Senator the Hon Katy Gallagher

PODCAST EFTM 

TREVOR LONG, HOST: I accept and acknowledge that I may have opened a can of worms last week. And I thought I was doing the right thing by opening many strategic cans to inform you, dear listener, on a, I think, really important issue of digital ID. Recapping, I spoke to Victor Dominello about this, I don't know, a year ago. I spoke to a young lady called Grace who runs a company called My Databoss, maybe three months ago when I was in London, about her plans for it and how, as a third party company, there was integration and things like that involved. But I still felt I didn't fully understand it. I knew there was opposition to it out there. So, I spoke to Senator Malcolm Roberts last week. And look, he has views, and they were deep. And he went into a lot of other things, which – I didn't want to be rude and cut him off. So, I just let him go. And it was a bit interesting and whatnot. But there is opposition and there's concern about the digital ID. So let's cut straight to the source and let's talk to the Minister of Finance, Katy Gallagher. She knows this, this is her legislation, it has passed. Let's understand it. And the Senator joins me on the line now. G’day, how’re you doing.

SENATOR THE HON KATY GALLAGHER, MINISTER FOR FINANCE: G’day, thanks for having me on.

LONG: Look, thanks for coming on, because I feel like I'm bringing you into an argument that I shouldn't have created. But I should have just got you on three months ago and talked about it then, but anyway, we won't do that again. What I want to do is I want to educate my audience, average Australians about the digital ID. So let's just start with the very basic principles of how you, what's your elevator pitch for the digital ID? What is it?

GALLAGHER: Well, I guess it's a way where you can prove who you are without having to share all your documents all the time. And that's been a problem in the past, as people know, with – you know, if you sign up for a phone plan, or you're getting a new rental in place. You know, you're always having to hand over all your documents, whether it's your birth certificate, your passport, your utilities, bills, and all of these different places store that. And I guess the digital ID gives people the opportunity to prove who they are once, to, you know, the verifying body, and then you use that process to basically prove who you are when you go and do all the other things you do. When you're, you know, in the I guess digital world that we're all living in. So, it's actually a way of reducing the amount of information people hold about you and making sure you control who shares information about you.

LONG: And given what we've had in the last couple of years with major hacks of public companies like Optus and Medibank, you know, that data is out there. We essentially could have avoided that if we were digital ID decades ago, because that information is never stored by the organisation. The idea is, if I sign up to a telco and prove myself through my digital ID, they simply get a tick that says “yes, Trevor Long, confirmed” – they don’t get my driver's license, my passport details, they don't get that information.

GALLAGHER: That’s exactly right. So, you've just explained it better than I did, to the first question. But that's right. I mean, we're already living in a world where hackers can, you know, undertake hacks on different companies. And we've seen that with Optus, with Latitude, with MediSecure and many others. So, a lot of Australians have been touched by those breaches. And so this is really, you know, reducing the amount of ID you hand over about yourself. And from the government's point of view, I think we've got about 12 million people who have signed up to myGovID. So, that's the government's digital ID. And so, there's a lot of people that are using it already. I guess the vision we have is that now this legislation is passed is that, you know, the private sector will have their digital IDs, the state and territory governments have a version, but we're all working under the same model where you're all accredited. You know, your systems are tested, so people know that it's working, and it's safe and secure. And then people feel more able to I guess use the tick or the verification rather than handing over all your documents.

LONG: We mere mortals don't live and breathe parliamentary process. And Malcolm Roberts brought up a concern that this passed without debate and any conversation around amendments. Is that rare? Or is that pretty standard when it's a well-supported bill?

GALLAGHER: Look, it happens from time to time and usually because the Senate, you know, takes – well, it takes a long time to get anything through the Senate. And sometimes when you’re reaching the end of the session, we have to push legislation through that – you know, it might be time critical, or we just need to get it done. So it isn't that unusual. I know Malcolm had a view about this one, but it's been consulted on since 2017. There's four rounds of public consultations, there were exposure drafts. I've just met with some of the staff who've been working on it, they’ve been working on it for a decade. So, it's not as if it was a surprise to anyone. And we did respond to the some of the Senate committee inquiry into the legislation. But ultimately, Malcolm wasn't convinced, Senator Roberts wasn't convinced, haven't been able to do that. So, he wasn't happy with it. But we got – you know, this basically ensures that the system is regulated. MyGovID’s been operating for years, but not in a regulated model. So, this provides an extra layer of protection for people.

LONG: Let's address the potential concerns, which is things like, it makes compulsory with the government to access your data and create your ID. What's – what level of this is compulsory?

GALLAGHER: So with the legislation we passed, and certainly on all government services, we've said it's voluntary. So, that means for people that don't want to be in it, fine, you don't have to be in it. And there's people that won't want to be in it. But for people who do want to be in it and want to set one up and sort of ensure that they only have to prove who they are once, then this is the way to go. But it is absolutely voluntary. I recognise Australians do not like being told that they have to do something with government. And this gives them the option.

