In this final post from our ‘Privacy in focus’ blog series we discuss changes we believe are necessary to enhance trust and confidence in the broader privacy landscape in Australia.
Thus far in the ‘Privacy in focus’ series, we have looked at the operation of the Privacy Act and its most fundamental elements: the definition of personal information, the operation of notice and consent, and organisational accountability. We have proposed changes that we believe will strengthen how privacy is managed.
In approaching our final post, we put ourselves in the shoes of the individual. What does the operation of the privacy regime look like to them? Are there gaps? Is there consistency in who is covered and who isn’t? Do they feel empowered to participate in the defence of their rights? In asking these questions, it became clear that there may be some blind-spots and loopholes undermining confidence in the broader system.
Time to close the gaps
A number of exemptions in the Privacy Act – while reasonable at the time of their inclusion – no longer appear valid given the way our economy and online environment functions. Most striking are the exemptions for small businesses and employee records.
Due to technology, small businesses today are capable of great scale, with many handling significant volumes of personal information. Small businesses account for 97% of all Australian businesses (by employee size) and at least a third of the value of the Australian economy. Excluding such a large chunk of the economy from privacy regulation not only places many individuals at risk of potential harm, it erodes trust in our privacy regime, is out of step with international standards and contributes to why we are inadequate under GDPR.
In saying this, many small businesses today already comply with overseas privacy regimes (that do not include a small business exemption) because they also service international customers. Removing the small business exemption may provide many such businesses with consistency and reduce friction in international transactions.
The changing times have also left employee records and political exemptions behind. Due to the convergence of digital experiences inside and outside the workplace, it’s likely many individuals have the same expectations of privacy from their employer as they do of businesses they deal with outside the workplace. The emergence of workplace surveillance technologies also further underscores the need for better protections for employee information.
On the political front, developments such as Cambridge Analytica, growing voter databases and unsolicited campaign messaging have clearly cast a shadow over the validity of exemptions for political parties.
As a final note, the Australian Community Attitudes to Privacy Survey 2020 found almost three-quarters of Australians feel exempt organisations “should be required to protect personal information in the same ways that government and larger businesses are required to”.
Two final strings to the bow
Earlier in the series, we made the case that consumers are not truly empowered to manage their own privacy – largely because the idea that we can make rational decisions about future informational harms, especially in increasingly complex digital ecosystems, is a deeply flawed premise.
This lack of empowerment is even more explicit when things go wrong. Firstly, many privacy wrongs are not covered by the Privacy Act at all. Absent a general ‘privacy tort’ or independent statutory cause of action, individuals lack the ability to take to court serious invasions of privacy that don’t involve the Privacy Act, such as such as unauthorised surveillance or infringements on the privacy of communications.
Even when an infringements is covered by the Act (ie. matters of data protection by organisations), individuals presently have no direct recourse. They must rely on privacy regulators – such as the Office of the Australian Information Commissioner – to act against the violating entity on their behalf. This makes a resource-strained regulator something of a gatekeeper.
It seems logical that a key part of empowering individuals to protect their privacy would be to give them the right to seek judicial redress when harmed. Tellingly, 78% of Australians believe that they should have the right to seek compensation in the courts for a breach of privacy. Indeed, the need for a statutory cause of action for invasions of privacy has been canvassed previously, including by the Australian Law Reform Commission (ARLC) and The Australian Competition and Consumer Commission’s Digital Platforms Inquiry.
There does need to be careful consideration of how a direct right of action is designed. Much has been written about the deep pockets required to approach the courts, and the counter argument that the courts could be overwhelmed by trivial privacy complaints, to say nothing of the fear of the business community in being dragged into ‘nuisance lawsuits’. Options such as a threshold test and procedural considerations have been contemplated in detail, including by the ARLC in its 2013 issues paper and by elevenM in our direct right of action research paper.
Introducing a direct right of action might also shift sentiment, drawing individuals to think more keenly about their own privacy. A direct right of action also amplifies the idea that privacy is of value in our society, particularly once individuals pursuing actions becomes visible. As argued by US lawyer Yosef Getachew in making the case for a right of action in the US, a direct right of action is “an extension of democratic participation, like petitioning government, writing members of Congress, and talking to state legislators.”
Towards a unified system
As we’ve worked our way through this blog series on the review of the Privacy Act, what has emerged clearly is that the legislation remains is no longer in-step with the modern digital environment, and that reform is necessary.
This includes changes at the level of definitions of terms like personal information. Equally important is understanding whether measures like consent and notice remain effective and durable as digital interactions become more complex. When we consider the roles of individuals and organisations, we also must ask: how do we strike the right balance of accountabilities? Should we reframe where the onus of responsibility sits?
In short, we seek to imagine a more unified system in which all parts – individuals, organisations, regulators and the regulations – work together to deliver a digital environment marked by consistently good privacy and high levels of trust. We’re confident many of these issues will be contemplated seriously by a revised Privacy Act, and hope this series has been a constructive and informative contribution.