Julie Owens (Parramatta, Australian Labor Party, Shadow Parliamentary Secretary for Small Business) Share this | Hansard source

The National Cancer Screening Register Bill 2016 and the National Cancer Screening Register (Consequential and Transitional Provisions) Bill 2016 are important bills (1) because they do something very important, but (2) because they highlight the incompetence of the government in implementing something as important as the National Cancer Screening Register. They are doing something that is important and, once again, they are doing it badly. In speaking today I want to highlight both those sides: what is important about the register itself, and the process that the government have gone through that has got them to the shemozzle that they are in today with this legislation.

Firstly, the Cancer Screening Register itself will replace nine existing registers: the National Bowel Cancer Screening Register and eight state and territory registers for the National Cervical Screening Program. Labor supports the establishment of a cancer register. It will reduce duplication and improve the prevention, identification and treatment of cancer in Australia. Because it will link through to GPs' desktops, GPs will be able to see the entire cancer screening history of their patients. Labor also supports the improvements to cancer screening programs that the new national register will enable. The National Cervical Screening Program will move from a two-yearly pap test to a five-yearly cervical screening test. This implements recommendations that were actually made by the independent Medical Services Advisory Committee, and this is expected to prevent an additional 140 cervical cancers a year. As with so many cancer prevention strategies, none of us will know the names of the people who were saved by this, but it is an incredibly important move. The National Bowel Cancer Screening Program will accelerate its transition to biennial screening—again, incredibly important—with Australians aged 50 to 74 screened every two years by 2020, instead of 14 years late by 2034. We know from clinical trials that biennial screening can prevent between 300 and 500 deaths per year. Again, it is incredibly important that this register be established, and it is a good thing.

But when it comes to the implementation itself we really do get a completely different story.

The register will hold Australia's most sensitive health data, like the results of cervical and bowel cancer screening, and we need to get it right. On the Labor side, we are incredibly concerned that the government has already carried out moves to outsource the register to Telstra, to privatise the keeping of what is incredibly important data.

I am going to leave aside the dishonesty during the election campaign, when they were declaring strongly that they would not outsource Medicare, when, four days before they called the election, they had already signed a contract with Telstra to outsource the cancer register. Let us leave that aside. Let us leave aside the fact that they planned to make a major announcement during the election campaign and then, when it became clear that the people of Australia did not want their medical services to be outsourced, they decided to cancel that announcement. Let us just that aside and deal with the process itself that got us to this point.

It is important to remember that the announcement for the cancer screening register was not made in the 2016-17 budget. It was actually made in the 2015-16 budget, so it was made over a year and a half ago, and two years before the register was due to come online, effectively, on 1 May 2017. So, in the announcement in 2015-16 they gave themselves two years to get the register, the legislation through the parliament, have it established, sort out its processes and get it right. And it is incredibly important that we do get something right when such sensitive information is held on the register. But what we found was that through the year 2015-16 to 2016-17 there was no legislation to establish the cancer register. It was not put forward. But what happened instead was that four days before the calling of the election a contract to manage the register was let to Telstra. So, roughly a year after they announced they were going to have a register, they let a contract to Telstra to manage a register, before the legislation had gone through parliament.

I think every business out there would wonder what is in that contract, because at that stage the legislation to establish the register the contract was for had not passed the parliament and we were heading into an election the government was not guaranteed to win. If we were honest, we had no idea during the election campaign what the parliament would look like, yet the government was letting a contract to a major corporation for a register that did not exist and had not passed the parliament. Heaven knows what is in that contract, but it must be an interesting one, with a lot of blank spaces.

The government now has to rush the bill through the parliament so that Telstra, which has the contract, is able to deliver the cancer register by 1 May 2017. You need to understand there that Telstra has no experience in the managing of this kind register. In fact, there is not a single cancer register in the world that is managed by a private entity; they are all managed by public entities, as they are in Australia. So Telstra has no experience whatsoever in setting up or managing a register of this kind and is busy at the moment running around to the existing holders of the nine registers trying to poach their staff and borrow their expertise so that they can actually meet this deadline. So we are now looking at a government that is trying to rush the legislation through the parliament to meet a deadline they have, by their own incompetence, shortened to a ridiculous extent.

When Labor and the crossbench referred the government's bills to the Senate inquiry, the health minister, Sussan Ley, accused Labor of a hysterical tirade. But in an embarrassing rebuke of the government their own privacy and information commissioner made six recommendations to fix the legislation to the Senate inquiry. Some of the loopholes identified by the commissioner were really alarming. For example, the government's bills, as drafted, may allow the register operator to collect all Medicare claims information on people who are on the register, and not just the information that relates specifically to the cancer register. Under the government's plan this would allow Telstra to see all the health services that a person had received, including in sensitive areas like mental health and sexual health. So that is one really alarming area of privacy that the commissioner alerted the government to.

