#81 At last! The Government responds on privacy reform

Arj
Welcome to This Week in Digital Trust, elevenM’s regular conversation about all things tech policy, privacy and cyber security. I’m Arj, joining you today from Awabakal country.
Jordan
And I’m Jordan, joining you from Wurundjeri country.
And we are on a public holiday?
For an important emergency update episode this week.
Arj
Yeah. Yeah, it’s very.
Exciting. Well, it’s exciting for privacy peeps, but you know broader significance as well. What what is the excitement?
Jordan
The excitement is the government’s response to the Privacy Act Review report, which was released. Yesterday and has been in the news a little bit. If you’re in the industry, you’re interested, you’ve probably seen at least some discussion. Finally, we’ve got a government policy position on the stack of recommendations about Privacy Act reform that we have been talking about for almost four years. Is now. It was in December 2019 that the, you know, then coalition government committed to undertaking a of the review of the Privacy Act. And you know now in end of September 2023, we’ve got A at least a in principle government decision about what they’re going to do.
Arj
There’s some high stakes stuff here, like obviously the. People that are, you know, advocates for privacy like we are in various rights groups, really, really keen to see certain things. But then on the other side, you’ve got certain business groups and others who are sort of worried about what privacy reforms could do for their industries. And so there’s been, you know, I would say a reasonable amount of anticipation. And I did wonder about the first day. For Grand Final weekend, where there’s a public holiday in Melbourne on a Friday in Sydney and you know Eastern states on a Monday, is this kind of your ultimate kind? Of take out the trash. Announcement or, you know, is it just a coincidence it feels?
Jordan
Like, that’s tradition for at least Privacy Act review and a lot of digital policy the last couple years we’ve had, like massive discussion papers or proposals being dropped in like late December as well. And just like, you know, Christmas holidays being spent.
Arj
Yeah, yeah.
Jordan
Going through writing submissions at rating things.
Arj
Should be an ongoing commentary on, like a view of how interesting the lives of you know, privacy. People are like, what are they gonna do at Christmas? What are they doing on Grand final weekend like? Let them read this you.
Jordan
Yeah, yeah.
Arj
Know 400 page report.
Jordan
Yeah, yeah, maybe that’s it. It’s like I have the privacy nerds. They’re not going to the footy, it’ll.
Arj
Be fine. I mean, just to I just. Want to kind of. Share A couple of headlines just to frame it, but kind of the AFR lead with this line of around 2.3 million small businesses will face new obligations around the handling of personal information after the government said it would remove an exemption. And the privacy actor that was their kind of. Leading and and. You know, small businesses kind of coming into the. The scope of this act has been one of the contentious issues and then SMH had a headline which was the pledge to move towards a strict European style data regime comes in response to a two year review of the nation’s privacy law. So they’re very much kind of looked at, you know, seeing this as a bold step to kind of, you know, replicate. The what the Europeans are doing, where you know, generally considered to be sort of very much the benchmark or the high watermark for data protection around the world. Fairly kind of I would say. Favourable commentary in the sense of like this is being characterised as a bold step forward.
Jordan
Yeah. And it is right and we’ll we’ll get to my reservation about this in a second, but it is important to recognise just how significant this is, right that there are stack of like really significant recommendations in the Privacy Act Review report, which you know are just coming at that point. From a team in. The attorney General’s department, who’s done some research, done some consultation. They’re making some recommendations. And the things we’ve talked about, some of them are in those headlines, right are fair and reasonableness test for handling personal information, applying the Privacy Act to small businesses and employees is restrictions on targeted advertising rights to sue for invasions of privacy. All these kinds of things would be like massive. And it’s really significant to have a concrete statement from the government that this is their policy intent to enact all of those things.
