consider should be included in an application to the Tribunal to fix reasonable terms for ongoing use of a former orphan work? 

Q 2.1: Quotation: Unpublished material 

Should the proposed new quotation fair dealing exception in section 113FA extend to the quotation of unpublished material or categories of unpublished material? 

Q 3.1: Libraries and archives: Online access - ‘Reasonable steps’ 

For the purposes of new paragraph 113KC(1)(b), what measures do you consider should be undertaken by a library or an archives to seek to limit wider access to copyright material when made available online? 

Q 3.2: Libraries and archives: Illustrations 

Does proposed new section 113KK, which replaces and simplifies current section 53 but is not intended to make any substantive changes to that section, adequately cover all of the matters set out in current section 53 or are there some potential gaps in coverage? 

Q 4.1: Education: Online access – ‘Reasonable steps’ 

For the purposes of new paragraph 113MA(2)(d), what measures do you consider should be undertaken by an educational institution to seek to limit access to copyright material, when made available online in the course of a lesson, to persons taking part in giving or receiving of the lesson, and ensure it is used only for the purposes of the lesson? 

Q 5.1: Government: Use of incoming material Does proposed new section 183G contain effective safeguards to avoid unwarranted harm to copyright owners’ commercial markets? If not, what other safeguards would assist?

The consultation paper refers to 'Additional minor measures' - 

Sch 6: Registrar of the Copyright Tribunal 

The Bill will simplify the process for appointing the Registrar of the Copyright Tribunal. These amendments will align the Act with current practices for the appointment of other Australian court registrars by giving the power to the Chief Executive Officer and Principal Registrar of the Federal Court to appoint, or terminate the appointment of, the Registrar of the Copyright Tribunal. 

Sch 7: Streamline the process for making technological protection measure (TPM) exceptions 

The Bill will streamline the process for making regulations to create or amend exceptions to liability for circumventing a TPM that controls access to copyright material. The amendment removes the requirement that a ‘submission’ must be made before the Minister can recommend changes to the regulations. Allowing regulations to be made in relation to access control TPM exceptions, where changes are consequential to amendments to the Act or otherwise identified in a review or proceeding, without first obtaining a specific stakeholder submission seeking this, will improve Australia’s ability to maintain a copyright framework that is fit for the digital environment. More information about TPM exceptions, and the current review of the exceptions listed in the Copyright Regulations 2017, can be found at Part B. 

Schedule 8: Archives The Bill will update the definition of ‘archives’ to capture current Commonwealth and State archives offices in the Act. 

Schedule 9: Referrals to the Copyright Tribunal 

The Bill will improve the consistency of language in the Act when referring to applications and references to the Copyright Tribunal. 

Schedule 10: Notifiable instruments 

The Bill will update the mode of notification required by the Act, changing outdated references to ‘Gazette’ publication to ‘notifiable instrument’.  

The paper also covers  the Review of Technological Protection Measures (TPM) exceptions, commenting

The Australia-United States Free Trade Agreement (AUSFTA) requires a review of exceptions to the TPM provisions made under the Copyright Act 1968 (the Act) every four years. The last TPM exceptions review occurred in August 2017. Consultation on this Bill provides an opportunity to consider whether existing TPM exceptions should remain and whether any new TPM exceptions should be added to section 40 the Copyright Regulations 2017 (Copyright Regulations). This includes any consequential amendments because of measures proposed in the Bill. All new TPM exceptions, including those that are consequential to the amendments proposed in the Bill, are subject to the criteria for review as set out in subsection 249(4) of the Act (and discussed further below). 

Current TPM scheme 

Technological protection measures (TPMs) are technical locks that copyright owners, and exclusive licensees, use to stop their material being accessed or copied. For example, passwords, encryption software and access codes. TPMs can be grouped into two broad categories: • Access control TPMs that prevent a person from being able to read, listen to or watch material. • Copy control TPMs that allow a person to read, listen or watch material but prevent a person from making a copy of the material. Australia’s TPM scheme allows for both civil actions and criminal actions in response to unlicensed circumvention of TPMs (see Part V of the Act: Division 2, Subdivision A, and Division 5, Subdivision E). 

Specific exclusions 

The scheme specifically excludes protection for TPMs that: 

• control geographic market segmentation: o For example, consumers can bypass region coding measures to play overseas purchased DVDs or computer programs on Australian devices. 

• restrict use of after-market goods or services, including restricting the supply of spare parts or repair or maintenance services by third parties: o For example, a computer printer manufacturer cannot use the TPM scheme to stop generic cartridges being used in its printers. o TPMs used by the providers of computer systems to restrict services being provided by competing computer system maintenance providers are also not protected. 

