EFA disputes privacy claims from Australian age tech trial findings

Electronic Frontiers Australia (EFA) has voiced its disagreement with the Australian Government's preliminary findings that age assurance technology is capable of being "private, robust and effective."

The organisation published a detailed statement challenging the outcomes reported from the Age Assurance Technology Trial. EFA Chair John Pane, who participated as the sole privacy advocate from civil society on the trial's Stakeholder Advisory Board, raised several concerns about the methodology used in the trial and the accuracy of its public summary, especially regarding privacy protections and information security.

Concerns about privacy claims

The findings released indicated a belief by the project team that age assurance technology "can be private, robust and effective", a conclusion that EFA contends is not supported by the trial's evidence. Mr Pane criticised the process and the government's messaging, stating that EFA's involvement was crucial to ensure privacy was represented in the discussion.

"If you're not at the table, you soon find yourself on the table," Mr. Pane said, explaining EFA's decision to participate in a forum where it was the sole representative for privacy concerns from civil society groups.

He went on to describe the reporting of preliminary findings as "strong on hype and rhetoric and difficult to reconcile with the evidence," especially the statement that the technology could be "private, robust and effective."

"The explanation of what 'private' meant was simply 'confidentiality'," Mr. Pane said. "These political talking points seem to be a case of 'selling the sizzle and not the steak' - or perhaps even 'privacy washing'."

Questions about methodology

EFA's review of the preliminary findings, which had been made public earlier in the year, highlighted several key issues it considers unresolved.

Among these is the assertion that the trial did not sufficiently recognise the immaturity of several technologies being tested. EFA noted that the government had itself previously expressed this concern in 2023. EFA argues that the limited approach to assessing privacy practices among participating technology vendors represents only basic compliance, such as having a privacy policy, and not the detailed scrutiny necessary given the sensitive data and new technologies involved.

This, the organisation states, could be viewed as "tick-box compliance" instead of a comprehensive review of privacy risks and controls, something EFA believes is vital for any project of this nature and scale. EFA states this approach undermines public trust and falls short of expectations for a significant government initiative with the potential to fundamentally affect internet use across Australia.

Data retention and regulatory backdoors

The trial was also criticised for failing to disclose the risk posed by vendors potentially retaining sensitive data. EFA reported finding evidence that some technology vendors proactively established the ability to retain personal, including biometric, data, anticipating possible requests from law enforcement or regulators, even when no legal requirement existed.

"From a privacy and information security perspective, this is an absolute nightmare!" Mr. Pane stated. "This indicates a potential failure by both the Age Assurance Technology Trial and various participating vendors to understand the what, why, and how of Australian privacy law requirements must be operationalised."

EFA further noted that Mr Pane had requested, but not yet received, assurance from trial organisers that all test subject personal data, possibly including biometric data, will be securely destroyed or permanently de-identified.

"It simply is not enough to have a clause in a contract requiring a third party to do something like securely destroy data," Mr. Pane said. "This sort of third-party risk must be managed closely from cradle to grave."

Awaiting the final report

The final report for the Age Assurance Technology Trial has been submitted to the government, but EFA has not yet had sight of its contents or confirmation that their concerns have been addressed.

"You can expect EFA to utilise its knowledge gained from the Age Assurance Technology Trial to counter any spin or hyperbole coming from the government on the efficacy or success of this flawed initiative," Mr. Pane concluded.