Arj
Yeah, I I agree. And I think it’s worth kind of emphasising that you know again. Because for the longest time you know, for those of us who have sort of been advocating for privacy reform, it seems like at at that ministerial kind of executive government level, the the sort of the Prime Minister, the Minister, the. Attorney general’s. It hasn’t been a an agenda issue for a long time and then we had a change of government. And Mark Dreyfus came in and sort of gave some good signals that he cared about, and that was almost like the first time we were. Sort of feeling like there might be a chance here, but even after that really the activity and the you know the the shape of what might be done has all been driven out at department level like as you say like bureaucrats kind of gathering ideas from industry and others and pulling together recommendations. But we have always been waiting and wondering like. What does the government at that kind of policy level that, that ministerial level actually think? And what’s gonna motivate them to move in in any direction? So it is, you’re right, absolutely worth kind of seeing. This pronouncement in that context, just for what it is in terms of a a policy commitment.
Jordan
The ambivalence I have, though, and I think you share this in looking at this report, is that all of those major reform proposals are agreed in principle and not not agreed. Right, they’ve got a. Handful of. Proposals where the government said yes, we agree. We’re gonna go away and start drafting legislation for this. That’s just one or two. We’ll get into which ones they are, then most of the major proposals, I think all of the major proposals are agreed in principle subject to further engagement, to explore whether and how they could be implemented, so as to proportionately balance privacy safeguards with potential other consequences and additional regulatory burden. Whether and how that’s? Whether more consultation as to whether we? Can do this so. We’ve got the public. Policy statement to say we want to great massive progress. We’re still on the fence about whether it’s actually gonna happen and that’s where my kind of worry comes in in reading this. It sounds like. To me, like that’s going to be another year worth of consultation that brings us out to, you know, late 2024, there’s probably gonna be a period of legislative drafting after that consultation, probably another. Year there’s gonna be a transition period another year. Even if we get these, which we’re not guaranteed to. We’re looking out to 2627. You know, before it comes into effect, right? So like the the privacy advocate in me was hoping, probably naively, honestly, cause this stuff is wildly complex. And you do need to do a lot of. That kind of detail work. Like, but the privacy advocate in me was hoping that, you know, we’d get a government response. That’s like, Yep, we’re going. Here’s the draught legislation. You know, we’re going to enact it next year, we’ll get going. But yeah, so that’s that’s the disappointment I felt reading the thing. And also the frustration in terms of, like, applying this stuff in companies. Right. If we talk to a lot of. Clients about what’s coming down the line and. This still hasn’t given a certainty right. This has given a certainty about the government’s intent, but will these things actually happen? I still don’t know.
Arj
I I share. It the same view as you and I think my overwhelming kind of feeling was actually disappointment about the likely outcome because the large chunk of this, some like 60% of the proposals are agreed to in. Principle as you. Said. And then there’s a portion above that that weren’t even agreed to it or. Were only noted but. The outcome does not feel guaranteed, you know, and many of the proposals are. So not particularly crafted in a way that was definite, even even the proposals themselves were crafted, in some cases to say, you know, do this only after consultation, like the small business exemption. For example you. Know which we’ll get into. So some of them weren’t even necessarily crafted so strongly. And then on top of that. They’re now saying we’re going to think about what we do next and. To me, the issue in privacy reform is is not so much, you know, we’re in this robust debate of, like, opposing voices. It’s inertia, you know, it’s the fact that we, the the default kind of situations, the status quo are these kind of. Business models and these technology kind of context that mean that people’s rights are violated. And So what we need is forthright action and like if you leave things to just drag on and play out. Then we’re actually, you know, getting a negative outcome. It’s not, you know, it’s not an equal kind of. We’re in kind of the middle of the road kind of the, the, the that we’re finally balanced on the razor edge. We’re actually getting the worst. Outcome while we. Wait. And it feels like we’re gonna be waiting much longer. As you just kind of.
Jordan
Painted the technology the tracking the. Data business models the surveillance. All of that progresses if, if we don’t progress our privacy laws. With that, we’re getting left behind. Yeah, which is a problem. But at the same time again. And this stuff is wildly complicated. It it impacts individuals, businesses, the economy in. All of like every sector is now like it’s an information economy, right? Data is at the core of almost every aspect of our daily lives. It’s really hard to just. You know, flip the switch. You you gotta do the work. I I hope that some priority will be given to. To working through this right, he can’t wait till 2027.
