25th International Conference of Data Protection and Privacy Commissioners

 

10-12 September 2003, Sydney

Malcolm Crompton

Australian Federal Privacy Commissioner

 

Welcome Speech

 

Ladies and gentleman. Welcome to the 2003 International Conference of Data Protection and Privacy Commissioners. I'd like to begin by acknowledging the Gadigal people of the Eora nation, the traditional owners of the land where we are meeting today. Let me introduce Mr Lee Madden of the Metropolitan Aboriginal Land Council to deliver an Aboriginal welcome to country.

Welcome to our Silver Anniversary. I also bring you messages from two former Commissioners who, regretfully, are unable to join us: Elizabeth France, who hosted the 24th Conference, and Stephen Lau, the former Commissioner from Hong Kong.

Yes, this is the 25th of these International Conferences. A lot has changed in the privacy world since the first of these conferences in Bonn in 1979. And a lot has stayed the same! Indeed, as I looked over the program of this conference the last time it was held in Sydney, in 1992, I formed the same impression.

The welcome to country we have just been privileged to receive brings home the fact that Australia's cultural heritage is drawn from a complex mixture of forces, beginning with Indigenous Australia. With the arrival of Europeans some 230 years ago and the waves of migration that have followed, Australia's community is now drawn from a very wide range of the world's cultures.

Australia, and Australians, are developing significant experience in protecting privacy, and there is no doubt that our particular approach has been strongly influenced by our rich and complex heritage. It is a product of where we have come from, where are now and where we wish to go in the future.

Extensive privacy regulation in Australia had to wait until the late 1980s. But privacy was nonetheless an important topic of public debate for Australians throughout the 1960s and 1970s. For example, Sir Zelman Cowen, later one of Australia's Governors-General, in 1969 made a significant contribution to public debate about privacy through his nationally broadcast Boyer Lectures, titled The Private Man. Sir Zelman made one point, in particular, that I will share with you.

[O]ne who argues for the imposition of restraints in the interests of the protection of privacy cannot do so in absolute terms. The constant search, in democratic society, we are reminded, must be for the definition of a proper boundary line in each specific situation and for an overall equilibrium that serves to strengthen democratic institutions and processes.1

Here Sir Zelman is pointing to something that has struck me forcibly about privacy. That is, its subtlety. It would be very nice to think that there was a single right way to ensure that privacy is respected. However, as Sir Zelman is hinting, there are no absolutes. What we are seeking to achieve in each case is some kind of balance, some kind of equilibrium. An equilibrium that takes into account the values, the culture and history of the particular society with which we are dealing. An equilibrium that takes into account other very important human rights, economic imperatives and technological developments.

 

1. Cowen, Z. The Private Man: The Boyer Lectures 1969. Australian Broadcasting Commission, Sydney, 1969, pp. 8-9.

However, I am firmly of the view that achieving a society that respects privacy is even more subtle than this. We are also faced with the fact that nothing stays the same. And nothing is staying the same even faster than ever before! Politics change, cultures evolve, economies grow and decline, and technology develops. And as they do, the prior equilibrium must shift. The challenge for all of us working in the privacy area - regulators, legislators, commentators, advocates, data handlers - is to come to terms with the reality that effective respect for privacy is dynamic. What we are seeking is a dynamic equilibrium.

Dynamic equilibria are commonplace in the natural world: plants, animals, and entire ecosystems manage to endure while continually adapting to changes in the environment around them. Rivers endure even though their exact course changes over years and centuries. In the same way, privacy itself can endure through changing circumstances because the best way to respect privacy will change with the circumstances. Like particular species and whole ecosystems, extinction faces systems that fail to adapt.

Operating in this dynamic environment requires anticipation. In Australia, we had the benefit of the forward looking work of jurist Michael Kirby. The Expert Group which developed the landmark OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data was chaired by Justice Kirby. He was also responsible, in his role as Chairman of the Australian Law Reform Commission, for a groundbreaking report on the need for privacy legislation in Australia. This report, although published in 1983, anticipated a range of technological developments that were only in their very early stages, and it remains an important reference for privacy policy thinking in Australia.

