October 2024 Submission to the Privacy Act Review

Submission to the Senate Standing Committees on Legal and Constitutional Affairs

Submission in Response to the Senate Standing Committees on Legal and Constitutional Affairs regarding the inquiry into the Privacy and Other Legislation Amendment Bill 2024 [Provisions], September 2024 Prepared by Rebecca Trapani on Wednesday, 09 October 2024

Thank you for the opportunity to submit comments to the Senate Standing Committees on Legal and Constitutional Affairs regarding the inquiry into the Privacy and Other Legislation Amendment Bill 2024 [Provisions].

In March 2023, I submitted a response to the Attorney-General’s Department’s Privacy Act Review Report. At that time, we were emerging from COVID-19 lockdowns in Victoria. Having relocated to a regional area, I experienced a significant shift in my life online—shopping, education, and social interactions were all conducted digitally. Even as a technologist, the extent to which my day-to-day activities relied on online platforms was unprecedented.

I found it frustrating that I had no choice but to accept the predatory data collection and aggregation practices of digital services and Internet platforms to live my life reasonably. Unfortunately, this remains true today.

As an information security professional, privacy advocate, and Australian resident, my primary concerns revolve around the lack of federal-level protections for privacy as a human right, and the government’s inaction on the systematic data collection and exploitative models that digital platforms, data brokers, and targeted advertisers thrive on.

The proposed Privacy and Other Legislation Amendment Bill 2024 is a positive first step in updating Australia’s privacy framework, which has not seen significant reform in over 40 years. While the Bill introduces important changes—such as expanded powers for the Information Commissioner and new transparency requirements for automated decision-making (ADM)—it is an extremely modest start.

In this submission, I aim to highlight key areas of concern and propose recommendations to strengthen the legislation and better protect the privacy rights of Australians.

Clear Timeline for Further Reform

While the Attorney-General has indicated that this Bill is only the first part of a broader reform agenda, there is no clear timeline for the remaining legislative changes. It is crucial that the Government provide a roadmap for further reforms to ensure comprehensive privacy protections are enacted in a timely manner. There is also uncertainty regarding the introduction of additional pieces of legislation before the 2025 federal election. A change in government could risk delaying or altering the implementation of crucial reforms.

Modernising the Definition of Personal Information

The current definition of personal information in the Privacy Act is outdated and fails to address contemporary privacy challenges. Notably, it does not cover location data or inferred information derived from an individual’s behaviour online. In addition, the definition of consent is too simplistic, allowing organisations to rely on vague consent mechanisms that do not ensure meaningful user understanding. It is recommended that the definition of personal information be updated to reflect modern data usage practices and that the concept of consent be clarified to enhance consumer protections.

Moving Beyond Tick-a-Box Consent

The Bill should impose stronger obligations on organisations collecting personal information to act fairly and reasonably. The reliance on lengthy terms and conditions, which are rarely read or understood by consumers, allows organisations to circumvent meaningful consent. It is recommended that the Bill include a fairness obligation, requiring organisations to handle personal information in a manner that is transparent, reasonable, and in line with consumer expectations.

Removing the Small Business Exemption

Currently, 95% of Australian businesses are exempt from complying with privacy legislation due to the small business exemption. This exemption leaves a large portion of consumers without adequate privacy protections and creates an uneven playing field for businesses. Removing the small business exemption will enhance privacy protections for consumers and ensure that small businesses are held to the same standard as larger organisations.

Enforceability and the Right to Sue

The introduction of a statutory tort for serious invasions of privacy is a positive development, but it does not go far enough in providing individuals with enforceable rights. Individuals must be given the ability to seek remedies for breaches of their personal information through the courts, especially where such breaches occur at scale. It is recommended that the Bill provide a clear, enforceable right for individuals to sue organisations for misuse of personal information.

Addressing Privacy Concerns in Automated Decision-Making (ADM) and AI

The proposed transparency requirements for ADM processes are a step in the right direction, but the two-year lead-in period for implementation is unnecessarily long. During this time, significant ADM activity will likely take place without adequate oversight. Originally, the Government’s Response included a right for individuals to seek further information about ADM processes, but this has not been included in the current Bill. It is recommended that this right be reintroduced and that transparency measures be implemented more swiftly to mitigate potential risks posed by AI and ADM.

Privacy Risks Related to Age Verification and Social Media Use by Children

The proposed ban on social media use for children under a certain age, potentially up to 16 years old, does not inherently provide greater privacy protection. While the intention is to safeguard children, this approach may create unintended consequences that reduce privacy protections for young users.

Under current privacy laws, organisations that explicitly collect personal information from children would be expected to implement enhanced data governance measures, including stricter processes, procedures, and technologies. However, if a platform can claim that children are not supposed to use their service due to age restrictions, it may avoid the additional legal obligations that would otherwise apply to protect children’s data. This loophole allows companies to argue they are not “knowingly” collecting data from children, even though children may still access their platforms.

This issue has been seen in other jurisdictions, such as the US under the Children’s Online Privacy Protection Act (COPPA), where some platforms avoid compliance by stating their service is not intended for children under 13. Similarly, in Australia, platforms could use age-based bans as a way to avoid the additional privacy safeguards that would otherwise be required.

Instead of relying on an age-based ban, the Government should focus on holding all organisations accountable for implementing robust data governance practices that apply regardless of whether children are an intended user base. Platforms must adopt tailored privacy policies, and heightened security measures to ensure the privacy of children is genuinely protected.

The potential introduction of age verification technology to enforce such bans also raises further privacy concerns. If verification systems are collecting sensitive information about children, there must be safeguards to ensure that this data is protected, used only for verification purposes, and not retained or misused.

The Privacy and Other Legislation Amendment Bill 2024 introduces important reforms, but further steps are necessary to bring Australia’s privacy laws in line with contemporary needs. A clear timeline for future reforms, modernised definitions of personal information, the removal of the small business exemption, enforceability of privacy rights, and stronger regulations for AI and ADM processes are critical to achieving comprehensive privacy protection.

Additionally, proposed measures such as the social media ban for children must be carefully reconsidered to avoid creating loopholes that weaken protections. The Government should focus on enhancing data governance practices for all organisations, ensuring that the privacy of children and other vulnerable groups is genuinely safeguarded.

Thank you for taking the time to consult with the community on this important topic.

Originally published under Mx Rebecca Trapani.