Arj
Yeah, and like. I I’m sorry and I know we’ll get into. This more later, but I think it’s just worth remembering. Also just how much consultation there has already been. You know, you said four years at the start, but it’s also like if you just break that down, it was like. You know an issues. Paper in 2020. That was 90 pages and had 160 submissions and then a discussion paper of two. 100 pages with 200 submissions and then a 300 and. Page review report and then there were 500 submissions. We’ve done a lot of consultation and so my hope was that, you know, we would be making some fairly kind of clear steps forward to legislating some of this stuff as opposed to saying, well, actually we need to talk. About it. More. Anyway, let’s.
Jordan
Get into some of the. Proposals that have been accepted and accepted in principle, we’ll kind of skate through a lot of these, I think, cause there’s. So many, and we’ve talked about a lot of these before. So on the the things that the government has agreed, let’s start with them. They’re things that so the commitment there is that Attorney General’s Department is gonna get ahead and start drafting some legislation, do a bit of consultation on what exactly the legislation looks like, but. The next step is we’re going to get some draught laws that implement these things. So that sounds good. But there aren’t heaps of them. A lot of the. Proposals are like relatively straightforward, kind of clarifications, or no brainers or things that there’s, you know, pretty universal agreement on. So, you know, starting with defining that a child is under 18, like, that’s actually a good. Result. That’s that’s. Good to have that in legislation, but it’s also not. You know, not particularly controversial. What jumped out for?
Arj
You you know that you, as you said, some fairly basic stuff around definitions are good journalism exemptions worth mentioning. Like we, we did a whole episode on kind of media journalism and privacy. One of the proposals has been accepted by the government is the idea that to qualify for the exemption, a media company has to be subject to privacy standards that are overseen by a recognised body. So, for example, ACMI the Australian Communications and Media Authority, but they didn’t kind of accept they only agreed in principle to some of the more stringent. But it’s like. Having the OIC developer criteria for standards and, you know making media companies comply with AP11, which is one of the privacy principles that deals with kind of securing and protecting information. So a bunch of bunch of stuff there that they they sort of shelved. But in general positive step forward.
Jordan
Yeah, exactly. That’s a good result. Just that requirement that media agencies self regulation is like there’s a standard, right, there’s a privacy minimum that that self regulation must meet which right now. That isn’t is is a good result. I think. The other thing really significant is some additions to the OIC’s regulatory powers. So they’re getting some enhanced powers to issue fines for certain kinds of privacy invasions and some enhanced kind of enforcement powers. So that’s significant. As well, probably the biggest thing for me though, is this commitment to introduce an online code for. Service is likely to be accessed to by children. This was a proposal from the previous government as well. It’s been kicked around a bit, but there’s this thing in the UK called the age appropriate design code, which is. A set of. Requirements for online services that are designed for kids to access that has things like prohibitions on like nudging. People into certain behaviours, prohibitions on collecting too much information or requirements to design the services in the interests of children. There’s a bunch. Which of just? Special protections that apply to kids in online services, and so the proposal that’s been agreed to is to develop a code like that for Australia that’s focused on online services, which I think is great.
Arj
Result. Yeah, great. Great, great result. And I think with things like children’s kind of protecting children, they’ve read the sentiment in the air. That’s. You know, there’s there’s a real appetite for more protection there. And in the same in a similar way. Notably, facial recognition was something that they’ve sort of stepped into and agreed. So one of the agreed proposals is that organisations need to consider, you know, doing enhanced risk assessments for facial recognition or that there be requirements and that and that’s part of a broader kind of set of thinking around. What’s going to be required of any high risk technology by private sector organisations? That second thing that I just said the the broader kind of idea of. Any high risk technology having a kind of risk assessment that’s agreed to in principle so you know we we may not see that in the short term, but facial recognition being kind of called out specifically and agreed to I think is like the like with children’s privacy, the community is worried about it. So they’re sort of step forward into.
Jordan
That, yeah, for sure and. Kind of related to that is the automated decision making stuff. So there’s a handful of proposals that have been agreed to. Around transparency of automated decision making. So if a company is using automated decision making on significant decisions, so things like you know refusing access to a important service finance or housing or employment or things like that, decisions that have a significant impact in a. ‘S life. They have to be transparent about that in terms of like saying that they do that for that particular type of decision in their privacy policy, saying what kind of information they use and giving individuals a right to request, like more information about exactly how that decision was made. So that’s I think, a really good one that’s been missing.