Exceptions to override access control TPMs 

The Act provides for a number of exceptions to civil and criminal liability for circumventing an access control TPM. This includes:

• specific exceptions in subsections 116AN(2)–(8) and 132APC(2)–(8) of the Act. These exceptions are not subject to this review, and 

• additional exceptions for acts which are prescribed by the regulations (see subsections 116AN(9)(c) and 132APC(9)(c)).

These provisions implement Article 17.4.7(e)(viii) of AUSFTA. The current additional exceptions are set out in section 40 of the Copyright Regulations, and are the subject of this review. 

This review covers both existing exceptions to access control TPMs as set out in section 40 of the Copyright Regulations, as well as possible new TPM exceptions to add to the Regulations. Currently, section 249 of the Act allows the making of new regulations in relation to TPM exceptions, and regulations varying or revoking existing regulations, on the recommendation of the Minister. Subsection 249(4) of the Act allows an additional act to be prescribed by the regulations when a submission for is received which provides credible evidence of certain criteria, and the Minister makes a decision to grant an exception. Under subsection 249(8) of the Act existing additional prescribed acts can be revoked or varied through a similar process.

The paper accordingly invites submissions on: 

• the appropriateness of the current TPM exceptions listed in section 40 of the Copyright Regulations, 

• potential consequential amendments to section 40 of the Regulations due to the Bill. 

Submissions should: 

1. Identify whether you are seeking a new exception, or to vary or revoke an existing exception. 

2. If seeking the variation or revocation of an existing exception, identify the existing exception. 

3. If a new exception is sought, clearly outline the exception and the circumstances in which it would apply. 

4. Address how the exception does or does not fit the criteria of subsections 249(4) and/or (8) of the Act.

Submissions should provide examples to support whether or not (as relevant): 

• the use of the TPM has had an adverse impact on the non-infringing use by the person or body the subject of the exception, or is likely to have such an impact, or 

 

• the TPM exception would impair the adequacy of legal protection or the effectiveness of legal remedies against the circumvention of the TPM.

Elections and Social Media

The First Interim Report of the Senate Select Committee on Foreign Interference Through Social Media, which quotes my submission, features the following recommendations: 

R 1  The committee recommends that the Australian Government clearly delegate lead accountability for cyber-enabled foreign interference to a single entity in government. 

R 2  The committee recommends that the Australian Government take a proactive approach to protecting groups that are common targets of foreign interference but are not classified as government institutions. 

R 3  The committee recommends that the Australian Government establish appropriate, transparent, and non-political institutional mechanisms for publicly communicating cyber-enabled foreign interference in our elections and review the processes and protocols for classified briefings for the Opposition during caretaker with respect to cyber-enabled foreign interference. 

R 4  The committee recommends that the Australian Communications and Media Authority's report into the functioning of the Australian Code of Practice on Disinformation and Misinformation be publicly released as a matter of priority. 

R 5  The committee recommends that the Australian Government publicly release the Electoral Integrity Assurance Taskforce's terms of reference. 

R 6  The committee recommends that the Australian Government establish clear requirements and pathways for social media platforms to report suspected foreign interference, including disinformation and coordinated inauthentic behaviour, and other offensive and harmful content, and formalise agency remits, powers and resourcing arrangements accordingly. 

R 7  The committee recommends that the Election Integrity Assurance Taskforce undertake an audit to assess capability relevant to detecting disinformation prior to the coming election and, further, that the Australian Government consider providing information about relevant capabilities and resourcing to this committee as appropriate to assist in our deliberations.

WHO

'The Intellectual Property Turn in Global Health: From a Property to a Human Rights View of Health' by Laura G. Pedraza-Fariña in (2021) 36 Osiris comments 

 International intellectual property (IP) law for pharmaceuticals has fundamentally shifted in the twenty-first century from a property-centric to a human rights view. Scholars tend to explain this transformation in the context of both the power struggle between developing and developed countries, and the influence of a social movement that criticized IP rights as hindering access to essential medicines. Yet, these explanations leave out the central role of two international organizations, the World Trade Organization (WTO) and the World Health Organization (WHO), and particularly their permanent staffs, whose boundary disputes have shaped international IP law at the intersection of trade and global health. Bringing into conversation historical and legal literatures on global health and IP, this article traces how a human rights perspective on IP emerged as a strategy to reconcile the WHO staff’s sociomedical views of health with an increasingly dominant set of global IP rules. It shows how the WHO staff used the language of economics—an analytical frame favored by the WTO—to advance a then unorthodox economic understanding of IP as a type of governmental regulation. This allowed the WHO to argue that states should enjoy regulatory autonomy to curtail IP rights in order to meet broader state objectives, such as human rights protection. Paradoxically, despite their divergent views on the nature of IP, both WTO and WHO engagement with it heralded the emergence of a new technocratic view of global health that focuses on patentable medicines and technologies, and that has ultimately turned away from the WHO’s sociomedical roots.

