April 2023 Submission in Response to the Attorney-General’s Department Privacy Act Review Report
Submission to the Attorney-General’s Department
Thank you for the opportunity to submit comments to the Attorney-General concerning the review of the Privacy Act 1988.
Recently, countless Australian’s have been impacted by massive data leaks at the hands of Optus, Medibank and most recently Latitude. As an information security professional, a privacy advocate and Australian resident my major concerns stem from a lack of federal level protection for privacy as a human right and the governments lack of action of systematic data collection and exploitative models that digital platforms, data brokers, and targeted advertisers thrive on.
During the COVID-19 pandemic I saw a significant amount of my life shift online, for three years a majority of my shopping, education and social life were conducted online. Even as a technologist I felt that the emphasis on using technology to conduct my day to day activities was unprecedented.
What left me frustrated was the need to accept predatory data collection and aggregation practices of digital services and Internet platforms to be able to reasonably live out my life.
Updating the Privacy Act has the potential to give Australians like myself and many others the ability to better control how my information is used and shared and allow me to take action when my privacy is violated as has been the case numerous times in the past three years.
Recognising the right to privacy at the federal level is critical to protecting the privacy of all Australians. Including those most vulnerable to abuse. Enshrining a right to privacy within the Privacy Act would allow a shift in the relationship we currently have with digital services and Internet platforms to a rights-based system rather than an economic or value-driven model which currently incentivises businesses to collect as much information about people as possible.
Protecting privacy is key to fighting back against harmful and invasive data practices of Big Tech (and other) companies. Privacy puts power and agency back in the hands of individuals and communities.
While other amendments to the Privacy Act will play an important part in improving protections against infringements upon Australians’ privacy, it is my belief and one echoed in many other submissions that without a right to privacy the impact of the reforms made to the Privacy Act will remain limited.
Ultimately I believe the right to privacy enables other rights. Without privacy it would be extremely hard to enjoy freedom of speech and expression, and the ability to organise, protest, and hold those in power accountable. There is no democracy without privacy.
So while it is my view that Australians needs a federal charter of human rights, until this is implemented introducing a right to privacy as part of the Privacy Act is critical.
Definition of “personal information”
The proposed re-draft of the threshold of “personal information” was positive to see as the current definitions often are a cause of confusion especially in regards to protections offered to technical data.
Furthermore, I was please to see the Discussion Paper to “cover circumstances in which an individual is distinguished from others or has a profile associated with a pseudonym or identifier, despite not being named” as it is understood the harms caused by targeted advertising and data brokers have little to do with the ability for companies to associate an identity to individuals.
It is well understood by most technologists that with enough data, companies are able to determine individuals’ social, political, and economic preferences, to create a “shadow profile” of the user.
I was please to see the suggestion of including information that is generated or inferred as part of the proposal. If profiles are built by data collection and further built out with tools such as artificial intelligence and deep learning, these inferences, predictions and other assumptions can have a very real negative consequence and must be considered a form of privacy harm.
Failure to include generated or inferred information within the scope of the Privacy Act would represent a failure to acknowledge the modern technical realities of data processing.
Furthermore, information that is generated or inferred by way of artificial intelligence, machine learning or other generative means must be contained in the list of information under proposal 2.2 to avoid organisations attempting to argue that generating or inferring information after the point of initial collection is a “use”, rather than another point of collection.
Additionally, inferring or generating sensitive information from other data by using transactional information, web browsing data, or location data, to infer an individual’s sexuality, religion, union membership or political affiliation can be achieved without use of any sophisticated predictive analytics or machine learning technology.
Given the downstream harms that can arise based on assumptions made on personal information, and the leaking of sensitive information, inferred or not must have legal protection.
Additionally noted was a lack of any new rights or meaningful changes to improve privacy for automated decision making. I do not believe that the proposed changes will have any meaningful impact or reduction of the possible harms caused by automated-decision making systems.
Notifying people that their personal information will be used in an automated decision making system is the absolute bare minimum that an organisation should be required to meet to use these types of systems.
Anything less than the development of additional provisions which give individuals a meaningful and accessible pathways to seek an explanation, audit, and review of decisions made by automated means is a clear demonstration that Australia is happy to continue to perpetuate the socio-economic harms caused by unregulated data extraction and decision making processes.
Notices on Consent
The notice and consent model has received a significant amount of criticism over the past few decades. With many people suffering from “consent fatigue” which describes the experience of individuals being bombarded with inconsistent and difficult to navigate requests to provide consent for data collection.
And in this way after a while many people don’t know what they are consenting to. A 2022 CHOICE analysis of Privacy Policies found:1 - Of 75 privacy policies found they average 4000 words and take 16 minutes to read. - A third of privacy policies required a university-level reading skills to easily understand.
1 https://www.choice.com.au/consumers-and-data/protecting-your-data/data-laws-and-regulation/articles/privacy-policy-comparison
And so collection notices—as well as other documents like terms of service and privacy policies—are well understood to be an ineffective means of communication for the majority of individuals.
So while standardising collection notices and privacy policies is a step in the right direction, it only goes part of the way in creating a system of meaningful control of personal information.
An additional aspect should offer individuals increased agency would be a requirement to offer a standardised ability for individuals to opt out of all personal information that is unnecessary to functionality of a service.
Ultimately I agree with the intention to reduce reliance on the “notice and consent” model, which has proved to be an ineffective approach to privacy.