Arj
Welcome.
Arj
Should we move on to what the other end of the spectrum, which was the nose? Yeah. Again, some great government speak. Governments don’t just say no, they note. So when they when there’s a proposal they don’t wanna do anything with. They just note that. The proposal was made and move on.
Jordan
Which is a great tactic for if people want to deploy it in there, just personal life. You know, if someone gives you feedback or. Just say noted. Yeah, move on.
Arj
My note that my room needs to be cleaned, I’ve noticed.
Jordan
Yeah, yeah, yeah. Your your room needs cleaning. Note it. That’s not an intent to do anything about it. I’m just like, I hear.
Arj
You the one. To start with, probably it’s gotten quite a bit of attention. Is the political exemption, so there’s currently a an exemption in the Privacy Act for political parties and political activity. These and large numbers of people submitted into this kind of process to say that shouldn’t be there anymore. You know, there’s kind of a lot of collection of personal information by political parties, a lot of misuse of personal information. And you know, we’ve seen things like Cambridge Analytica happen overseas and all of that kind of stuff and and, you know, text messages and spam messages from Clive. Mama and.
Jordan
The last election people getting text messages, I think just like blew this up as an issue. Everyone’s like, how can they do this? This is outrageous. Yeah.
Arj
Yeah, I was looking at the review report from February the into the Bribery Act and and there’s a quote saying almost all submitters commented that the exemption was not justifiable and should be narrowed or removed. And when you consider how, yeah, kind of contentious and debated most of the proposals are in the Privacy Act proposal. This one was, like, almost everyone agrees this is just. Bogus, except it would seem the government. Yeah. Yeah. The notable exception being the government. So the government basically noted.
Jordan
Well, almost everyone.
Arj
All of the. 6 proposals relating to removal of the privacy exemption. So things like the fact that political parties might have to publish privacy policies, do things that are only fair and reasonable, allow people to opt out of direct marketing, take reasonable steps to protect information. No political parties don’t have to do any of it, and we’ll continue not to have to do. Yeah, but which? Sure.
Jordan
I won’t get into that. Let’s, let’s keep moving. Yeah, the other two. That’s actually the only really major, I think, proposal that the governments effectively said no to there are. A couple of other like. Detail bits and pieces around DE identified information and targeted advertising that the government said, well, no, but probably they’ve agreed in principle to related recommendations. And they.
Arj
Said I will.
Jordan
Probably deal with this in a different way, or we’ll do some more thinking. The other noted. Yeah, around deidentified information. There were some proposals to extend the privacy protections to DE identified information and to prohibit reidentifying deidentified information all. These kind of. Intended to stop people from trading in de identifying information so that it’s not covered by the Privacy Act and then trading in that information and then re identifying it as kind of data. Grocery stuff that sometimes goes on and is slightly. Lady. And they’ve said no to those things, but but they have been pretty good on the general proposals to clarify and expand the definition of personal information generally. And I think their approach to that, in particular they’ve taken this position that’s recommended in the Privacy Act. View and that the OIC, the Information Commissioner, has in fact applied in some determinations recently that you don’t actually need to know a person’s name for them to be identified in a data set and for the Privacy Act to apply. Buy all you need is to be able to single them out to to be able to distinguish them from everybody else. So if you just have like a advertising identifier and you can distinguish a person with that, that’s personal information. And so there’s a really strong policy statement in the government response to that effect, they say. Importantly, the government considers that an individual may be reasonably identifiable. Where they are able to be distinguished from all others, even if their identity is not known. But I think that’s a really important policy statement. So it’s less I’m. Less concerned that they’ve said no to the detailed DE identified stuff.
