A. Introduction and Overview

1. Objective and Scope of this Preliminary Assessment

The E-government Unit (EGU) of the State Services Commission (SSC) has undertaken this initial Privacy Impact Assessment with the objective of identifying and assessing the privacy implications of the proposed models for online authentication for e-government.

While there is as yet no standard definition or common form of a Privacy Impact Assessment, the Office of the Privacy Commissioner has indicated the areas and issues that such an assessment should consider [ Privacy Impact Assessment Handbook, OPC Publication, March 2002]. This preliminary assessment adopts the approach suggested in the Privacy Impact Assessment Handbook.

This assessment:

• describes the reason for, and nature of, the proposed online authentication models;

• describes at a high level, the intended information flows and requirements of the four models that are currently being discussed with agencies and members of the public;

• recognises that a single 'preferred' option will be presented to Cabinet;

• reviews on an initial basis and at a reasonably high level for each of the four models;

• the actual and potential impact on privacy of electronic authentication; and

• the legal implications of electronic authentication.

This assessment aims to objectively consider the relative impacts (the potential for adverse effects on privacy) compared to the benefits (achievement of the policy objective). Policy makers, the Office of the Privacy Commissioner and interested parties, can then consider these in commenting on the proposal(s) that will form the basis of the recommendations to Cabinet later in 2003.

As this is an initial assessment, the report:

• deliberately does not make recommendations. Rather, it identifies some of the privacy concerns related to each of the four models, and evaluates them against local and where appropriate international experiences. The report suggests some means by which privacy concerns could be addressed if the proposal is to go ahead; and

• has not been prepared by or reviewed by an independent agency. Such a review is to be undertaken during the final assessment of the proposal(s) prior to presentation to Cabinet in mid 2003.

It is acknowledged that the assessment will need to be updated as the authentication proposal evolves. An independent agent will prepare a Privacy Impact Assessment based on the proposed solution that will provide background for the 2003 Cabinet paper.

While this report is both a draft and a preliminary Privacy Impact Assessment, it is intended that it will be made available to any individual or organisation wishing to comment on the authentication models, primarily being published on the e-government website.

Summary Point 1

The E-government Unit of the State Services Commission has prepared this report as an initial assessment of the potential impacts on privacy resulting from the models being considered by the authentication project.

The assessment has not been independently prepared or reviewed. It will be updated as the authentication proposal evolves.