Businesses large and small must not be able to use consent as a go-to mechanism to green-light any data collection practices they want while claiming that if the user has any interest in using the platform they must agree.
Additionally they must not be able to bury the details in privacy communications and claim “transparency”. Regulated entities must be required to handle personal information in a fair and reasonable manner, rather than relying on notice and consent mechanisms to be able to place the responsibility upon individuals under the illusion of choice.
Like many other submissions I am concerned that the tests for “fair and reasonable” allows too much room for companies to argue that privacy-invasive practices, or practices which cause downstream privacy harms, are still “fair and reasonable”.
In many of these cases they are deemed “fair and reasonable” because the “loss of privacy is proportionate to the benefits”.
Restricted and Prohibited Acts and Practices
While I have concerns around the risk of creating a “compliance mentality”, it is my belief that Privacy Impact Assessments (PIAs) should be made mandatory for restricted practices. Having seen theses processes in use I support putting the requirement on organisations to perform a PIA for high-risk activities and do not believe they cause significant operational overhead, in actual fact, the additional work required to meet the bar for implementing restricted practices may disincentivise businesses from using restricted practices which is a net positive for consumers.
Ultimately if organisations wish to conduct high-risk activities they must demonstrate they have completed due diligence and have made a reasonably informed decision. PIAs also provide important artefacts for privacy and security research, as is often the case in my own line of work.
Additionally, for restricted practices other processes could be defined where by if an organisation proposes a restricted activity, it must submit why it is in the interests of the individual to the OAIC, alongside the PIA.
With regard to which practices should be classified as restricted, I defer my support to he list of restricted practices originally proposed by Salinger Privacy.2
2 https://consultations.ag.gov.au/rights-and-protections/privacy-act-review-discussion-paper/consultation/view_respondent?show_all_questions=0&sort=submitted&order=ascending&_q__text=Salinger&uuId=536332874
Children and Vulnerable Individuals
While I whole heartedly agree that children and vulnerable individuals are indeed at greater risk of harm as a result of their personal information being handled inappropriately. Robust privacy protections for everyone, including the creation of a federal right to privacy, go much further in protect children and vulnerable people from privacy harm.
It is my belief that any other system generates a two-tier class system of privacy protections and introduces more ambiguity about how we define children and vulnerable people.
Given there extensive work in the space of digital privacy, consent in digital spaces and ongoing work to help protect children and vulnerable people in digital spaces I defer my support to the original recommendations made by Digital Rights Watch.3
3 https://consultations.ag.gov.au/rights-and-protections/privacy-act-review-discussion-paper/consultation/view_respondent?show_all_questions=0&sort=submitted&order=ascending&_q__text=Digital&uuId=435022273
Exemptions
I was disappointed to see the Discussion Paper did not include any specific proposals to remove the exemptions for small businesses, employee records, political parties, and media organisations.
While I appreciate the concern that removing small business exemptions may create a compliance and administrative burden upon small businesses. In my experience small businesses are often the most complicit in poor data handling practices.
In one such case that I have witnessed first hand, a hotel leaked copies of drivers licenses and credit cards to an unknown group of people who went on to use these details to open business accounts with several hardware companies stealing hundreds of thousands of dollars worth of equipment.
However, because the victim of this identify theft did not incur any of the financial costs, the police and associated organisations were unwilling to provide any assistance in preventing further harm to businesses, or the victim resulting in months of back and forth between police, other businesses who had been scammed and credit companies trying to ensure that no additional lines of credit were opened in their name.
The small business exemption is a clear example of how privacy in Australia is considered under a value-based rather than rights-based framework.
In order to participate in the digital economy in a responsible manner, small businesses need to play their role in protecting the privacy and security of people’s personal information.
Recommendations
For these reasons, I provide the following feedback on the report on the Privacy Act Review:
- Introduce a federal level right to privacy in order to effectively empower all Australians and protect them against privacy violations by public and private entities.
- Introduce a statutory tort for invasions of privacy, and provide a direction right of action, including civil penalties as well as damages that can be awarded to the individual complainant.
- Explicitly include language in the definition of personal information to ensure that “identifiable” includes the notion of “distinguished from others even if the identity is not known”.
- Ensure that consent cannot be used as a way to circumvent complying with purpose limitation.
- Ensure that the definition of consent requires genuine choice and made from a position of knowledge. It must not become a transactional, box ticking requirement, that then serves as a licence to use personal information without limit.
- Include standard requirements to allow people to easily opt out of all collection of information that is not essential to the technical functionality of a service.
- Introduce and extend the list of restricted practices. A small number of prohibited practices should be introduced which represent unreasonable risk of harm and undue interference with privacy. For example, one-to-many facial recognition.
- The Privacy Act must apply to any and all entities which collect, process, or otherwise handle personal information.
- Provide small businesses with additional, targeted resources and support to adopt the privacy practices required by the Privacy Act. Additional funding to the OAIC or another entity should be provided to make this possible.
- Remove the political exemption as a part of reviewing the Privacy Act.
- Remove the employee records exemption, or, commit to standalone workplace surveillance legislation.
- Develop additional provisions which give individuals a meaningful and accessible pathways to seek an explanation, audit, and review of decisions made by automated means.
Thank you for taking the time to consult with the community on this important topic.
I agree to my submission being made public under my name.
Originally published as response 1025659477.