Arj
The noting, or in other words, the kind of knocking back of the proposal for an unqualified right to opt out of target advertising, has gotten quite a bit of attention. I think you know one of the, I guess, biggest criticisms of. The governments response, in addition to the political exemption not being removed, has been on this targeted advertising. People have seen it disappointing and I had that initial response too. But then I think like you, there’s more to target advertising and a lot of it is premised on that capability that you said, which is that you know, there’s this ability to distinguish people. Not by knowing their name, but based on other factors, and so the importance of recognising that behaviour to attract people in a way that doesn’t allow them to be known by their real name is, I think, important to acknowledge, and it will. Will play a role in kind of putting some limits around targeted advertising if those requirements come through the the other thought I you know, I had around the targeted advertising ones. It just seems like a very hard thing to to do like to to allow for an unqualified right to opt out. You know so much of what we consume online. We talked about this in our previous episodes. That the original sin of the Internet is like, you know, there are services that exist that are that we only get because targeted advertising is part of the pack. Engine. Maybe the government just. Thought that was too. Hard to unpack, you know, if they would allow people to outright opt out, does that mean that they should be allowed to be denied a service you. Know there’s a. Whole thing going on in Europe at the moment around, you know, matters legal basis for doing operating its business and it’s a very, very complicated thing to step into.
Jordan
I think it also gets to some of the complexity and. Into relational illness, there’s a better word for that that I can’t think of right now, interdependency of. These proposals that OK, we didn’t get the unqualified right to opt out of targeted advertising, but if some of these bigger proposals about fairness and reasonableness requirement and and that expanded definition of personal information get up, then all the dodgy tracking that under pins targeted advertising. If you can tidy that up, maybe targeted advertising itself is not the problem. And so I think it’s it goes through that’s kind of the optimistic lens. Anyway, right that.
Arj
It it’s optimistic, but it’s also holistic in the sense that it also addresses the sort of the weasel words of some of the framings of targeted advertising proposals, which is that, you know, we are going to allow people to opt out of receiving targeted. Advertising and that word receiving means that. OK, well, I don’t have to send you target advertising, but I can continue to track you and profile you and learn other things about you in the background.
Jordan
So and use that. To target to like your family who didn’t have.
Arj
You’re. Yeah. Yeah. So that’s why.
Jordan
Doubt or something?
Arj
Way you need that more deeper view of you know what’s going on, what’s fair and reasonable because yeah, you can play that game. But I mean, going on to the fair and reasonable, then moving into the set of things that were agreed in principle, as you said before, the vast majority of the proposals kind of 6070 odd were agreed in principle. But we’re going to hone. In on a couple of the. The ones of significance, the things that we’ve probably spoken about before that are of interest to. Us under privacy reform the fair. And reasonable test being one of. Them this is actually. A big deal. I mean, again, like all the caveats about what, what agree in principle actually means in terms of when we’ll get this, but to to re explain what it is, I think I just read, there’s a really good kind of statement in the government’s response itself, which I’ll just read. Out, but relying. Exclusively on notice and consent to regulate. Personal information handling may place an unrealistic burden on individuals to decipher lengthy policies and collection notices that outline complex practises the government agrees in principle that this imbalance imbalance be addressed through a new requirement that collections, uses, and disclosures of personal information are fair. Reasonable. So it’s really just I think that’s a fairly compelling kind of statement of the issue with sort of moving on from this idea that there’s a check box kind of exercise that if people agree to what are complex descriptions of information handling process practises, then we can do those things. We can do whatever we want and moving away from that to say, well actually. Bonuses on you to make sure what you’re doing is fair and reasonable to begin.
Jordan
With, if the privacy Commissioners resourced to do this, it gives the. And a really good and important role of just like enforcing these norms, like looking at dodgy information practises, looking at surveillance or, you know, creepy harvesting of all of the car stuff that we were talking about the other day. It gives the away. I see the Information Commissioner. Tool with which to just look at really dodgy practises and say Nah, that’s out. That’s not fair. That’s not reasonable. Yeah, that’s the the biggest one for me. If that was. If I got to pick one proposal out of all of these would be that one is the the thing that will like move the dial the most and other other agreed. The principal ones that are really big ticket items are expanding the coverage of the Privacy Act to small. Prices, there’s the proposal is to do that gently and with a lot of consultation and a lot of consideration about the burden and whether some aspects of the Privacy Act don’t apply properly or would be, you know, super onerous and not very beneficial, which is all very appropriate. But the overall policy goal is to get to the point where. The 95% of Australian businesses that have turnovers under $3,000,000 a year and that aren’t covered by the Privacy Act because of that currently. To bring all. Of those into the coverage of the Privacy Act. So that’s a really important proposal and related to that is getting rid of the employee exemptions.