'Patenting Personalized Medicine: Molecules, Information, and the Body' by Mario Biagioli and Alain Pottage in the same issue comments 

The histories of patent law and medical practice in the United States have intersected in various ways over the past 150 years, beginning with the professional campaign against “patent medicines” in the late nineteenth century, and culminating, for now, in attempts to patent the diagnostic procedures discussed in this article. The patenting of diagnostic procedures provokes a set of fundamental questions about the episteme of patent law. These questions are not new. They emerged at the very origins of patent jurisprudence, centered on the question of what distinguished an invention from a law of nature, and this question of patentability has persistently reemerged over the past century in the contexts of plant breeding, biotechnology, and now diagnostic medicine. So far, the question has been addressed in terms that imagine the invention as a machine, understood in the figurative sense of a transformative organization of forces and elements. But diagnostic procedures, because they address the body informationally, as a system based on the recursive patterning of signals rather than a linear transformation of inputs into outputs, stretch the figure of the machine to the point at which it ceases to be effective. How then should one define and delimit invention?

Clearview, OAIC and the Federal Police

The Office of the Australian Information Commissioner has, somewhat belatedly and with uncertain effect, issued a Determination under the Privacy Act 1988 (Cth) regarding use by the Australian Federal Police of Cleaview. 

The Determination states 

110. I find that the Respondent interfered with the privacy of individuals whose images it uploaded to the Facial Recognition Tool, by failing to take reasonable steps under APP 1.2 to implement practices, procedures and systems relating to its functions or activities that would ensure that it complied with Clause 12 of the Code. 

 Disquietingly but unsurprisingly the Determination states

116. While these appear to be constructive developments, on the evidence before me, I cannot be satisfied that steps the Respondent has taken to date will ensure that the breaches of clause 12 of the Code and APP 1.2 are not repeated or continued.

It notes

There is a disagreement between the OAIC and the Respondent about whether an interference with privacy has occurred, and this determination allows this question to be resolved. There is a public interest in making declarations setting out my reasons for finding that an interference with privacy has occurred and the appropriate response by the Respondent. 

Further it states 

According to a media article dated 21 January 2020, a spokesperson for the Respondent [ie the AFP] had advised at that time that it did not use the Facial Recognition Tool (see paragraph 13). The Respondent refused 3 FOI requests on 13 February 2020 on the basis that no information relating to the third party service provider had been identified, notwithstanding that the Facial Recognition Tool had been used by several Trial participants (see paragraph 15). There were limited records of how this novel technology was used. For example, the dates of registration for  Trial participants are unknown;  the Respondent did not have logs recording details of access and/ or use of the Facial Recognition Tool; and for many uploaded images, the Respondent had no record of the particular image that had been uploaded. 

Regrettably the OAIC is not using the Determination as an opportunity to encourage best practice in FOI responses.

The OAIC states 

96. I am not satisfied that during the Trial Period, the Respondent had appropriate systems in place to identify, track and accurately record its use of new investigative technologies to handle personal information. 

97. I consider that the Respondent should have instituted a more centralised approach to identifying and assessing new and emerging investigative techniques or technologies that handle personal information. This would have assisted the Respondent to identify new high privacy risk projects within its organisation and take a consistent approach to risk assessment. It would also have supported the Respondent’s compliance with APP 1.2 in future, by enabling it to explain why a new or changed way of handling personal information did not have the potential to be high privacy risk (noting that it is the responsibility of each agency to be able to demonstrate whether a new or changed way of handling personal information was a high privacy risk project). 

98. In addition, the Respondent’s policies should have specifically addressed the use of free trials and other freely available online search applications, for investigative purposes. The privacy risks of using such applications (such as those outlined in 69 to 73), were foreseeable given that search tools and applications are easily accessible on the internet, and noting the ACCCE’s commitment to exploring ‘new and innovative solutions’ to meet challenges posed by offenders evolving their operating methods to avoid detection. 

95 The policies should have explained how attendant privacy risks should be assessed to enable compliance with Clause 12 of the Code, and the controls and approval processes in place to support such privacy risk assessments.  ...

Privacy training 

99.Under the Respondent’s written policies that applied during the Trial Period, functional areas were responsible for ensuring that PIAs were undertaken for all high privacy risk projects. The policies clearly stated that personnel could contact the Privacy Officer for assistance in determining whether a PIA is required, and included their contact details. 