LONG: Your job is just to convince them that it's going to be easier for them. As you said at the very start, it's about making things easier. And I think once one person says, “oh, no, I just did this,” and someone else is pulling out 16 pieces of paper – you'll kind of be convinced as we go along. I guess that's the theory here, that over time, through word of mouth, let alone through actual marketing or conversations, people will realise it's probably going to be easier to do things this way.

GALLAGHER: Yeah, exactly. And as I said – I mean people will have used, I think many people – well, we've got 12 million who use myGovID and they have those accounts set up. There's 140 services across Commonwealth, state and territory governments that it can be used for. Now, I guess people want an example of how's it gonna make my life easier – so, say you have a baby, you haven't engaged with Centrelink before, you can get – without taking the baby and everything into a shopfront – you can apply for your Centrelink Customer Reference Number. So, we need to really know that you are who you say you are, but you can do that once you've got a digital ID set up. I guess the other option is, we've now got stat decs online. So, anyone who's gone and got a statutory declaration process, you know, when you've had to find a Justice of the Peace or whatever – it can be really difficult and there's times when you need to get one. Again, with this, you can do a stat dec online if you've got a digital ID. Saves people a lot of time and effort. So more and more, I think you'll see different, you know, ways that you interact with government – and probably more often the private sector once they get theirs up. Optus, I notice are advertising pretty heavily their digital ID at the moment.

LONG:Yep.

GALLAGHER: And you know –

LONG: Probably a good idea for them.

GALLAGHER: Yeah, exactly. It's been – you know, in their recovery from their breach, they want to make sure they that customers think their data is going to be protected and they don't have to share it all the time. Or hold it. Like, if they don't even have to hold all that information about you, there's much, much less information available for hackers.

LONG: One of the concerns again that I heard from Senator Roberts – and I'll be honest, I didn't challenge him directly on it because I want – this show is not the Ray Hadley School of talk-back. I may come from that school and I worked with Ray for many years, but I’m not here to have an argument with the bloke –

GALLAGHER:That’s a relief for me.

LONG: Yeah, well, I could if I wanted to! No, but I'm not going to. He talked about data breaches. And for many, many years, and even during the Optus and the Medibank and all those kinds of things, I was, you know, very vocal about my commentary on those breaches. And I said for a long time, you know, private companies are exposed far more than governments ever are. And I don't remember an instance where a government has been breached in any major way where data has been lost – because frankly, banks and governments are held to a higher account on a technical level, let alone risk level. So, when someone in opposition to the digital ID – like Senator Roberts – says, you know, you'll see defence data breached, NDIS data breached, health data breached, that didn't feel factual to me. I feel like we are in a better space when it comes to the protection of data under the government than through the public or private sector.

GALLAGHER: Well, there's been a lot of things said by a lot of people that aren't right about digital ID, and it's usually a lot of things about what digital ID isn't as opposed to what it is. And you're right. I mean, government has a lot of information already that it holds at a state, territory or Commonwealth level. So, people who engage with Centrelink, we've got data on that. If you've got a passport, you've had to provide quite a bit of information about who you are – whether it be a birth certificate, you know, all those different points. The same with banks. So yeah, look, – I mean, we're always worried about it, like you're always making sure that your systems are as strong as they can be. And of course, you know, we know that governments are often targeted. But yeah, we haven't had any significant data breach. It's something that we keep an eye on all the time. There's been – I mean, I think if I was to give Senator Roberts, you know, to be generous to him – he's used a couple of examples I think where it was something other than a data breach. There was a problem, but it wasn't a data breach. And again you know, this is something that we keep very close eye on. And I acknowledge that people need a level of trust when they're engaging with the private sector or government about the information they hold. And one of those I guess levers of trust is us saying, look, we don't want you to be sharing, there's too much information sharing about your data going on already. This is a way to reduce it. And for you to have control over it.

LONG: Well, this is more to my fundamental understanding of the digital ID, but there is no one central database of information, is there?

GALLAGHER: No.

LONG: This is all about bringing together a bunch of – so, when you sign up for myGovID and I did it the other night for my mum, you know, you get your passport out, you get a couple of points of ID out, and it does this amazing verification of you, but it does it one thing at a time. So, driver's licence, when it does that, I assumed the myGovID service, you know, has a digital conversation with services New South Wales and says, yep, good, excellent. And then it goes off and says to the passport office, yes, good, excellent. But it doesn't download and store that data in one database. It simply, again, ticks a box. So it actually is far less risk because the data is broken up into its parts.

GALLAGHER: That's absolutely right. So, there's no single centralised database with all your personal information. It's exactly as you explained it. So, it's all of the dispersed locations where original ID information is either – you know, is issued by the state, territory or Commonwealth agencies. So, there's all those digital conversations and in the end, if that all lines up, then you know you're given access to whatever you want to try and do at that point in time. So, I mean, I agree, it is hard to explain exactly what it is, because it's not like you're issued with a card or a number or anything like that. It's a way of verifying who you are by using existing sources of information and making sure there isn't actually a centralised database with all of this information helpfully collated together for some nefarious purpose. That is – it's the opposite of what we want to happen.