Arj
I was just gonna say on the small business, one first well, one of the things I liked about the governments response, even though they aren’t necessarily moving forward say with the small business. Question is, they did reflect a lot of the kind of community sentiment back into its response. So they they referenced the Community Attitude Survey report and they talk about the community expectation that if you provide your in federal small business, it’s still gonna be kept safe. It doesn’t matter that it’s a small business. So that’s important I think in making that policy statement is to say you know this is we know what the Community. Once, but I think the I. Think most of. Us are on. Board with the fact that this is gonna be a big change, so consultation is is, you know, gonna be need to be part of the part of the picture similar rationale I guess for the on the employee side which is is a sort of an outdated approach to trying. To manage employee personal information under workplace relations laws or or or the you know the the privacy kind of concerns that may. Come up around. That, and the expectations of us now as individuals are whether it’s my employee, whether it’s a small business, whether it’s big business, you know, I have protections around my personal information, so. They’re going to move forward with that in.
Jordan
Time there’s a bunch of restrictions around targeted advertising and direct marketing. Probably the most significant of which again relates to kids. I think that targeting of content or advertising to children. Has to be in their best interests or it’s not permitted. At all. So that’ll force online platforms and others to really consider if you’ve got an algorithm that is tailoring what a child will see, you’ve really got to consider, like design that to be good for that child, right, not just for your corporate bottom line or for engagement. And there there are some other kind of restrictions or controls on trading data about kids as well and then some broader restrictions on enhanced restrictions and rights to opt out to targeted advertising and direct marketing more broadly. And your requirement for people to consent to. The trading of their personal information so companies can’t. Sell your information. And without you explicitly yeah agreeing to.
Arj
It and then speaking, I guess, Speaking of rights there, there’s a couple of areas that have long been on the agenda for privacy reform, which was to give individuals more rights to take actions when they feel their privacy has been infringed. And there are two proposals, both of which the government agreed to in principle. One was a direct right of action. Which basically allows individuals to go to the courts if they feel like they’ve suffered a a breach. Under the act. Hmm, is that they still have. To go via the OIC for that.
Jordan
Yeah, they still gotta complain, but they. Can if it doesn’t get mediated and conciliated and so on, they can bring an action to the court, which you kind of would have assumed a lot of this stuff, you kind of assumed you could do today, but.
Arj
Yeah, yeah, yeah.
Jordan
You can’t. You’re completely. Reliant on the way I see agreeing with you and making the determination and awarding the damages. Right now.
Arj
Yeah. And then the other one is the statutory tort for serious invasions of privacy. And so this is the, this is where you. And kind of go to the courts for compensation for a breach of privacy that isn’t covered by the act, so that you know, the classic case is being snooped on by a neighbour or. Something like that or or. A media company so not not covered by the act, but you now have a right. To go to. The courts around.
Jordan
That, yeah. So, so, yeah, good examples of that. Neighbour snooping. Someone taking like individuals taking videos of other individuals in like a public bathroom, say, or in a, you know, in a private environment or an employee missing misusing sensitive facts about another employee that they got, you know, by virtue of like a work position or something right now. Well, there’s like, you know, covert filming wars, but they’re like criminal offences that punish a person for doing the thing. There’s not like, a right to redress or a right to compensation when someone does that invasion of privacy thing to you. And so this statutory tool would would establish that again. Yeah. Like you say, it’s been discussed forever. Having a concrete government policy to enact that is great. It’s been on the table forever, so I believe it when I say it. Honestly, that’s the cynic in me talking. But it would be great to have so that’s that’s the that’s the overview, right? That’s the. So there’s a bunch of like really significant reforms as we were saying. At the top that the government has now committed to making happen. If they can, we’ll see how big a caveat that is, how you feeling about it, Dutch?