100. Notwithstanding this, none of the 10 members of the ACCCE who registered for trial accounts conducted a threshold assessment or a PIA (see paragraph 64). Given this omission, I have considered the steps the Respondent took to implement its written policies about privacy risk assessments, including through staff training and other communications about requirements under the Code. 

101. While I recognise that the Respondent’s written policies contained some information about requirements to undertake a PIA under clause 12 of the Code, the Respondent’s online training module:

• did not include sufficient information to enable staff to identify whether a planned project may involve high privacy risk, such as factors indicating that a project may be high privacy risk, 

• information about the process of conducting threshold assessments and PIAs, or relevant operational examples did not set out clear pathways and triggers for functional areas to consult with appropriate legal and technical experts, before engaging in new or changed personal information handling practices 

• did not clearly identify who was responsible for undertaking threshold assessments and PIAs, and for keeping relevant records 

• did not include information about the potential privacy risks of novel high privacy-impact technologies, or the risks to individuals of uploading personal information held by the agency to a third party service provider in the absence of a Commonwealth contract (as discussed in paragraph 71). 

102. The Respondent’s submissions also indicate that at least 3 of the Trial participants had not received privacy training in the 12 months leading up to the Trial Period. 

103. Based on the Respondent’s submissions and documentation provided, I cannot be satisfied that adequate training was provided to functional areas about how to undertake such an assessment, when to do so, and when to involve the Privacy Officer or other privacy experts. 

PIA 

104. In addition to being a discrete obligation under the Code, an example of the practices, procedures and systems that an APP entity should consider implementing to comply with APP 1.2, is a commitment to conducting a PIA for new projects in which personal information will be handled or when a change is proposed to information handling practices.  A PIA can assist in identifying the practices, procedures or systems that will be reasonable to ensure that new projects are compliant with the APPs. 

105. I have concluded at paragraph 76 above that the Respondent breached clause 12 of the Code by failing to undertake a PIA for a high privacy risk project. 

What additional steps were reasonable in the circumstances? 

106. The requirement in APP 1.2 is to take ‘reasonable steps’ to implement practices, procedures and systems to ensure compliance with the APPs and the Code. 

107. I have considered the seriousness of decisions that may flow from use of the Facial Recognition Tool (see paragraph 71), the fact that the personal information of victims (including children and other vulnerable individuals) was searched, and the likelihood that the Trial involved the handling of sensitive biometric information for identification purposes. I would expect the Respondent to take steps commensurate with this level of risk under APP 1.2, to ensure any privacy risks in using technologies like the Facial Recognition Tool are carefully identified, considered and mitigated against. In some circumstances, the privacy impacts of a high privacy risk project, may be so significant that the project should not proceed. 

108. I consider that having regard to these heightened risks and the deficiencies outlined above, the Respondent should have at least taken the following additional steps before the Trial Period:

• The Respondent should have implemented a centralised system to identify, track and accurately record its use of new investigative technologies to handle personal information. 

• The Respondent’s written policies should have specifically identified the privacy risks of using new technologies to handle personal information as part of its investigative functions (including on a trial basis and when a service is available free of charge) and included controls and approval processes to address these risks. 

• The Respondent should have ensured that staff who were responsible for assessing privacy risk received appropriate privacy training on a regular basis, which covered at least the matters outlined at paragraph 101. 

• The Respondent should have conducted a PIA in relation to the Trial. 

109. I have taken into account the relevant circumstances, including the Respondent’s role as a federal law enforcement agency, its use of the Facial Recognition Tool to search for victims, suspects and persons of interest for investigative purposes, the sensitive nature of the biometric information collected and used by the Facial Recognition Tool, and the time and costs of implementing appropriate policies, procedures, and training. Having regard to these circumstances, I am satisfied that the Respondent did not take steps as were reasonable in the circumstances to implement practices, procedures and systems relating to its functions or activities that would ensure that it complied with clause 12 of the Code, as required under APP 1.2. ... 

Remedies 

111. There are a range of regulatory options that I may take following an investigation commenced on my own initiative. In determining what form of regulatory action to take, I have considered the factors outlined in the OAIC’s Privacy Regulatory Action Policy103 and the OAIC’s Guide to Privacy Regulatory Action. 

112. I am satisfied that the following factors weigh in favour of making a determination that finds that the Respondent has engaged in conduct constituting an interference with the privacy of an individual and must not repeat or continue such conduct: The objects in s 2A of the Act include promoting the protection of the privacy of individuals, and promoting responsible and transparent handling of personal information by entities.