Last week Labor proposed nine amendments to improve the government's legislation and the government has come kicking and screaming into accepting many of those amendments. We understand the government will move a series of amendments that will meet many of the demands that Labor has made, because they are actually quite reasonable demands. Arguably, if the government had spent sufficient time on getting this register right over that year where it sat idle, they may have handled these matters themselves and may have done the appropriate consultation to handle these kinds of really quite obvious problems with the legislation.

Yet, the government still cannot get it right. The legislation is still absolutely full of holes, so Labor is moving three more amendments that the government refused to accept. Those amendments fall into three areas. First, relating to Telstra itself, to limit the operation of the register to a not-for-profit organisation or a government agency. I will come back to this. Second, is mandatory disclosure, so that individuals are notified when their most sensitive health data is breached. Third, an amendment to increase the penalty for unauthorised use of or disclosure of information. On the Labor side we would think that these are three really obvious amendments that will have the support of the people of Australia. First, that something as sensitive as a cancer register should be held by a not-for-profit organisation or a government agency. Second, that if data is breached individuals should be notified. Third, that the penalties for unauthorised use of or disclosure of information are substantial, substantial enough to ensure that a private company would be extremely concerned that such unauthorised disclosure did not happen.

I will come back to the detail of those amendments. The Telstra amendment, which limits the operation of the register to a not-for-profit organisation or a government agency is there for a very simple reason. Telstra has never operated a register like this. In fact, no for-profit corporation anywhere in the world does it. It is new territory and it is extremely sensitive information for the government to be using in a guinea pig approach for Telstra's first foray into health.

It is going to contain extremely private health information that has never been handed over to a for-profit company. This includes the Medicare number, the Medicare claims information, the preferred GP, HPV vaccination status, screening test results, cancer diagnosis—incredibly sensitive information which has not, in Australia, been held by the corporate sector before today. So, Telstra will know things like whether you have had a cervical or bowel cancer test, whether you have a precursor to cancer or genetic markers that may lead to cancer or whether a woman has had a hysterectomy or a partial hysterectomy—incredibly sensitive information.

In fact, the Senate inquiry revealed that it is not just the Labor Party that is concerned about keeping this kind of sensitive information in the hands of the corporate world. The Australian Medical Association, the Royal Australian College of General Practitioners, and other experts share Labor's concern about outsourcing the register to a for-profit corporation. Labor's amendment, in clear English, would ensure that the register would have to be held by a government agency or a not-for-profit. Incidentally, not-for-profit organisations and government departments are currently quite successfully holding the nine registers that currently exist.

The second amendment concerns mandatory disclosure so that individuals are notified when their most sensitive health data is breached. Under the government's legislation, if and when there are data breaches, Telstra has to tell only the Department of Health. That is it. We understand that the government will now accept Labor's amendment to ensure that the Privacy Commissioner is also notified. That is an improvement, although, as I said earlier, the Minister for Health originally said we were being hysterical about this, but they have agreed to that. But it is really not good enough: if a person's health privacy is breached, that person should be advised of that breach. So that is the second amendment, and it is consistent with our position across all portfolios. Unfortunately, the government has a history on this. When sensitive Medicare and PBS data was breached the government took weeks to come clean. So this is an important amendment for protecting consumer rights.

The third one is the penalties amendment. Under the current bill the penalty for recording, using or disclosing information without authority is $21,600—for Telstra—for misusing or disclosing information without authority. In the six months to December 2015 Telstra reported a profit of $2.1 billion. It is hard to see how, for a corporation of that size, a penalty of $21,600 would be a sufficient deterrent to ensure that the corporation had data security in the forefront of its mind. First, they have to tell only the Department of Health—and now, because of the amendment, the Privacy Commissioner—and they get fined what is a drop in the ocean for a corporation the size of Telstra. The former Secretary of the Department of Health, Stephen Duckett, said:

The automatic consequences of release of data – inadvertent or not – must be made so great that any risk-management matrix will ensure the organisation and its managers always have patient privacy at the forefront of their mind.

Even stakeholders that are generally supportive of the government's legislation, such as Pathology Australia, have called for a review of the fine for offences to ensure that they are an appropriate deterrent.

Under the Crimes Act 1914 a court can impose a penalty of up to five times this amount on a corporation. So, if Telstra is the register operator it could be fined $540,000 for breaching the legislation. This penalty of $21,600 is simply insufficient, and it should not be discretionary. If individuals or organisations inappropriately use Australia's most sensitive health data, the punishments should be severe and automatic. These three amendments—to prevent data being held by a corporation but, in the case where it is, mandatory disclosure of any breach of data privacy and serious penalties for disclosing information or publishing it either intentionally or inadvertently—are absolutely essential items. It is a shame the government did not spend the time they should have spent on this. They would have had two years to make it happen. Rushing legislation like this and rushing a process that is as important as this is an absolute sign of their incompetence.

See this speech in context