Senate sneaks in a privacy surprise: new ‘exposure draft’ legislation coming soon

Marketers should get a glimpse of what Australia’s new Privacy laws could look like when an exposure draft - and new Discussion Paper - is released at the end of April or in early May 2021.

Privacy - along with legal definitions of ‘personal information’ - can be tough for governments to legislate in an age of big data and personalised ads, when our smartphones know more about us than our mothers ever did.

A Senate committee meeting last week gave marketers the best hint yet at what might be coming from the Australian federal government’s review of Australia’s 1988 Privacy Act.

We already know there are likely to be “increased penalties” - or higher fines - for anyone who breaches the Privacy Act. No surprises there: it was flagged in the 2019 Digital Platforms Inquiry final report.

The surprise is that we might see a so-called ‘exposure draft’ - likely to be a detailed draft of proposed privacy legislation - when the next privacy Discussion Paper is released at the end of April or early May, 2021.

This new 2021 Privacy Act Discussion Paper - along with the ‘exposure draft’ of the privacy legislation - should be made public after Easter.

This Discussion Paper will likely delve deeper into the complex privacy issues than the Issues Paper released in 2020.

Bureaucrats looking after the Privacy Act review told a Senate committee last week that “we’ll be talking to the government in the second half of this year” about the Privacy Act review, following the release of the new 2021 Discussion Paper and draft legislation (also called the ‘exposure draft’).

These bureaucrats also flagged a warning “the complexity of the issues involved” could mean new privacy legislation won’t make its way through parliament until 2022.

So could privacy become another news media bargaining code headline generator?

The warning that it may take another year to eighteen months to get new privacy legislation through the federal parliament may signal the Australian government will continue playing hardball with technology platforms like Google and Facebook.

In its Digital Platforms Inquiry July 2019 report, the ACCC recommended an “enforceable code of practice in consultation with industry stakeholders to enable proactive and targeted regulation of digital platforms data practices.”

After all, the Australian government made global headlines for its News Media Bargaining Code legislation in February 2021, when Facebook pulled news and other vital information from its platform in Australia.

Despite the federal government’s tough line, news media publishers and Google and Facebook made private deals to sidestep the code, which forced technology platforms to pay publishers. 

Interestingly, the United States is now planning its own version of Australia’s news media code laws.

The same tough line from the federal government may be evident when the Review of the Privacy Act Discussion Paper and “exposure draft” legislation is released later in April or in early May.

The Privacy Act Review has already flagged many considerations for major changes for Australian legislation, 6 of which are:

1. Personal information: Is there a need to redefine the scope of the definition to include (amongst other things, technical information) and making laws around how it is collected, used and disclosed by platforms and anyone else ‘trading’ in personal information.

2. Privacy consent: how will people opt in, be notified and ask for personal information to be deleted when platforms use personal information.

3. The flow of Australian data to international platforms: how can local privacy laws not be ‘watered down’ by conflicting international laws or codes.

4. The right of individuals to enforce privacy obligations: should people have a right to individually force companies to comply with privacy laws.

5. A so-called ‘privacy tort’: this would strengthen the law to prohibit egregious privacy breaches.

6. The effectiveness of the notifiable data breach scheme: is the new scheme meeting its objectives.

The Privacy Act Review has had hundreds of submissions from interested businesses and not-for-profits about what Australia should do to legislate privacy. You can read the submissions here.

ADMA has made its own submission, which you can read in detail here, or by subscribing to our regulatory updates.

Marketers need to be prepared to have their say on privacy

While we don’t yet know how controversial the Review of the Privacy Act may be, we do know the government had technology platforms - specifically Google and Facebook - in its sights when it began the review of our privacy laws back in 2019, saying privacy had to be reviewed as part of the ACCC Digital Platforms Inquiry.

Since the beginning of the federal government’s massive technology and privacy reform agenda back in 2019, other technology changes and global forces continue to clash and shape the industry.

When former Attorney-General Christian Porter announced the Review of the Privacy Act Issues Paper in October 2020, he said: “Australians are spending more and more of their time online and more of their personal information is being collected, handled and stored.”

“Technology is also rapidly evolving in areas such as artificial intelligence and data analytics, which is why it is crucial that we have a privacy regime that is fit for purpose, can grow trust, empower consumers and support the growing digital economy.”

Since that announcement, not only has Christian Porter been replaced as Attorney-General but there are global antitrust investigations shaping technology and confirmation from Google about how it might start replacing third party cookies.

ADMA believes a sustainable marketing and advertising sector requires fair and transparent handling of consumer data (including personal information) to nurture digital trust. Any new legislation must also take regulatory change AND market forces into consideration, rather than looking at privacy in isolation.

Changes to our nation’s privacy laws should reflect the full gamut of digital change coming our way, including:

• The increased reliance businesses, governments and individual citizens have on digital services and the digital economy overall. (Especially after the COVID-19 pandemic - where would we be without QR codes or Zoom calls?)

• Disruption to the way the digital economy serves advertising, marketing and personalised experiences due to the deprecation of third party cookies.

• The evolving Consumer Data Right legislation, which gives citizens the ability to take their personal information to competitive suppliers and find better deals, such as a new mortgage.

• How small and medium sized Australian businesses can remain competitive in an increasingly globalised digital economy.

• Minimise regulatory burdens to make sure a diverse advertising, marketing and publisher eco system can flourish and grow.

• Balance the rights of citizens and the free flow of information to ensure communication and digital participation in a global economy are maintained.

For more detail on ADMA's view on Privacy, click here.