Since then, there has been a total transformation in the way information moves around. For example, many of us have recently heard a lot about radio frequency ID chips (RFIDs), and mobile phone cameras. Of greater real import, however, is the networking of the world which is proceeding at a staggering pace. No longer is it just an 'Internet' of computers. Also connected are surveillance cameras, Global Positioning Systems, mobile phones, home appliances, cable and satellite television, all watched over by a connected satellite imagery of ever higher resolution. This interconnectedness is increasing and creates new, very intimate data sets with the potential to track and understand our every move.

Elsewhere, we see new and significant challenges too, not the least in the area of genetic and medical data. How are we to capture the wonderful improvements to our daily lives that many of these developments offer, in a way that truly respects privacy?

I said earlier that approaches to privacy depend very much on where you have been, where you are and where we wish to go in the future. In the case of Australia, one of the circumstances probably most responsible for etching privacy into our contemporary cultural and political consciousness was the astonishing strength of public reaction to a Government proposal in the mid-1980s to introduce a national identification card. Rather symbolically, I think, it became known as the 'Australia Card'.

The idea of allocating a single Government number to each individual, in conjunction with a card containing a photograph and a signature, seemed to be a straightforward solution to pressing issues such as tax and welfare fraud, and the pressures toward what we might now call 'joined-up government'.

As the detail of the proposal emerged, however, and the practical consequences of having to carry and produce the Australia Card became clear to Australians, the groundswell of opposition escalated at a phenomenal rate. A group of prominent Australians from a very broad political spectrum formed together, and, in the space of only a few weeks and months, tens of thousands of people were marching in the streets across Australia. And remember the global context: 1984 had passed only four years earlier and the Berlin Wall fell only a couple of years later.

When the Australia Card was just another political proposal, it didn't generate much debate. Once the practical consequences were made clear, and were imminent, Australian passions were roused in a way that took many commentators, and the Government, by surprise.

As a consequence, we in Australia have had to explore a range of different solutions to the important issues the Australia Card was trying to address. And I am absolutely convinced that the dynamic subtlety associated with respecting privacy means that we must continually look for different ways to tackle it. We have to find solutions that fit the particular combination of society, culture, history and technology with which we are dealing at the time.

For example, we can now regard the Australia Card approach as a 'stone age' solution to a set of pressures, but pressures that remain. Perhaps the core problem is the increasing need to manage the authentication of assertions that people make, including, but not limited to, assertions about a person's identity. Technological change has worked to change the landscape of this issue quite remarkably. In my view, we would be missing a tremendous chance if we do not also exploit the great potential offered by all these new technologies. The challenge is to ensure this includes the potential to ensure that authentication challenges can be met at the same time as maintaining, or even enhancing, the dignity and privacy of individuals.

This is why you will find that I often talk about discovering privacy 'solutions'. It reflects my concern that we must be effective in what we do. I believe that, in recognition of the complexity and subtlety of respecting privacy, to achieve results that have a real impact on the everyday lives of individuals, we must be prepared to explore a number of possible ways in which privacy can be respected.

Sometimes respect for privacy can be delivered effectively by law, and it is often delivered effectively through regulators such as Privacy and Data Protection Commissioners. But it can also be delivered through social mores, and through technical and practical measures. Because regulators and legislation cannot on their own deliver privacy, it is fundamentally important that we develop a culture of respect for privacy throughout the community that operates from its own momentum. Where you have a culture that respects privacy, agencies and organisations must also operate in that way because it will be in their interests to do so, rather than because the law says they must.

If we look around the world we can see the different ways that countries are seeking to meet this dynamic challenge, taking into account their particular culture and history. For example, in our region, the Asia Pacific Economic Community (APEC) is developing a set of privacy principles. Also, a study group of the Asia-Pacific Telecommunity (APT) is working on Guidelines on Personal Data Protection in the Asia Pacific region. Many countries in our region have recently passed, or are in the process of developing, data protection and privacy legislation. These include: Japan, India, Pakistan, Thailand, Malaysia, Mexico, South Korea, Taiwan and the Philippines, many of which countries are represented here today. The result can be an equilibrium that suits each country and region.

The ultimate challenge for all of us, however, is that at the same time as we recognise that privacy is contextual, we must also operate in a global environment. Achieving equilibrium in our own jurisdictions or regions will not be enough. The only way we will all be truly effective is if we take a global approach. We must all be willing to learn from, and appreciate, the varied cultures and histories from which we have emerged, and with which we interact. Only in this way have we any hope of finding practical solutions that reflect all these differences appropriately.

