Draft OFPC Information Sheet on Scanning ID Documents

Submission to Office of the Federal Privacy Commissioner

21 August 2007

From: "nigel waters" <enquiries@privacy.org.au>
To: <consultation@privacy.gov.au>
Cc: "'Timothy Pilgrim'" <timothypilgrim@privacy.gov.au>
Subject: Comments on draft Information Sheet on Scanning ID documents
Date: Tue, 21 Aug 2007 21:22:33 +1000

Thank you for the opportunity to comment on this draft.

We are disappointed by the draft. The tone is overall much too permissive - not appropriate as a response to a new dangerous, unsafe and abusive practice that should generally be discouraged very strongly. (We are particularly thinking of its application in e.g. community club entry requirements).

We urge you to go back up the decision tree and focus more on explaining why frequently it will NOT be appropriate to routinely assume that scanning of ID documents is required. Viewing an Evidence of Identity (EoI) document (they are never ‘proof’), plus recording the verified name separate from the docs should be adequate in most cases, much cheaper, quicker and less offensive.

This generally unnecessary practice is intrinsically intrusive, oppressive and dangerously insecure, with the outsourced contractor structure of the transaction also a central issue in weakening accountability. It creates a honeypot of the raw materials for ID fraud. This key outsourcing aspect is not adequately considered - each party denies responsibility. Who is the collector: the security guard, the system operator, or the club?

The body of the document in places reasonably discusses quite well the reasons why anonymity is OK, and even if not, scanning is rarely required in order to check identity.

However the initial summary does not take this approach, assuming a permissive aim, and many of the suggestions are framed on the implicit assumption you just have to check a box before you go ahead.
 
The focus of all the language and suggestions should instead be that you will rarely need to do this, and the reasons why it may both offend privacy principles and customers, and also create personal information security risks which individuals cannot be reasonably be expected to accept in relation to a practice that is rarely essential.

Unless you are going to aim to discourage the practice more vigorously and demand higher standards, it may be better not to issue guidance but instead to wait for complaints to come in and build up a body of 'decisions' based on real life experience, not seek to in effect authorise and encourage the practice and give hints about how you can get away with it.

The draft also does not emphasize seeking express informed consent, or offering choice.
 
It also mentions IT security/spyware precautions in passing, but this is dangerously weak.  A problem that the Regulating Malware research program at the UNSW Cyberspace Law & Policy Centre (see <http://www.cyberlawcentre.org/>http://www.cyberlawcentre.org/) is unveiling is that IT security is in effect broken for many purposes, with minimal chances that any given consumer or SME system, or even most large ones, can be established to be secure any more. The default response should be to expect continued vulnerability, not security (unlike many physical premises, where security is reasonably possible). This is especially so where there is digitisation, networking, third or 4th party handling, and the documents are known to be critically useful for ID fraud.

So this part of the paper is also flawed - a customer would typically be unable to have any confidence that the business' system will be secure, but there is no suggestion that independent auditing would be an essential starting point for such a honeypot for ID fraud data, and no discussion of the major problem of outsourced processing - there is a lack of any contractual link for the data subject with the real collector/processor/distributor, who may be anywhere.

This is analogous to online banking liability - unless the business is actually prepared to accept some of the risk they are creating, by e.g. implementing independent open trustworthy IT security auditing on an ongoing basis, there is no reason for consumer trust. We believe you should acknowledge this in the paper (or in a decision not to issue the guidance without further thought and discussion).

We would be pleased to discuss our comments further

*************************************************
Nigel Waters, Board Member and Policy Coordinator
Australian Privacy Foundation
E-mail: enquiries@privacy.org.au
APF Web site: <http://www.privacy.org.au>http://www.privacy.org.au
*************************************************