Thursday, 15 August 2019

 Mr DAVIS (Southern Metropolitan—Leader of the Opposition) (18:23): My matter for the adjournment tonight is for the attention of the Premier, although it does concern the Minister for Public Transport, the Special Minister of State and other ministers across government. The bombshell report today by the Office of the Victorian Information Commissioner, Disclosure of Myki Travel Information: Investigation under Section 8C(2)(e) of the Privacy and Data Protection Act 2014, is an absolute shock. The commissioner said a range of things, but he points to a serious contravention of Myki data: 15 million pieces of Myki data released without proper controls, data that can be reverse engineered to find out personal information about hundreds of thousands of Victorians. It is an absolute disgrace. Today’s report, according to the commissioner:

… demonstrates that deficiencies in governance and risk management in relation to data can undermine the protection of privacy, even where the project is well-intentioned.

He went on to say:

Where a dataset contains unit-level data about individuals, especially where it contains longitudinal unit-level data … such material may not be suitable for open release, even where extensive attempts have been made to de-identify it.

He also stated:

The evidence before the Deputy Commissioner suggests the identities of individuals can be extracted from the dataset with relative ease.

PTV has provided no persuasive evidence to the contrary, and has instead relied on technical arguments about the definition of personal information. The facts before the Deputy Commission show that the dataset contains a wealth of information about the travel movements of Victorians, which was disclosed with no effective controls in place to guard against re-identification.

This is a story in Daniel Andrews’s Victoria, and he has form with data manipulation back in the period before 2010. He also has bad form with respect to this recent plan for city-wide monitoring and the information that is been put out on that tender. I for one do not feel comfortable about that matter. He went on further and said ‘the failure to take reasonable steps to protect the personal information contained in the dataset from disclosure’. He said that the steps taken by Public Transport Victoria (PTV) in considering Data Science Melbourne’s request for the provision of Myki data were inadequate and not reasonable to protect it. He issued a compliance notice.

Now, what particularly concerns me is that the Department of Premier and Cabinet (DPC), the Department of Transport and PTV are pushing back against the independent officer here. DOT has carefully considered the report and does not accept the finding:

Our position remains that a Compliance Notice was not warranted in the circumstances.

I mean, this is like being pulled up by the cops and saying, ‘No, no, you can’t fine me. I’m above it’. Well, an arrogant Premier with his department has got to intervene, pull in line these agencies—the DPC, the Department of Transport and PTV. Even DPC does not accept the Office of the Victorian Information Commissioner’s findings, that release of the Myki dataset— (Time expired)