With the theme of 'practical privacy' this conference seeks to explore a very important question that must form part of any privacy framework. That question is, 'are we making a difference - are we being effective?'

And this is not a question we need to ask just once. Because the equilibria have to be found in dynamic, changing social contexts, we have to pose questions about privacy again, and again. It is a cyclical process; a constant movement between considering matters of important principle, followed by checks to see how effective the practical applications of the principles have been.

Looking back at the themes and concerns of our international conferences in the past illustrates this dynamic interaction of principle and practice. Some have focussed on privacy as a human right and a democratic value. Others have focussed on implementing privacy in a particular context, for example, in the Information Technology environment, or on the fact that privacy is fundamentally about people. I look forward to a conference next year that contributes further to this dynamic process by taking yet another approach to exploring the many dimensions of respecting privacy.

To find out whether we are being effective, we need to develop and continue a dialogue with those trying to implement privacy principles; the businesses, health services, charities, and the government agencies. We need to talk to other government regulators who are trying to achieve similar ends, or who may have regulatory powers in overlapping areas. We also need to talk to and hear from people in the street, and those representing them. And of course we need to consider matters that are of current and pressing importance.

This is why, immediately after the 24th Conference in Cardiff a year ago, I established an informal, international advisory board to help me plan the shape and scope of this conference. I included on it Data Protection and Privacy Commissioners, and similar regulators, people from the private sector, and from consumer groups. They were a great help through the process of planning and I am immensely grateful to them.

And now, this week, we can talk to, and hear from, all of these groups. The conference seeks to focus on issues that are of immediate practical significance today. All of the influences that I have mentioned culminate in the theme for this Conference: "Practical Privacy for People, Government and Business."

During the conference we will address the issue of building trust, and explore privacy in the global context. We will hear from organisations in the public sector and the private sector about the real efforts they are making in respecting privacy. We will hear the views of the individuals affected by them. And we will hear the perspective of Commissioners on all this.

I expect that we will also gain greater insight into ways to achieve, in the current climate, that very delicate balance of having a safe and open society that also maintains compassion, forgiveness and individual dignity. Pressures to find a new equilibrium have been developing for some time, but the global response to terrorism - symbolised dramatically and tragically in the events of September 11, 2001 - has accelerated the pace of change.

I have talked much today of challenges, and in particular, that of promoting and nurturing respect for privacy. When we consider, in particular, the global scale of the task, it could seem daunting. I am most heartened by the willingness of so many people in this room to come together to consider the issue. It is evidence of the great resources, energy and good will available to tackle that challenge. Viewed over the long course of history, I am immensely confident of the future.

My Office's purpose is to promote an Australian culture that respects privacy. I hope that by addressing the range of practical issues and challenges that will be raised over the next three days, we will all of us have taken some significant steps in promoting a global culture that respects privacy.

I declare the conference open.

References:

• Clark, R. (1998) "A History of Privacy in Australia." Available at http://www.anu.edu.au/people/Roger.Clarke/DV/OzHistory.html.
• Privacy Victoria. "A Brief History of Information Privacy." Available at http://www.privacy.vic.gov.au/dir100/priweb.nsf/download/6551D9BEE768D457CA256C520023230E/$FILE/07.pdf
• Clark, R. (1987). "Just Another Piece of Plastic for your Wallet: The 'Australia Card' Scheme". Prometheus Volume 5, No. 1 (June 1987). Available at http://www.anu.edu.au/people/Roger.Clarke/DV/OzCard.html.
• Greenleaf, G. "The Australia Card: towards a national surveillance system." Law Society Journal (NSW) Volume 25 No. 9, October 1987. Available at http://austlii.edu.au/itlaw/articles/GGozcard.html.
• Davies, S. "Campaigns of Opposition to ID Card Schemes." Available at http://www.privacyinternational.org/issues/idcard/campaigns.html.
• Proceedings of the 14th International Data Protection and Privacy Commissioners Conference, 27-29 October, Sydney.
• Davies, S. (1992). Big Brother: Australia's Growing Web of Surveillance. Simon and Schuster.