Specified steps  

113. Under s 52(1A)(b) I may declare that the Respondent must take specified steps within a specified period to ensure that an act or practice investigated under s 40(2) is not repeated or continued. 

114. I recognise that the Respondent is proactively working to build the maturity of its privacy governance framework and embed a culture of privacy compliance across the agency. I particularly acknowledge the Respondent’s commitment since the Trial Period, to reviewing and strengthening parts of its privacy governance framework. This includes reviewing and updating its privacy management plan (1 July 2021 to 1 July 2022), which identifies specific, measurable privacy goals and targets and sets out how the agency will meet its compliance obligations under APP 1.2. 

115. In addition, the Respondent submitted during the investigation that it:

• had appointed a dedicated position within the ACCCE, who would be responsible for undertaking software evaluations of similar kinds of applications in future 

• was undertaking a review of existing internal governance processes and documents to specifically address the use of free trials in the online environment 

• had commissioned a broader review of the Respondent’s privacy governance with the assistance of an external legal services provider 

• was reviewing its training module to ensure operational relevance to all staff by including sufficient context and explanation. 

116. While these appear to be constructive developments, on the evidence before me, I cannot be satisfied that steps the Respondent has taken to date will ensure that the breaches of clause 12 of the Code and APP 1.2 are not repeated or continued. 

117. The Respondent has not provided the OAIC with specific information about how any steps it has taken or is taking, will prevent similar breaches occurring again in the future, by addressing the deficiencies in paragraphs 95 to 105 above. For example, during this investigation, the OAIC was not provided with details of how the Respondent’s policies, decision making processes, and approval processes in relation to the use of new technologies have changed since January 2020.  In addition, while the OAIC’s preliminary view contained findings about additional steps that should have been taken to train staff about privacy impact assessments, the Respondent did not provide any updated information about changes to its training program. 

118. Without a more coordinated approach to identifying high privacy risk projects and improvements to staff privacy training, there is a risk of similar contraventions of the Privacy Act occurring in the future. This is particularly the case given the increasing accessibility and capabilities of facial recognition service providers and other new and emerging high privacy impact technologies that could support investigations. 

119. For these reasons, I consider that it is reasonable, proportionate and appropriate to make the declarations in paragraph 2(c) of this determination, under s 52(1A)(b) of the Privacy Act, requiring an independent review of the changes made to the Respondent’s relevant practices, procedures, systems (including training) since the Trial Period. The declarations will provide the OAIC with ongoing oversight of updates to the Respondent’s privacy governance framework. The independent review may also provide additional assurance to Australians that the deficiencies identified in this determination have been addressed. These specified steps will help the Respondent to prevent similar contraventions, and ensure any privacy risks in using high privacy impact technologies are carefully identified, considered and mitigated against.

In October the OAIC in a separate Determination addressed data collection by Clearview, with the OAIC subsequently commenting

Clearview AI, Inc. breached Australians’ privacy by scraping their biometric information from the web and disclosing it through a facial recognition tool. 

The determination follows a joint investigation by the Office of the Australian Information Commissioner (OAIC) and the UK’s Information Commissioner’s Office (ICO). 

Commissioner Falk found that Clearview AI breached the Australian Privacy Act 1988 by: collecting Australians’ sensitive information without consent collecting personal information by unfair means not taking reasonable steps to notify individuals of the collection of personal information not taking reasonable steps to ensure that personal information it disclosed was accurate, having regard to the purpose of disclosure not taking reasonable steps to implement practices, procedures and systems to ensure compliance with the Australian Privacy Principles. 

The determination orders Clearview AI to cease collecting facial images and biometric templates from individuals in Australia, and to destroy existing images and templates collected from Australia.  

Clearview AI’s facial recognition tool includes a database of more than three billion images taken from social media platforms and other publicly available websites. The tool allows users to upload a photo of an individual’s face and find other facial images of that person collected from the internet. It then links to where the photos appeared for identification purposes. 

The OAIC determination highlights the lack of transparency around Clearview AI’s collection practices, the monetisation of individuals’ data for a purpose entirely outside reasonable expectations, and the risk of adversity to people whose images are included in their database. 

“The covert collection of this kind of sensitive information is unreasonably intrusive and unfair,” Commissioner Falk said. 

“It carries significant risk of harm to individuals, including vulnerable groups such as children and victims of crime, whose images can be searched on Clearview AI’s database. 

“By its nature, this biometric identity information cannot be reissued or cancelled and may also be replicated and used for identity theft. Individuals featured in the database may also be at risk of misidentification. 