LONG: Help me understand the big final thing that I have not fully understood. And I don't know whether it's easy to explain, but the third party part of this – so, I spoke to this young lady who runs a company called My Databoss and I know there's others out there that want to be a digital ID. They want to be a an app or something that you hand over. I expect that in three years from now or something like that, when you sign up to a telco or whatever it is to prove your ID. Like there is at a checkout, when you're shopping online, there's a PayPal button, there's a Visa button, there's a Shop Pay button. There's all these different buttons. Is it the case that there'll be different ways to choose as an individual how you prove your ID, one of them might be myGovID, one of them might be My Databoss, one of them might be you know, Joe Blow’s digital ID? Is that the process or the concept for the future of third party digital ID apps? And how do they get controlled?

GALLAGHER: Yeah, so the idea is that it is an economy-wide digital ID system. So, a trusted system. And so, people who are wanting to develop their own digital ID would get accredited under the legislation. So that means you meet certain tests, the ACCC is going to be the regulator of that. And once you are through that system, you'd have, you know, probably, a trust mark that you'd be able to use on your digital ID, but that you would be able to then, you know – for example, in the future, one of the hopes we have is that those digital IDs can talk to government and private sector companies in terms of verifying who you are. I think there's still a question about whether there's some things that the government has that we probably want to maintain, and say, look, if you want to access this, you really do need to use a government ID.

LONG: So, Joe Blow digital ID might not let me log into my ATO account in the future. That’s a hurdle that might be too high.

GALLAGHER: Exactly. I mean, they’re some of the things that we're just still working through. Are there some core things from a trust point of view that the Australian community would say, look, I think that actually, you know, if you're going to do that online, we want a government – the myGovID. But for the large part, if someone doesn't want to have a government ID and they want to use you know, for example, a telco or a bank one, then they should be able to you use that, if it's accredited under the system, to verify themselves with a whole range of you know businesses. So, that's the idea. It's like it's all been designed to make it seamless, but also standardised so that everyone's playing under the same rules. And people know that it's trusted, it's gone through an accreditation process. And also, if you've got a problem with it, that you've got a right to pursue that through the regulator.

LONG: And in simple terms, the legislation has passed, the gates are open, the digital ID is real now and myGovID’s the first instance of that. And people can now look at that as potentially being rolled out in other places. So, we may start to see that myGovID verification appear in other places other than government services from this point forward.

GALLAGHER: Yeah, like, that's right. I mean, the system has been operating for a while people go what, I've already got a myGovID? So, yeah, that's true. But it hasn't been working in a regulated model. So, this is putting laws around it to make sure it's safe and trusted. And I believe that will certainly ensure that we've got more people coming in under that scheme. So you know, and more and more, I guess, companies are looking for this as well. Like you said, your guest who’s a small business or a tech company, by the sounds of it, you know, they're going to want to ensure that they can say to their customers, this is safe, you use us? Safe. This is this is the system we use. So, I'm really optimistic about it, but we have to be cautious. We have to make sure that we're doing it right, dotting the i's, crossing t's, all the rest of it. And I think there's some people like Senator Roberts that I'm not going to convince, and that's fine. Because they can just continue engaging with services the way they've always done, which, you know, might involve them sharing information with a whole range of companies.

LONG: Just finally, censorship, currency. How does digital ID – this is a Malcolm Roberts debunking here. You know, he did go into a major, major whole other rant about misinformation bills, the central bank, digital currency. Oh, my God, I nearly lost my mind. But there is no conspiracy behind this from the government to make us all move to a Bitcoin-style digital currency, is there?

GALLAGHER: No, it has absolutely no relationship to that. I know there's a bit of that online within certain groups.

LONG: Wait, there’s fake information online?

GALLAGHER: Yes, I know.

LONG: This is unbelievable.

GALLAGHER: Go figure. It has no relationship with misinformation or disinformation, has no relationship with the central bank, digital currencies. It is not about creating new identities. It's not about taking all your information and selling it. All of these things that I've tried to go through with some senators, it's none of those things. It's simply a way of reducing the information you share and you being able to prove who you are without getting your passport, your electricity bill, your birth certificate, you know, your rates notice, your mortgage account, without providing all of that to anyone you want to talk to.

LONG: Great stuff. I'm excited about it. I think the average – as you said 12 million people are using myGovID already and we’ll start to see it in other places and it'll make your lives easier. And hopefully in the future when there's data breaches, which are inevitable in many ways in certain companies, it's just life – they won't result in the loss of our information on this on the scale it did before. Appreciate your time.

GALLAGHER: There's heaps of information on the myGovID site too if people want to go and read more about it. Yeah. Thank you for having me on. Appreciate it.

LONG: Thank you minister.

GALLAGHER: Thank you.