Opt-out e-health a 'fundamental breach of trust': Victorian regulator

The Australian government has committed a "fundamental breach of trust" by flipping personally controlled e-health records (PCEHR) from an opt-in system to opt-out, according to Victoria's Commissioner for Privacy and Data Protection, David Watts.

"I actually designed the regulatory system for e-health in Australia, and I swore black and blue ... that we would never be an opt-out system, and always be an opt-in. And of course it's now an opt-out system in order to drive take-up of e-health, because AU$4 billion had been spent on it and very few people had registered," Watts told the Australian Information Industry Association (AIIA) Navigating Privacy and Security Summit in Canberra on Tuesday.

"In my view that's a fundamental breach of trust."

Watts said it puts simple economics ahead of information self-determination.

"It says something about trust across government that those sorts of principles would be thrown away simply because a system's not been used as much as it should be."

Watts is the only privacy and security regulator in Australia to have adopted Privacy by Design as a core principle for government handling of personal data, even though it's increasingly being adopted as a benchmark for good privacy practice internationally.

"One of the most important principles is the last one, keeping it user-centric," Watts said, and a key part of that is self-determination.

New technology might make that self-determination more feasible, according to Dawn Routledge, executive director for strategic policy with the NSW Department of Finance, Services and Innovation.

"The protection of personal information as an aspect of privacy has never been deemed to absolute, and all of the privacy frameworks have been about ensuring that there's an appropriate balance of power between the legitimate use of personal information to provide a service or to manage a community -- so policing and that kind of thing -- and that right of individuals to the protection of their personal information," Routledge told the conference, making it clear that this was her personal view.

"What I'd like to see in the future is that through changing technology there is perhaps an opportunity to re-think that balance in power, and perhaps shift it more in favour of citizens," she said.

"At the moment, there are a number of processes and services that require government or businesses to actually collect and hold data ... but in the future it's quite likely that you don't need to collect that data. It may be held by the person, and you [the government or business] just need access to it, or even you just need some kind of verification."

One example might be personal income tax returns. The Australian Taxation Office doesn't need to know exactly how you earned your income, Routledge said, only that you correctly recorded your income and any legitimate deductions, and paid the correct amount of tax.

"Digital govt isn't about creating a lake of data and expecting magic to happen," she said.

New technology might make self-determination more difficult, however.

Dr Jodie Steel, lead for government and defence for NICTA's cyber security business team, cited comments about "ambient data collection" by renowned security expert Bruce Schneier at last week's RSA Conference in San Francisco.

Data collection is increasingly involuntary, something that just happens because it's part of someone's surroundings -- whether that's through emerging Internet of Things (IoT) devices, or through existing apps on smartphones. The internet thinks, senses, and acts, she reported Schneier as saying. How can people really give informed consent in this environment?

But consent is a particularly American concern, according to Constellation Research privacy consultant Steve Wilson, who was in the AIIA Summit audience.

"Consent is not the only or even most important issue," Wilson told ZDNet on Wednesday.

"The rest of the world doesn't obsess about consent. But consent is all they've got in America, absent any overarching data protection restraint, so they obsess about whether or not 5,000-word privacy policies are enforceable as informed consent," he said.

Wilson said that in general the community trusts the government to adhere to core privacy principles, such as not repurposing information without due cause, and our day-to-day experience is good in that regard.

In Australia, for example, we trust Medicare with highly-sensitive healthcare metadata -- but e-health records contain clinical data, and that's a different ball game.

"Some cynics say that the government isn't organised enough to share data, even if they wanted to. But health data has so many borderline use cases that there's a strong temptation to reuse it. If there's any uncertainty about how the government might handle those cases, then trust starts to erode," Wilson said.

"It's nice to trust, but it's better not to have to trust, and instead have clear rules and regulations."

Disclosure: Stilgherrian travelled to Canberra as a guest of the Australian Internet Industry Association.