The Government's Response to the Privacy Act Review

PRIVACY ACT REVIEW IMPORTANT UPDATE FOR MARKETERS

28th September 2023 REGULATORY & ADVOCACY

BRINGING YOU UP TO SPEED The review of Australia’s Privacy Act 1988, is being done by the Attorney General’s Department and has involved nearly 3 years of consultation.

Along the way there have already been some key developments in the law and in the Governments commitment to Privacy protections.

REGULATORY & ADVOCACY

ADMA’S ENGAGEMENT IN THE REVIEW

• ADMA has been actively engaged in all stages of the Government’s Privacy Review • The Privacy Act Review Report (released in February 2023) put forward 116 Proposals • ADMA was supportive of most of the proposals

- some in the form proposed - some with a minor tweak , and others - only after further consultation (These are the ones we were most concern

REGULATORY & ADVOCACY

WHAT YOU NEED TO KNOW

•

On 28th September 2023 the Government released its response to the 116 proposals in the Privacy Act Review Report.

•

The Governments response considers reforms to Australians privacy framework under 5 key focus areas: 1. Bringing Privacy into the Digital Age 2. Uplifting protections 3. Increasing clarity and simplicity for entities and individuals 4. Improving control and transparency for individuals over their personal information 5. Strengthening enforcement.

REGULATORY & ADVOCACY

DIGGING A LITTLE DEEPER

Of the 116 proposals that were in the Privacy Act Review Report (released in February), the Government response: - Agrees to 38 proposals - Agrees in principle to 68 proposals - Notes 10 proposals

REGULATORY & ADVOCACY

KEY CHANGES THAT MARKETERS WILL CARE ABOUT

•

Children will be defined as persons under 18 years (Proposal 16.1)

•

Further consultation around introducing a criminal offence for malicious reidentification of de-identified information (proposal 4.7)

•

Existing data security obligations will be enhanced by specifying that ‘reasonable steps’ in the context of APP 11 include both technical and organisational measures (proposal 21.10) - the OAIC will provide guidance on ‘reasonable steps’ an entity should take to keep personal information secure (Proposal 21.3) and how to destroy or de-identify personal information (Proposal 21.5)

•

The Government agrees that further considerations should be give to enhance risk assessments for “High Privacy Risk Activities” including facial recognition technology and other uses of biometric information.

•

Overseas Data flows - a mechanism should be introduced to allow businesses to disclose personal information to prescribed certain countries (those with substantially similar privacy laws) without the need for contractual provisions or other measures.

•

Automated Decision Making (ADM): An organisation’s privacy policy will need to set out the types of personal information that will be used in substantially automated decisions (e.g online insurance and credit applications ) that have a legal or similarly significant effect on an individual’s rights. The OAIC is to provide guidance on the types of ADM covered by this requirement (Proposal 19.1 and 19.2).

AGREED Proposals There will be development of legislative proposals with further targeted consultation to follow

REGULATORY & ADVOCACY

CHANGES SUBJECT TO FURTHER CONSULTATIONS

•

Definition of Personal Information - Amendments to the Act are needed to clarify that personal information includes technical and inferred information if this information can be used to identify individuals (Proposal 4.1)

•

Fair and Reasonable Test - The Government agrees that it is no longer appropriate to rely exclusively on notice and consent to regulate personal information handling practices. The government agrees that rather than place the burden of reading through lengthy complicated privacy policies, there should be an overarching fair and reasonable test (proposal 12.1) which will apply regardless of whether or not consent has been obtained.

•

Notification of Data Breaches: There will be more specific requirements around notification timing and responses to data breaches (proposal 28.2 and 28.3)

•

Remove of the Small Business Exemption - The Government agrees that in light of the privacy risks applicable in the digital environment the small business exemption should be removed however the Government will work closely with small business to understand the impact of any change in order to inform what privacy obligations would be placed on this cohort.

