“People should not have to choose between protecting their privacy and participating in the digital economy,” Attorney-General Michelle Rowland said as she unveiled the second round of changes to Australia’s Privacy Act, a law that dates to 1988.
The government has released exposure draft legislation for the package. A consultation paper goes with it and will be open for public comment for three weeks.
What the draft would do
The centrepiece is a “fair and reasonable” test. It would stop companies collecting more personal information than they need, or using it in ways consumers would not expect. The draft also targets the trading of personal information without clear permission, including data on shopping habits, online interests and location. Rules on how organisations respond to data breaches, and how they handle fraud and financial abuse, would be tightened.
The first round of reforms created a statutory tort for serious invasions of privacy, made doxxing a crime, gave the Office of the Australian Information Commissioner stronger enforcement powers and ordered a Children’s Online Privacy Code.
Penalties will be steep. Rowland said breaches “can be in the tens of millions of dollars, and they can also be calculated as a percentage of revenues or turnovers”, and that the structure would follow the Online Safety Act.
Erasure rights and smart glasses
Much of the press conference at Parliament House was about smart glasses and whether Canberra would ban imports of devices able to record covertly. Rowland acknowledged “serious concerns” and cited research suggesting about 60 per cent of point-of-view content uploaded from such devices could be classed as harassment. She named children, women and people facing violence or coercive control as most at risk.
The government is not consulting on an import ban as part of this process. Pressed on whether that ruled one out, she said: “We are not ruling anything out, but we are utilising what we have at our disposal right now.” She warned against a device-specific approach and a game of “whack-a-mole” with new technology.
Two parts of the reforms would reach smart glasses. The fair and reasonable test would govern how data they collect is used, and a right to erasure would apply to large platforms such as Meta that store and process it. Under the model, people would ask each platform or search engine directly. There would be no central register like the “do not call” list, and the platform, not the individual or the Privacy Commissioner, would carry out the erasure. Asked whether that could be enforced against multinationals, Rowland said: “Large digital platforms already are required to do this in the EU. They know how to do this.”
She also encouraged councils and businesses to consider banning smart glasses from pools, childcare centres and retail change rooms.
IDLock
Alongside the privacy package, the government announced a digital identity protection service called IDLock. It will be available through myGov from next year. Australians will be able to block, unblock and monitor how their identity documents are used through the Document Verification Service. Rowland described it as a tool against identity crime, scams and the fallout from data breaches.
She said she expected the laws to be in place “well before a year’s time” and urged Parliament to back them.
