The Immigration Department would seem to have really messed up.
Asylum seekers’ identities revealed in Immigration Department data lapse
Exclusive: online database provides personal details of almost 10,000 people in serious and embarrassing security breach
- Oliver Laughland, Paul Farrell and Asher Wolf
- theguardian.com,
- Wednesday 19 February 2014 11.09 AEST
The personal details of a third of all asylum seekers held in Australia – almost 10,000 adults and children – have been inadvertently released by the Department of Immigration and Border Protection in one of the most serious privacy breaches in Australia’s history.
A vast database containing the full names, nationalities, location, arrival date and boat arrival information was revealed on the department’s website, raising serious concerns that thousands of asylum seekers have had confidential details made public.
Every single person held in a mainland detention facility and on Christmas Island has been identified in the database, as well as several thousand who are living in the community under the community detention program. A large number of children have been identified in the release, which also lists whether asylum seekers are part of family groups.
The breach raises serious questions about whether those identified could be placed at risk of retribution if they are returned to their countries of origin.
The disclosure of the database is a major embarrassment for the federal government, which has adopted a policy of extreme secrecy on asylum-seeker issues.
The asylum seekers named, range in age from newborns to people over 80. They come from countries including Sri Lanka, Afghanistan, Iran and Syria and arrived in Australia as late as September. Some have been in detention for more than 1000 days.
Much more here:
After the event we have the Privacy Commissioner leaping into action.
Privacy commissioner to investigate immigration department
Department confirms report that a file with personal details of asylum seekers was publicly accessible
- Rohan Pearce (Computerworld)
- 19 February, 2014 12:38
Federal Privacy Commissioner Timothy Pilgrim has confirmed he will investigate how a file containing the personal details of asylum seekers was made available to the public through the immigration department's website.
The Guardian this morning revealed the security lapse by the department.
The Guardian article by Oliver Laughland, Paul Farrell and Asher Wolf reported that the "vast database" contained the "full names, nationalities, location, arrival date and boat arrival information" of asylum seekers.
The file contained the details of almost 10,000 people, including every asylum seeker imprisoned in on-shore detention centres and on Christmas Island, as well as those in community detention, the newspaper reported.
"This information was never intended to be in the public domain," an immigration department spokesperson said in a statement sent to Computerworld Australia.
Lots more here:
Here is the link to the Commissioner’s statement:
We look forward to the explanation of what happened and some assurance that this won’t happen elsewhere.
The Privacy Foundation also seems to be keeping the Privacy Commissioner busy.
Go here to download a range of letters to the Commissioner from the Foundation.
Some extracts:
“Dear Commissioner Pilgrim,
Re: Privacy and the electronic health records: Victorian healthcare service
The Australian Privacy Foundation (APF) is the country's leading privacy advocacy organisation. I am writing in my capacity as Chair of the Health Committee of the APF.
APF has received communications from clinicians, patients (some now deceased) and information technology specialists who are anxious about the security and privacy of ehealth records. In particular, serious concern has been expressed about records that are curated by a regional health care service in Victoria. This would of course be in violation of privacy law and guidelines.
On the basis of the information APF has received, it appears that private e-health records at the regional health care service are accessible via a web browser after authentication - that is the provision of eligible user names and passwords. These are often transmitted in clear text without encryption over the Internet. Of two access portals shown to some of these concerned individuals, one permitted access using a plain http connection, that is no security, while another appeared to use SSL, a more secure http connection (https).
Further, specific security and privacy concerns expressed by the individuals are that:
1. Authorised user names and passwords can be intercepted.
2. Private data is revealed; the scope of the data includes most present and past patient
details, including full name and contact information, test results and diagnoses.
3. These individuals claim that security protocols around user names and passwords are
virtually non-existent or not enforced.
And.
Dear Commissioner Pilgrim,
Re: Privacy and the PCEHR record
The Australian Privacy Foundation (APF) is the country's leading privacy advocacy organisation. I am writing in my capacity as Chair of the Health Committee of the APF.
I refer communication received by a patient who was asked to sign up for the PCEHR by her General Practitioner (GP) during a medical consultation. The patient was anxious that her concerns did not receive adequate response when she consulted both her GP and your
office.
Her concerns are as follows:
“Information uploaded to my PCEHR will be kept for 30 years post mortem or 130 years if DOD unknown.
If I change my mind and wish to withdraw, while the information can be "cancelled", it is not deleted: it will still be kept as above and may still be accessed.
While we would expect that the information could be used only for health care, this is not so: it may be used also for law enforcement, medical indemnity insurance and other purposes.
Health care providers sign a participation agreement, which assigns all intellectual property rights to data uploaded to the PCEHR to the government. These rights can never be revoked, even on termination of the agreement.
Full access to my data may be gained from any PC in the country configured with NASH certificate, by invoking the "emergency access" criterion.
There is no guarantee that the government (System Operator) will not attach unspecified additional data to my PCEHR, without my knowledge or consent.
With the possibility of the Minister's review resulting in the scrapping of the PCEHR system now or later, there is uncertainty over what will happen to my data.
With less than 1% of those who have registered actually uploading shared health summaries, what use is the system anyway?
If I were in your position [the patient’s GP], I would be looking at the penalty provisions, which can amount to over $17,000 for individual and over $85,000 for body corporate and to whether my indemnity will cover me against possible action in connection with PCEHR.”
More at the web site above.
Seems there are some hard questions to be answered here. We need to keep an eye out for some answers.
The results of the investigations might appear here in due course:
It will really be interesting to see just how effective the Privacy Commissioner will be in creating improvement. Certainly the Asylum Seeker Incident should result in the relevant CIO leaving the public service.
David.
No comments:
Post a Comment