•

Targeting - targeting should be subject to the following requirements (Proposal 20.5): • Targeting individuals should be fair and reasonable in the circumstances • Targeting individuals based on sensitive information should be prohibited with an exception for socially beneficial content this is to be clarified with further guidance

“AGREES IN PRINCIPLE” Proposals The government supports these proposals but there will be further consultations to explore whether and how these proposals could be implemented

REGULATORY & ADVOCACY

CHANGES SUBJECT TO FURTHER CONSULTATIONS (Continued) “AGREES IN PRINCIPLE” Proposals The government supports these proposals but there will be further consultations to explore whether and how these proposals could be implemented

REGULATORY & ADVOCACY

•

Targeting children -targeting to a child should be prohibited with an exception for targeting that is in the best interest of the child (Proposal 20.6)

•

Trading - an individual’s consent should be required in order to trade their personal information (Proposal 20.4)

•

Trading in children’s data - trading in the personal information of children should be prohibited (Proposal 20.7)

•

Withdrawing Consent - expressly recognize the ability to withdraw consent and do it in a manner as easily as the provision of the consent (Proposal 11.3)

•

Privacy Policies and Collection Notices are to be Clear, up to date, concise and understandable (Proposal 10.1)

•

Privacy by Default- to address concerns about ‘dark patterns’, privacy settings for online services should reflect the ‘privacy-by-default’- framework of the Privacy Act, to determine what is ‘fair and reasonable in the circumstances and be clear and easily accessible for users (Proposal 11.4)

•

Direct Right of Action and Statutory Tort : The government will make it easier for individuals to take direct action where their privacy has been breached. (Proposal 26.1)

WHAT WILL NOT CHANGE “NOTE” Proposals Unlikely to progress at this stage - in the form drafted in the Proposals

The government has not indicated any intent to progress with the following Proposals: providing individuals with an unqualified right to opt- out of receiving targeted advertising (Proposal 20.3) limiting the journalism exemption – this exemption will continue where the handling of personal information is done ‘in the course of journalism’ (Proposal 9.1) extending specific protections of the Privacy Act to de-identified information (Proposal 4.6) extending privacy rules to some activities of registered political parties (Proposal 8.1)

REGULATORY & ADVOCACY

NEXT STEPS

REGULATORY & ADVOCACY

The Attorney Generals Department will continue to lead the next stage of the Privacy Act Review.

This will involve: •

development of legislative proposals which are “agreed”, with further targeted consultation to follow;

•

engaging with entities on proposals which are ‘agreed in principle’, to explore whether and how they could be implemented so as to ‘proportionately balance privacy safeguards with potential other consequences and additional regulator burden;

•

development of a detailed impact analysis to determine potential compliance costs for regulated entities and other potential economic costs or benefits (including for consumers)

•

progressing further advice to the Government in 2024, including outcomes of further consultation and legislative proposals.

WHAT CHANGES ARE ALREADY LAW

While the above Proposals are still to become law - it is important to remember that the Privacy Legislation Amendment (Enforcement and Other Measures) Bill was passed in 2022 and that means there is already significant increases in the maximum penalty that can be applied for a serious or repeated privacy breaches of the Privacy Act 1988 The previous maximum AUD$2.22 million has now increased to whichever is the greater of: -

a AUD $50 million fine;

-

three times the value of any benefit obtained through the misuse of information; or

-

30% of a company's adjusted turnover in the relevant period.

REGULATORY & ADVOCACY

WHAT SHOULD I DO NOW

-

Prepare your teams for the changes in privacy law

-

Consider starting working groups in your marketing teams to understand how this will impact your operations

-

Prepare for an expanded definition of personal information

-

Review your current Notice and Consent in line with new expectations

-

Understand your current data practices

-

Review your current systems and access permissions

-

Build Partner Accountability

-

Prepare for changes in Direct Marketing and Targeting (there are still changes coming!)

REGULATORY & ADVOCACY

-

Strengthen your Data Breach Notification Plan

-

Continue to champion Privacy compliance within your teams

-

Stay engaged in the conversation - the job to be done in this

HOW CAN ADMA HELP?

• To ensure all Members of your Marketing Teams are up to date with the current Privacy and compliance landscape, consider team refresher training such as the ADMA Privacy & Compliance for Marketers. Discounts are available for Members and bespoke team training sessions.

•

Ensure your ADMA Membership is current to:  Stay up to date with industry trends through regulatory updates  Access member-only resources and advice to assist with compliance.  Take part in regulatory training and complimentary bespoke workshops  Improve your ‘data privacy professional ‘ status by being able to display your ADMA Data Pass label

• Subscribe to the ADMA Newsletter here and connect with us on

REGULATORY & ADVOCACY

For more information contact ADMA today at

FOR MORE INFORMATION CONTACT

Email: contact@adma.com

REGULATORY & ADVOCACY