“These practices fall well short of Australians’ expectations for the protection of their personal information.” 

Commissioner Falk found the privacy impacts of Clearview AI’s biometric system were not necessary, legitimate and proportionate, having regard to any public interest benefits. “When Australians use social media or professional networking sites, they don’t expect their facial images to be collected without their consent by a commercial entity to create biometric templates for completely unrelated identification purposes,” she said. 

“The indiscriminate scraping of people’s facial images, only a fraction of whom would ever be connected with law enforcement investigations, may adversely impact the personal freedoms of all Australians who perceive themselves to be under surveillance.” 

Between October 2019 and March 2020, Clearview AI provided trials of the facial recognition tool to some Australian police forces which conducted searches using facial images of individuals located in Australia. ... 

Clearview AI argued that the information it handled was not personal information and that, as a company based in the US, it was not within the Privacy Act’s jurisdiction. Clearview also claimed it stopped offering its services to Australian law enforcement shortly after the OAIC’s investigation began. 

However, Commissioner Falk said she was satisfied Clearview AI was required to comply with Australian privacy law and that the information it handled was personal information covered by the Privacy Act.

SOCI 2 - Cyber Security Obligations

The exposure draft of the Security Legislation Amendment (Critical Infrastructure Protection) Bill - aka SOCI 2 - features a specific part 2C on 'Cyber Security Obligations', described thus in the explanatory statement for the draft Bill -  

86. Critical infrastructure assets and the systems they rely on are increasingly interconnected and interdependent. While Parts 2, 2A, and 2B, discussed above, impose obligations to manage risks to the operation of these assets, a small subset of critical infrastructure assets are of the highest criticality due to their interdependences with other critical assets. A closer partnership is required in relation to these systems of national significance, and the computer infrastructure that underpins them, to build enhanced cyber resilience and preparedness. 

87. The Australian Government has introduced the enhanced cyber security obligations to strengthen the cyber preparedness and resilience of entities that operate critical infrastructure assets of the highest criticality (system of national significance). Consultation on the Cyber Security Strategy 2020 supported initiatives to enhance cyber information sharing to build a stronger collective understanding of threats to Australian systems. These obligations enable the Government to establish a bespoke partnership, tailored to individual assets, to not only prepare entities to better manage cyber risks but also improve Australia’s situational awareness, particularly as the threat environment worsens. 

88. Under Part 6A, the Minister for Home Affairs may declare a critical infrastructure asset to be a system of national significance. Part 2C would provide for a series of enhanced cyber security obligations which may be imposed on the responsible entity for a system of national significance. Responsible entities for Systems of National Significance would not be obligated to comply with each of these enhanced obligations following the Minister’s declaration, but rather may be required to do so, from time to time, following a written notice from the Secretary of Home Affairs. This approach reflects the different nature of the obligations provided under this Part, which are aimed at addressing or identifying vulnerabilities and building resilient practices. 

89. The Australian Government would continue to build on the strong voluntary engagement and cooperation with critical infrastructure entities that has underpinned the success of the relationship to date. This includes providing voluntary support and guidance. However, there may be instances where entities are unwilling or unable to voluntarily cooperate and the Enhanced Cyber Security Obligations are necessary. 

Division 2 of Part 2C – Statutory incident response planning obligations 

90. The first of the enhanced cyber security obligations which the Secretary may require the responsible entity for a system of national significance to comply with is the statutory incident response planning obligation. Incident response plans are designed to ensure an entity has established processes and tools to prepare for and respond to cyber security incidents. Incident response plans would provide assurance to Government that entities are sufficiently prepared for cyber security incidents and would assist entities by clearly articulating ‘what to do’ and ‘who to call’ in the event of a cyber  security incident. Clear escalation pathways and processes can be crucial to mitigating and minimising the consequences of fast moving cyber incidents. 

91. Section 30CB would enable the Secretary of the Department of Home Affairs to determine that the statutory incident response planning obligations apply to the entity, meaning that it would need to adopt and maintain an incident response plan (section 30CD), comply with the plan (section 30CE), and regularly review (section 30CF) and take all reasonable steps to ensure the plan is up to date (section 30CG). 

92. Section 30CJ would provide that an incident response plan is a written plan that relates to the system of national significance, for the purposes of planning for responding to cyber security incidents that could have a relevant impact on the system. The plan would need to comply with any requirements specified in the rules, which may include details on procedures to be included in the plan for responding to a particular cyber security incident. 

93. Incident response plans would vary from entity to entity. However, common elements of an incident response plan include definitions of the types of systems being used, details of staff member roles and responsibilities, outlines of common cyber incidents and incident response processes to mitigate and remediate a cyber security incident. 

