You are here

Infrastructure and Transport – Facial Recognition

Cassy O'Connor MP  -  Tuesday, 24 November 2020

Tags: Facial Recognition, Privacy, Cybersecurity

Ms O'CONNOR - Point of order, Chair. The answers to these questions are very long-winded and just when we think there's going to be a wind-up, the minister feels he needs to add more so I want to place that on the record - quite different from yesterday's Estimates.

Minister, we're seeking an update on the Government's decision to transfer the photographs of 430 000 Tasmanians to a database at the Commonwealth level. Are you able to update the committee on the total number that have been transferred? Can you confirm that the federal legislative framework that was flagged to cover these photographs is not yet in place and what is your response to Professor Terese Henning who says -

The Tasmanian Government began collecting facial recognition data in the absence of the relevant legislative framework to do so and in the absence of the recommended safeguards, privacy and personal security as it was done without our knowledge and without our consent. It was done without community consultation on the need for it or the desirability of its collection.

This is the former head of the Tasmanian Law Reform Institute, Professor Terese Henning.

Mr FERGUSON - I'm going to invite to the table Martin Crane, General Manager, Road User Services, and while he is setting up I will begin with an answer. Ms O'Connor, you've been completely consistent on this one in opposing what is, for us, about identity protection and security of our Tasmanian community's data. It would be fair to say -

Ms O'CONNOR - It's sitting up there in an unprotected database at the moment.

Mr FERGUSON - It would be unfair to say that, that it's an unprotected database when it's actually a secure base server which is only accessible by the Department of State Growth.

Ms O'CONNOR - No legislative protection.

Mr FERGUSON - It does have legislative protection ; it has the legislative protection of Tasmanian laws.

Ms O'CONNOR - The regulation you slipped through.

Mr FERGUSON - While it is on the - I will just get the correct name of the server - the National Driver Licence Facial Recognition Solution. Until the Australian Government's legislation has passed and the Tasmanian legislation is reviewed to confirm that it complements and supports that Commonwealth legislation, the Tasmanian data that you refer to is not accessible by any other government or authority and remains -

Ms O'CONNOR - Or private entity?

Mr FERGUSON - and remains secure in a separate segment and I can include in that a private entity, can't I? Now, to answer your question directly, the number which I'm happy to be transparent about - 442 744 Tasmanian driver licences are replicated in the secure Tasmanian segment of the NDLFRS and, again, I have to reinforce it is accessible only by the Department of State Growth.

I’m not a lawyer and I'm sort of glad I'm not a lawyer often but I hear what you're saying on behalf of other people and I respect their opinion but I have also to take advice from my department on this who also have access to legal guidance. There has been some significant ignorance on this point by some people. Images have been collected, stored and printed on driver licences in our state since 1992. It is about when I got my Ps. The secure sharing of driver and vehicle information between states and the Commonwealth has been in place since the late 1990s through a different named system which achieved similar things. The national exchange of vehicle and driver information system, NEVDIS, was implemented in Tasmania in 2006.

I know it will not make you happy, but the fact is Tasmania, Victoria and South Australia have also loaded their data into their segregated partitions within the service and other states and territories are expected to be also loading their data progressively through 2020 and 2021. Please bear with me, I want to find one other point for you. This is important but I think it will add to the record which is very useful. It should allay people's concerns actually. I have not seen the federal legislation yet.

Ms O'CONNOR - No one has.

Mr FERGUSON - I do not think it has been tabled or presented. The federal government has had their mind on the pandemic as well.

The main use of the face matching service is about preventing and detecting identity fraud and will be used by document issuing agencies to verify a person's identity. Pretty important. The investigation of the most serious crimes law enforcement agencies will have an ability to search for an identity based on a photograph. Access to this capability will be restricted to accredited and trained personnel within law enforcement agencies.

Ms O'CONNOR - How do we know? We have not seen the legislation.

Mr FERGUSON - Until that legislation is presented, only the Department of State Growth has access to that data. I am advised that FMS cannot be used to identify a face in a crowd by linkages to CCTV or other forms of surveillance. Notices regarding the use of the face matching service are on all Tasmanian licence application forms and renewal notices. Obviously, privacy is paramount. It is to me as well as you. A comprehensive set of safeguards has been developed in consultation with federal and state privacy commissioners.

It is very important to note that the new system will use computer programming to generate a code based on distinctive facial characteristics that is unique to each face and cannot be mimicked. What does this mean? What this means is that it is code, not the photograph, which will be used to confirm an identity or determine attempted fraud or identity theft using another name.

I round this out with this very clear difference because people have all sorts of incorrect assumptions about how this service in the future will work. The primary use of the data is to provide not a photograph, it does not give the photograph back out of the server to let you compare with your sourced document.

Ms O'CONNOR - No, it reduces us to a set of numbers.

Mr FERGUSON - Not even that. The primary use of the data is to provide a yes or no response to a one on one image test while other details will be accessible by relevant law enforcement agencies for the investigation of a serious crime. In all cases appropriate security and all the controls will be in place to monitor access.

I invite you, Ms O'Connor, to have another look at your position on this because the primary use of that database, and you should expect, and you are entitled to expect, that it be secure and robust and protected in terms of outside influences and hackers, but the primary use of the data is a binary answer coming out of the system - yes/no. It is a match or it is not a match. For the applicant seeking a matching test they have to have a photograph that has been sourced from some voluntary location. It is not taking our Tasmanian driver licences information and sharing it with anyone else.

Ms O'CONNOR - The question is one of consent. We know that tens of thousands of drivers did not give their consent. Perhaps you could tell the committee how many people have applied for a driver licence renewal in 2019 20, and I am happy to put this on notice, and of that number do you know how many were done in person via the online option for Service Tasmania, and how does that compare to the previous year? The reason I ask that question is that it was in 2018 after harvesting these images without consent, that you changed the information on the driver licence applications so that people by default give their consent, but prior to 2019 20 they did not.