In February of this year, the Attorney-General’s Department released the final report for their Privacy Act Review, which had extended over the previous two years. At the end of September, the Federal Government released its response to the Final Report. Of the 116 proposals included, the Government agreed to 38, agreed in-principle to 68 and noted (effectively, not agreeing to) 10.
This is not the first time that some of the recommendations have been made, or even the second time. In 2013, Professor Emeritus Barbara McDonald was appointed as the Commissioner for the Australian Law Reform Commission’s (ALRC) inquiry into Serious Invasions of Privacy in the Digital Age.
“The government has said, ‘yes, alright, we accept what the ACCC says, we accept what the Productivity Commission says, we accept what the Attorney General says, yes, it should be introduced, and yes, we agree in principle with it being introduced, and we’ll further consultation with the media, and we’ll talk to the states’, implying that the Commonwealth is not particularly interested in doing it as a Commonwealth Act, which would apply uniformly to everyone,” said Professor McDonald.
The ALRC recommended the introduction of a statutory cause of action for privacy. In 2019, the Australian Competition and Consumer Commission recommended the introduction of a statutory tort for serious invasions of privacy in their Digital Platforms Inquiry. In October 2023, the Government has now agreed in-principle to its introduction, based on the model recommended by the ALRC, subject to further consultation about potential safeguards for public interest journalism.
Each of these inquiries went through significant consultation processes, ultimately reaching similar conclusions. Professor McDonald explained that there is a risk of submission fatigue as with repeated inquiries, the number of submissions tends to go down “because people are just sick of putting in a submission for something that they’ve already put in a submission about.”
Statutory law reform is not the only way forward, Professor McDonald suggests that there is also room for the common law to develop further. “I hope to see judges being a bit more creative, or a bit more adventurous, really, I should say. But then that requires an adventurous plaintiff as well,” said Professor McDonald. “Celebrities are sometimes useful,” explaining that England’s right to privacy developed after Naomi Campbell took her case through to the House of Lords.
Professor McDonald explains that for the next steps in statutory reform to occur we are dependent on political will and priorities as “that’s what legislation depends on, it depends on political will, political priorities. As opposed to case law, which depends on something happening and someone starting an action.”
Samantha Floreani, digital rights activist and Head of Policy at Digital Rights Watch, tells Honi that it’s “still kind of theoretical at this stage. Until we see a bill or a draft bill in place, and then passed, it’s still kind of in theory. So, at the moment, there’s quite a bit of frustration and also hope happening in the privacy advocate sphere.”
The form of the proposed reform is also unknown — including whether the agreed proposals would be implemented together or in stages — with no clear suggestion of when a bill will be tabled.
“We’re keeping a firm eye on what the government’s doing as well, because if they don’t actually turn those things into legislative change, then it means nothing,” said Floreani.
Important changes agreed to by the government include the introduction of a fair and reasonable use test and expansion of the definition of personal information. A fair and reasonable use test shifts the “responsibility onto the organisations that are collecting and using and storing people’s personal information, rather than relying on the individual to be able to manage that on their own,” explained Floreani.
“It’s completely ludicrous to expect in this data environment, the data economy, for individuals to be able to make informed decisions.”
“Essentially, the definition of personal information acts as a gatekeeper to the protections offered in the Act,” said Floreani. As a result, a broader definition of personal information can broaden the scope of the entire Privacy Act. An expanded definition could include technical data or metadata, which is “a big part of the fuel of surveillance capitalism”, and generated information, which includes predictions or inferences that an organisation generates about you, even though you never gave that information to them.
The introduction of a direct right or action and a statutory tort for serious invasions of privacy offer further potential to develop legal responses to privacy, expanding beyond the Australian privacy principles (upon which the Privacy Act is based). The government has also agreed in-principle to the introduction of individual rights for access, objection, erasure, correction and de-indexation.
“Those individual rights need to be also paired with more obligations on the organisations who are collecting and using and benefiting from our personal information to be practising data minimisation, and not using people’s information in ways that’s going to be harmful or detrimental to those people,” explained Floreani.
“Privacy invasion is a collective issue, it is a networked issue, and so it needs to be tackled on that level.”
Floreani uses an analogy of a building to explain the issues with relying on the current notice and consent model: “If you walk into a building right, you expect there to be safety measures and OH&S in place to make sure that our building is safe to walk into. You wouldn’t expect to be able to tick an ‘I agree’ pop up and then walk into a building that’s on fire.”
The Privacy Act is structured around a number of exemptions that mean that currently many, if not the majority of, businesses are not required to adhere to many of the provisions. The proposals included changes to many of the exemptions including those for small businesses, politics, and journalism, with the government agreeing (or agreeing in-principle) to changes for small businesses and the media, but not for political entities.
In a mostly unsurprising turn, the Government merely noted the proposals for the political exemption. Floreani explained that the ease with which you can leverage data and personal information to specifically target people with advertising becomes more concerning when considering the flow on effects for campaigning and political advertising.
Changes to the small business exemption have the political to lead to a significant expansion of the application of the Act. “It’s easier than ever to buy data analytics software off the shelf, and be able to collect, process, analyse, store, and share information,” said Floreani. “Two thirds of real estate agents in Australia are not covered by the Privacy Act currently, and they collect and use heaps of personal information and it’s absurd that they are not required to protect that.”
For the journalism exemption, Floreani explains that there are concerns about “what if privacy ended up being like a direct right of action on privacy ended up being used in the same way [like defamation], they really don’t want to add another layer of chilling effect on their journalism.”
“Those challenges around protecting journalism are ones that are solvable through particular careful protections, and that’s something that the government has been very clear that they are supportive of,” said Floreani.
“Another factor being considered by media organisations is that they are more and more often becoming data driven companies in their own right, and there is an incentive for them to be able to compete with digital platforms. They want to be able to engage readers, they want to be able to profile them, advertise to them. There’s a lot of money in that, and if they want to be able to compete in the surveillance capitalism economy, then they want to also be able to collect a lot of data and use it and monetise it.”
“Do we want the media to be behaving like Facebook? Do we want them to be trying to get engagement at all costs? Because we’ve already seen how that approach leads to clickbait or misleading headlines.”
Privacy reform is a chance to challenge the power structures that govern our digital experiences. It’s a chance to decide the technological future that we want. An equitable digital future requires strong privacy protections.
