Zoe Daniel (Goldstein, Independent) Share this | Hansard source

I'd like to begin by recognising the importance that the government's digital ID proposal represents for the Australian economy and society, but I say that equivocally. I will say that the existing arrangement of digital identity verification in Australia—one decentralised and led by the private sector—is fraught with risk. One only has to look at the 2022 Optus and Medibank Private data breaches to identify the need for a secure means of digital identity verification in Australia. Names, phone numbers, physical addresses, bank details and mental health diagnoses should not so readily find their way into the public domain. Australians can and should be protected from this kind of risk.

Enabling Australian industry to rely on a secure means of digital identity verification is likely to simplify a vast range of economic activities. Banks will be able to verify a mortgage applicant's identity without having to undertake their own verification process and carry the risk of storing sensitive identity documentation themselves. Accessing government services like Medicare or the Tax Office would be made less arduous—that's the promise, anyway. It's even foreseeable that the process of entering a hospitality venue could become quicker and easier, with greater protection for underage children.

Some people are suspicious of or simply struggle to deal with the increasing digitalisation of government services that we've seen in recent decades. I understand and I acknowledge their concerns. There is an equity issue here, and we must make sure that older people, poorer people and people from a range of backgrounds are not disadvantaged. But I don't oppose the trend in principle. I can see that where evidence based policy design has been undertaken and thoroughly considered, and safeguards are in place, digitalisation can be a force for positive change in society.

Unfortunately, however, there are elements of this legislation which indicate the process has not been rigorous enough. Whether this policy will be successful comes down to a single word: trust. In the case of digital ID, I don't think the government has done enough to build that trust, and I think that's been evidenced by the speakers before me.

The government has missed several opportunities. As a starting point, it is poor public policy and legislative practice that this piece of legislation has been prioritised for enactment prior to the government's broader promised series of reforms to the Privacy Act. This view was put forward by Digital Rights Watch to the government last year but has apparently been ignored or, at worst, parked. As the government has publicly acknowledged, Australia's present-day privacy legislation is insufficiently robust to deal with a modern and internet connected digital economy. Ideally, expansion of the existing Australian government's digital ID system should only occur within a comprehensive legal framework which provides assurance to Australians that their sensitive data is private and protected.

The government's proposed model for this digital ID system is not of itself new. It's a model that has been used internationally, and many countries have adopted such a policy, the Aadhaar system in India being one significant example. India's version of digital ID, which is technically comparable to Australia's proposal, includes law enforcement access and accredited private sector involvement. But it also raises important questions about the design of its technical systems. International advocacy group Access Now, in a case study of the Aadhaar system, found that its implementation did not broadly capture all types of identity within India. In addition, in India, religious and caste identities are both contested and deeply societally complex. Visibility of such social characteristics, particularly for marginalised groups or those perceived to be 'out of favour' with the government of the time, is not uniformly desired. This is particularly the case when adequate and accessible alternative methods for verifying identity are not available—take, for example, the plight of a refugee escaping persecution while having no choice but to navigate a complex and central digital identity system.

Despite some other welcome changes to the original legislation, which I'll come to later, this bill would have been further improved had it contained specific protections against discrimination of vulnerable individuals. I raise this issue because the legislation does not incorporate such safeguards. The explanatory memorandum states that the legislation does not include express provisions to prevent the discriminatory use of a digital ID. While I understand other legal avenues may exist for individuals impacted by the digital ID system to seek redress, we must question whether proper safeguards have been implemented within this proposal which would prevent discriminatory misuse or mission creep by a future government. This is another missed opportunity to build trust in this bill.

The special accessibility provisions for law enforcement agencies to the digital ID system are one of the predominant questions surrounding this legislation. Amendments made by the Senate offer some improvement by requiring that the minister responsible for the Australian Federal Police report to parliament annually detailing the number and types of access requests made by law enforcement. I want to stress that the simple activity of verifying one's identity digital should in no way involve law enforcement and in no way improve the effectiveness or operation of the government's proposed model for digital ID. This is an unnecessary provision. Alternative means exist for law enforcement to protect Australians, and its inclusion only serves to undermine the integrity or the perception of integrity of the digital ID system for many Australians as they understand it. Perception and acceptance are particularly important when dealing with new technology and public policy and in this case are key drivers for broad uptake of the system. These principles appear to be ignored in the legislation before us. Again, it's another missed opportunity to build trust.

I commend the amendments made by the Australian Greens in the Senate relating to protecting the voluntary nature of the digital ID system and ensuring alternatives for identity verification are available as the system is implemented. This is an important provision to ensure that Australians are not forced into the system by a simple lack of other options. While the digital ID system will no doubt be quicker and more secure than any other alternatives, this important provision both respects the concerns any Australian may have in their understanding of, and trust in, it. The amendments also safeguard against indirect or unintentional discrimination experienced by Australians who are less literate in digital technologies. The amendments made by the Senate, therefore, improve the voluntary nature of this new form of secure identification. Law enforcement access is restrained and subject to those accountability measures.

On balance, I am inclined to vote for this bill based on the benefits it presents to bringing up to date secure and modern verification of one's identity. But, for the moment, I will reiterate my concerns that this must be closely monitored to guard against unintended consequences.

See this speech in context