94. A copy of the incident response plan would need to provided to the Secretary of Home Affairs, as soon as practicable after it is adopted or varied. This would ensure Government and entities have the necessary information to activate cyber security incident response arrangements at any point in time, particularly in the event of an emergency. 

95. A civil penalty of up to 200 penalty units applies for failure to comply with the obligations in this Division (the value of a penalty unit is currently $222 for offences committed on or after 1 July 2020). 

Division 3 of Part 2C – Cyber security exercises 

96. The second of the enhanced cyber security obligations which the Secretary may require the responsible entity for a system of national significance to comply with is the requirement to undertake a cyber security exercise. 

97. Cyber security exercises are an integral part of an entity’s cyber security procedures, as they are used to test response preparedness, mitigation and response capabilities. Such exercises enable an entity to develop an understanding of how to address a cyber incident through a scenario that requires the entity to draw upon resources, such as incident response plans, relevant legislation, policies and processes to identify the most appropriate response to a cyber security incident. Cyber security exercises can identify gaps in existing approaches and help streamline processes to ensure more effective and efficient responses to threats as they emerge. 

98. During consultation on the Cyber Security Strategy 2020, submissions highlighted the importance of joint cyber security exercises involving industry and government to improve entities’ cyber resilience. Noting the interdependencies between critical infrastructure assets, these exercises can be used to develop interoperable response capabilities to prevent a cascading of impacts across sectors. 

99. Section 30CM would provide that the Secretary of Home Affairs may, by written notice, require the entity to undertake a cyber security exercise in relation to all types of cyber security incidents, or one or more specified types of cyber security incidents (for example, a denial of service or ransomware attack). 

100. The scope of the exercise would be determined based on analysis of threats and incident trends, as well as consideration of the consequential or cascading effects that may occur should the system be impacted by a cyber security incident. 

101. A cyber security exercise would be defined in section 30CN to an exercise, the purpose of which is to test the entity’s: ability to respond appropriately to the cyber security incident/s; preparedness to respond appropriately to the cyber security incident/s; and   ability to mitigate the relevant impacts the cyber security incident/s could have on the system. 

102. Cyber security exercises are generally conducted through one of two formats: discussion-based or tabletop exercises, and operational or functional exercises. 

103. The Secretary of Home Affairs may also require that the entity allow specified designated officers to observe the cyber security exercise, provide those officers with access to the premises or other assistance and facilities to allow the observation of the exercise, allow them to make reasonably necessary records and give them notice of when the exercise would commence. A designated officer is defined in section 30DQ to be an employee of the Department of Home Affairs or a staff member of the Australian Signals Directorate. 

104. Section 30CQ would provide that, on completion of the exercise, the entity is required to prepare an evaluation report relating to the exercise and give a copy of the report to the Secretary. An evaluation report is a written report the purpose of which is to evaluate the entity’s:  ability to respond appropriately to the cyber security incident/s;  preparedness to respond appropriately to the cyber security incident/s, and  ability to mitigate the relevant impacts the cyber security incident/s could have on the system. 

105. However, if the entity has prepared, or purported to prepare an evaluation report, provided it to the Secretary for Home Affairs and the Secretary has reasonable grounds to believe that the report was not prepared appropriately, the Secretary may require the entity to appoint an external auditor to prepare an evaluation report for the entity. Alternatively, if the entity fails to comply with section 30CQ the Secretary for Home Affairs may require an external evaluation report to be prepared by an external auditor. An external auditor is a specified individual authorised by the Secretary as such for the purposes of the Act. 

106. A civil penalty of up to 200 penalty units applies for failure to comply with the obligations in this Division (the value of a penalty unit is currently $222 for offences committed on or after 1 July 2020). 

Division 4 of Part 2C – Vulnerability assessments 

107. The third element of the enhanced cyber security obligations which the Secretary may require the responsible entity for a system of national significance to comply with is the requirement to undertake a vulnerability assessment. 

108. Vulnerability assessments are a routine cyber security practice undertaken to identify vulnerabilities or ‘gaps’ in systems which expose them to particular types of cyber incidents. These preparatory activities also enable the entity to evaluate the risk of particular vulnerabilities. This  would enable entities that operate Australia’s Systems of National Significance to remediate vulnerabilities before they can be exploited by malicious actors. The identification of vulnerabilities in one system may also enable the remediation of similar vulnerabilities across other critical systems. 

109. A vulnerability assessment can consist of a documentation-based review of a system’s design, a hands-on assessment or automated scanning with software tools. In each case, the goal is to identify security vulnerabilities. 

