Australia’s Privacy Act is this year turning 35. Bob Hawke was prime minister, Crocodile Dundee II came out, Steve Jobs’ NeXTcube made its debut and this was considered a mobile phone. A lot has changed since 1988, yet the laws that govern how our privacy needs to be protected have not (save for a handful of amendments here and there).
It’s therefore no surprise the Australian government wants to overhaul the Privacy Act.
Back in October 2020, Australia’s then Attorney-General Christian Porter officially kicked off a review into the Privacy Act. In 2021, submissions were made by all interested parties that provided their two cents on what a new sparkly Privacy Act would look like.
A reoccurring theme from many of the submissions was to align the Act with international laws, such as Europe’s General Data Protection Regulation (GDPR), which would allow Aussies to control who has and uses their data, as well as delete their data, among other things.
As is the nature of government, taking into consideration, of course, that we’ve since had a change of power, it’s now only today that we’re seeing how our privacy might soon be handled.
Australians rightly expect greater protections, transparency and control over their private information. It’s clear our privacy laws are woefully out of date.
Today, we’ve released a report with ideas on how to fix it, so Australians can have confidence their data is safe.
— Mark Dreyfus (@MarkDreyfusKCMP) February 15, 2023
Privacy Act Review Report
The Privacy Act Review Report is a chunky 320 pages in length. There is a neat little one-page explainer, however.
There are 12 major proposals made as a response to the review, which ranged from redefining what ‘personal information’ is and expanding the scope of the Act to include organisations and small businesses that previously were excluded from complying, to compelling clear consent forms from a platform/business/service before they gobble up user data and tighter (and harsher) regulatory oversight.
But there was also a number of really, really important ideas proposed in the Privacy Act Review Report, such as giving Australians greater control of their personal information.
One is aiming to address potential harms arising from direct marketing, targeted advertising and online content, and entities trading in personal information. To this end, the Privacy Act Review Report highlights a need to give Australians the ability to opt-out of targeted ads.
Elsewhere was the proposal of a number of individual rights modelled on the GDPR ‘data subject rights’ (such as rights to object, to request erasure and to have search results deindexed). The right to erasure is essentially the ability to, for example, contact Meta in an easy manner and ask it to delete any trace of you on Facebook. How ideal.
Transparency requirements for automated decisions that use personal information and have a significant effect on individuals are also proposed. Under this, entities would need to provide information about types of personal information used in automated decision-making systems and how such decisions are made.
In the wake of recent large-scale data breaches, the Privacy Act Review Report also highlights the need for entities to put in place stronger protections to prevent unauthorised access to Australians’ information. This would include mandating just how much data an entity can request/keep/store as well as giving individuals the right to sue for serious breaches of privacy.
The Privacy Act Review Report also proposes enhancements to the Notifiable Data Breach scheme (NDB scheme) so that, when a data breach occurs, quick action can be taken to minimise harm to affected individuals. It’s suggested this be within 72 hours of becoming aware of a data breach.
This doesn’t all become law, however. Feedback is now being sought on the Privacy Act Review Report, which has a March 31, 2023 deadline. From there, the new Privacy Act will be shaped.