New privacy law gives shelter and unintended consequences

The fluid digital world of mobile phones, the internet and social media makes us more connected, but loss of privacy is the entry fee. The Albanese government’s attempt to help people protect their privacy is a timely reform.

Under proposed new legislation, Australians are likely to gain historic rights allowing them to sue for privacy invasions, avoid being targeted by firms using sensitive personal information, and demand that tech companies erase data. Further, under a “children’s online privacy code”, companies such as TikTok will be prohibited from targeting ads at children and selling their private data.

These proposals are admirable. But privacy is a fraught and subjective area and some of the changes inevitably have unintended consequences: Small businesses with an annual turnover of $3 million or less – which are currently not required to protect personal information or disclose how it is used – will have to comply with the new landscape and are understandably unhappy about the additional cost, estimated to be about $2200 to delete a customer’s data. However, the government will cushion the initial blow during the transition period through an impact analysis and support package. Another unintended knock-on consequence concerns the legislation’s failure to allow adults to opt out of targeted advertising, a decision likely to disappoint consumer rights advocates.

The wide-ranging review of the Privacy Act was commissioned under the Morrison government two years ago. Labor had been pushing for “urgent reforms” to the decades-old privacy laws, but the issue blasted into the headlines 11 months ago when a series of major leaks at Optus and Medibank compromised the personal data of millions.

Loading

Federal Attorney-General Mark Dreyfus will respond to his department’s review by agreeing with 38 of its 116 recommendations and agreeing in principle to 68 more which will require further consultation before a final decision. Among 10 recommendations not accepted were provisions to allow individuals with “an unqualified opt-out of receiving targeted advertising”, and proposals to narrow the political exemption to the Privacy Act. The government intends to legislate the changes in 2024.

Closer to home for the Herald, media outlets will continue to be exempt from the Privacy Act. This is partly due to the work of the Right to Know coalition, including Nine Entertainment Co (which owns this masthead), News Corp, the Guardian, AAP, Free TV Australia, the media union and public broadcasters ABC and SBS, which warned the changes would curtail press freedom.

The legislation is expected to mirror European-style data regimes where the 2018 General Data Protection Regulation laws imposed obligations on those who target or collect data related to people within the European Union. The big US tech companies have been fined regularly, and heavily, for breaches of the laws, with Amazon going down for a €746 million ($1.24 billion) fine in 2021 for its alleged misuse of individuals’ data.

The EU and US, as the lead protagonists in the debate about the relationship between data privacy and borderless commerce, need to devise a framework that protects one without unduly burdening the other. But the global economy cannot function effectively or efficiently if data is quarantined within national borders and the Albanese government’s new legislation aims to tackle the local problem through a range of fields that reflect the digitisation of the Australian economy and society.

Loading

Governments and firms cannot prevent data theft or protect consumers completely and attempts to stop privacy being for sale will always have unintended consequences. Clearly, individuals should take responsibility for their own protection, but the new laws are a step towards providing some shelter from intrusion and smoothing the process when people have information stolen.

Bevan Shields sends an exclusive newsletter to subscribers each week. Sign up to receive his Note from the Editor.

Loading