Five years after the government first began discussing it, new changes have finally been proposed for Australia's Privacy Act. Privacy reform is hugely popular: 93% of Australians say protecting personal information is important to them, and 87% say they are more concerned about their privacy than they were five years ago.
The proposed changes come as 'pervert glasses' sell out at Kmart, facial recognition technology proliferates in everyday environments, and microtargeting for advertising fills algorithms with nonsense and toxic junk. Tick-a-box consent is a broken model, and Australians rate protecting personal information as their number one priority for AI regulation.
Fair and reasonable test
At the centre of the reform is a fair and reasonable test. This shifts the onus away from individuals to make impossible decisions about consenting to endless terms and conditions, instead posing the question to companies: are you collecting and using this information in a way that is fair and reasonable?
Australia's privacy laws remain woefully out of date, with the majority drafted four decades ago. This latest tranche of reform, if implemented, will be a highly significant improvement, bringing Australia closer to jurisdictions such as Europe and California.
Right to erasure
The government has also opted to introduce certain provisions around the right to erasure. Giving individuals the right to request that data be deleted is hugely important in a context where many people have experienced a data breach involving information they may have shared years before, including with companies they no longer use. It is also important for those managing problems such as gambling, who may not want that industry or marketing companies to know about it.
There are some carve-outs and limitations in the current proposal, but the next little while offers a great opportunity to convince the government to tighten these up.
Enforcement concerns
While the exposure draft is a welcome step, the government needs to do more. The regulator, the Office of the Australian Information Commissioner, is under-resourced and outmatched in size compared to the corporations it supervises. The benefit of a flexible and technology-neutral rule such as the fair-and-reasonable test will include that it can adapt to community expectations over time and specific situations – but only if people are allowed the right to enforce it directly in court.
Courts have an important role to play in interpreting and applying the rules: Meta's recent US$17bn settlement serves as a case in point. Cases brought by people harmed by these companies allow evidence to come to light that can shape effective rule-making. They also send a chill through boardrooms of companies that have to date banked on escaping the scrutiny of regulators.
This is a problem for another important policy: the digital duty of care. It is a great idea but it also has to be enforced for it to be meaningful. At present, it would be very difficult for an Australian to sue Meta in the way that has been done in the US, even though the harms experienced are the same. It is not even clear that the improvements Meta has committed to making as a result of that case will be made to their Australian service. Such a perverse outcome can be addressed if the government makes it plain that both courts and regulators have a role to play in enforcing privacy rights and the digital duty of care.
Surveillance and next steps
The other key concern is the spectre of surveillance creeping into all aspects of our lives. Facial recognition technology is highly invasive and almost entirely unregulated in Australia and, while some aspects of these reforms might touch on this tech, specific rules are needed for such significant technologies. There are pre-existing proposals that could be introduced immediately, which are in line with rules in other comparable countries.
Privacy reform may seem wonkish or a lost cause but, in reality, it is one of the best tools available to take back power from big tech and creepy companies. This proposal is a great first step but it cannot be the only one.