110. Section 30CU would provide that the Secretary of Home Affairs may require the entity to undertake, or cause to be undertaken, a vulnerability assessment in relation to the system and a particular type of cyber security incident, or cyber security incidents generally. The entity can undertake this assessment or may choose to engage the services of a third party to undertake the assessment. Prior to making such a request, the Secretary is required to consult with the entity. This consultation requirement would assist the Secretary to determine the entity’s capacity to undertake, or cause to be undertaken, the required vulnerability assessment. 

111. If the Secretary of Home Affairs has reasonable grounds to believe that the entity would not be capable of complying with a notice or has not complied with an earlier notice, the Secretary may give a designated officer a written request to undertake the vulnerability assessment and require the entity to provide reasonable access, assistance and facilities to the officer to allow the assessment to be undertaken. 

112. If the entity, or a designated officer, undertakes a vulnerability assessment they would need to prepare, or cause to be prepared, a vulnerability assessment report and provide a copy of the report to the Secretary. 

113. A civil penalty of up to 200 penalty units applies for failure to comply with the obligations in this Division (the value of a penalty unit is currently $222 for offences committed on or after 1 July 2020). 

Division 5 of Part 2C – Access to system information 

114. The final of the enhanced cyber security obligations which the Secretary may require the responsible entity for a system of national significance to comply with is the requirement to provide system information. 

115. During consultation on the Cyber Security Strategy 2020, stakeholders strongly supported initiatives to improve information sharing to make critical infrastructure more resilient and secure. The provision of system telemetry from Systems of National Significance would support the Government’s ability to build a near-real time threat picture through the CESAR capability and share actionable, anonymised information back out to industry. Aggregated system information, overlaid with intelligence and reporting, would also enable the Government to target its limited capabilities to the threats and vulnerabilities of greatest consequence to the nation. 

116. System information is information that relates to the operation of the computer needed to operate a system of national significance. This information may assist with determining whether a power under this Act should be exercised in relation to the system of national significance. However, system information cannot include personal information within the meaning of the Privacy Act 1988. For example, system information may be network logs or alerts that provide visibility of the operation and functioning of a broader computer network. The monitoring of this information can be crucial to identifying a compromise of a system and deploying a rapid response to mitigating its potential impacts. 

117. Section 30DB would provide that, if the Secretary of Home Affairs believes on reasonable grounds that the responsible entity for the system of national significance is technically capable of doing so, the Secretary may require the entity to provide the Australian Signals Directorate with periodic reports consisting of specified system information (‘a system information periodic reporting notice’). The Secretary may specify the intervals, manner and form in which the information is to be provided, as well as any other information technology requirements relating to the provision of the information. Depending on the information required and the ability for automated provision (such as automated machine-to-machine cyber threat intelligence sharing), these reports may be required to be made at rapid intervals, for example, every minute. 

118. Section 30DC would provide that, if the Secretary of Home Affairs believes, on reasonable grounds, that the responsible entity for the system of national significance is technically capable of doing so, the Secretary may require the entity to provide the Australian Signals Directorate with reports consisting of specified system information as soon as practicable after each incidence of a specified event occurring (‘a system information event-based reporting notice’). For example, a report may be required every time a particular computer program raises a specified class of alert or error message. 

119. In deciding whether to give a system information periodic reporting notice or a system information event-based reporting notice, the Secretary of Home Affairs would have to have regard to the costs that are likely to be incurred by the entity in complying with the notice. To support this consideration as well as the determination of whether the entity is technically capable of providing the report, section 30DD mandates that the Secretary of Home Affairs would need to consult with the entity prior to issuing the notice. 

120. If the Secretary of Home Affairs does not believe on reasonable grounds that the entity would be technically capable of preparing reports under sections 30DB or 30DC, section 30DJ would provide that the Secretary may require the entity to install and maintain a specified computer program (‘system information software notice’). The computer program may only be specified in the notice if its purpose is to collect and record the required system information and cause the information to be transmitted electronically to the Australian Signals Directorate. The computer program would be provided by the Government and would, for example, operate as a host-based sensor reporting back to the Australian Signals Directorate telemetry information used to monitor the system for malicious behaviour. 

121. In deciding whether to give a system information software notice, the Secretary of Home Affairs would need to have regard to the costs that are likely to be incurred by the entity in complying with the notice. To support this consideration, section 30DK mandates that the Secretary of Home Affairs would need to consult with the entity prior to issuing the notice. 

122. A civil penalty of up to 200 penalty units applies for failure to comply with the obligations in this Division (the value of a penalty unit is currently $222 for offences committed on or after 1 July 2020).