Digital Platforms and Beyond – Potential Privacy Reforms
On 26 July 2019, the Australian Competition and Consumer Commission (ACCC) released its highly anticipated ‘Digital Platforms Report’. The report was intended to assess the impact of digital platforms (online search engines, social media platforms and other platforms storing digital content) on Australian consumers and businesses and issue a series of recommendations for legislative reform.
The ACCC report, through the recommendations made, appears to have laid the foundation for significant reform of Australian privacy law to increase consumer protection, with impacts likely to extend further than digital platform regulation.
ACCC’s Privacy Recommendations - The Goal
The ACCC recommendations relating to privacy and data protection are intended to inform, empower and protect consumers, giving individuals greater control over their data and a better understanding of how it is being used.
In their report, the ACCC recognised that large digital platforms like Google and Facebook are privileged over consumers, who are often unable to fully understand or control the collection and use of their data when agreeing to an organisation’s Terms and Conditions.
The ACCC suggested that Australia’s current privacy legislation contributes to this, as it does not do enough to safeguard individuals against the increased challenges posed by digitalisation.
ACCC’s Privacy Recommendations – A shift towards Europe?
In this vein, the ACCC recommended sweeping reforms to existing Australian privacy legislation. These recommendations include:
widening the definition of ‘personal information’ in the Privacy Act 1988 (Privacy Act) to include a consumer’s technical information (such as metadata, IP addresses and ‘cookies’);
increasing the clarity and readability of consumer notifications about the collection, use and disclosure of their personal information;
bolstering consumer consent requirements; and
empowering an individual to request that their personal information no longer be held by an organisation.
Notably, the recommendations also include establishing a statutory cause of action, to enable individuals subjected to ‘serious invasions of privacy’ to seek damages from the organisation responsible. This measure, recommended previously by the Australian Law Reform Commission, has been the subject of some debate in the past, and is reminiscent (along with the ACCC’s other proposed privacy law changes) of the stricter data right protection and management introduced in the European Union in 2018 as part of the General Data Protection Regulation (GDRP).
What does this mean for my organisation?
Privacy reforms reflecting the ACCC recommendations, if implemented, will likely affect all Australian entities currently subject to the Privacy Act. In a climate of increasing stringency in data protection, such entities can best prepare themselves by taking a proactive, ‘privacy-by-design’ based approach to protecting consumer rights and by maximising consumer understanding of, and engagement with, the entity’s information management practices.
How the Federal Government will implement the ACCC’s privacy recommendations remains to be seen. A 12-week consultation period is currently open (closing on 12 September 2019), enabling individuals and businesses to provide submissions about the ACCC’s recommendations. Submissions can be made via: https://consult.treasury.gov.au/structural-reform-division/digital-platforms-inquiry/
If you or your organisation are seeking advice about how potential changes to privacy law might affect you, our experienced privacy lawyers can help. We can be contacted at help@adaptbl.com.au
Georgina Hicks and Geoff Adams