Arj
Well, I mean, it’s interesting talking about that last set of things that are agreed to in principle, the fair and reasonable kind of tests, some of the removal of exemptions, the rights of action. It it gets you kind of motivated it, it feels like this is the right step forward. And I you. Know. So I there’s a general kind of positive sentiment around the fact that these are agreed to in principle. But I. I can’t shake the feeling that ultimately I’m sort of disappointed with an outcome where the major commitment is to consult some more on these important things. Too importantly, it’s phrased throughout the report that this agree in principle is also about like, as you said, it’s weather and how so it’s not just about how to do it, it’s weather and the weather is. Contingent on, you know, do the trade offs stack up? So it’s like not just is the impost on you know business you know excessive and whatnot but there were references to kind of you know looking at the economic benefits and consulting with treasury around many of these proposals that that’s in the definition of what it means to agree to something in principle. Under this report and. Given what I was saying before about, you know, sort of reading out that kind of history of how many consultations have been and how many submissions they’ve been, and you know how many reports have been written. It is hard for me not to feel like we could and should be further along in terms of a clearer decision about legislating most of these things not. Just the sort of. Half a dozen or 10 that were agreed to. Yeah. Ultimately I don’t. Know that I feel.
Jordan
Yeah. No, for sure, right? Well, like, I mean, again, we’ve been talking about this review since 2019. We’ve had issues papers with a lot of these proposals like these are not brand new proposals. In the final report, right, we’ve had a whole bunch of issues and discussions papers and consult. Questions. Have we not consulted with Treasury yet? You know, like have we cannot not considered the economic impact of these things have, are we just now realising that these things might have economic impacts, you know that it’s it’s a bit I I share that disappointment right that like it feels like we’re gonna. Yeah. I mean we’re not starting from scratch but it feels like. They’re just now thinking about the the potential economic impacts of that which have been covered in submissions from both sides throughout the process, right?
Arj
You know all.
Arj
The patience. Yeah. In February this year, the Privacy Act Review report, which was. The attorney general’s departments statement of what the proposals were, so this was, after all of the previous two or three rounds of consultations, even, that final report that says, OK, we’ve heard all the consultations. Here’s what we lay out as being what we need to do to our privacy Act. Even that went for consultation. And there were 500, you know, responses, written responses, submissions about that. And then the AGD did held further meetings after it received those submissions to get further stakeholder views. You know, we have consulted, we have canvassed, you know, we have gotten the input around all of these things. There’s a. I don’t know. It’s too strong to say. A lack of kind of political courage to make the call now. Like. Yeah. And like I said before, I feel like inertia is the biggest problem in this space, not the fact that, you know, there’s the, you know, opposing or wrong, you know, political view or policy view. It’s just that there’s a willingness to let this. Stuff just sit. And not get done. And you know the phrase kinda. Have they kicked the can down the road it gets used, but the one the phrase that version of that that I you know heard from a former colleague a couple of years ago was kicking the can into the sorry kicking the ball into the long grass you know it’s like not kicking the can down the road because you can still see the. And you kick the ball into the long grass, and maybe nobody sees it for a while and and you know. And so it feels a bit like that. So I.
Jordan
Yeah, this stuff. We’ll deal with it later, yeah.
Arj
You know, I look forward to seeing what this 2024 legislation looks.
Jordan
Like I’m I’m gonna remain optimistic. I’m. I’m hopeful that there is a genuine intent here to, you know, make real progress on these items. But yeah, we’ll we’ll see if it’s, you know, if we get another position paper in 12 months. About these approved in Prince. All consultations I’ll be very disappointed the the last thing for me is also just it’s quite frustrating advising people on this stuff, right? Cause we’ve been for years now saying privacy reform is coming, but it’s probably a few years away. It’ll probably cover these things so we can kind of start preparing. But there’s just so much uncertainty. About still weather and how these new laws will come into effect. And so yeah, it just makes planning and a lot of these things you actually need 2 long term plan, right? Like you need to build a right to erasure or a privacy rights into like software and IT deployments and they have like like long lead times. So yeah a bit of certainty. Here, even if it was just like, we’re definitely doing it, we’re just consulting. How would have been would have been really nice to.
Arj
See, because there’s also political uncertainty, which is the other factor, right? Like it’s it’s they we’re talking about introducing this stuff in 2024. There’s a the next election has to be held before May 2025. We’ve often looked at the sort of the change of government with the Labour government. As being the opening of the window to get some of this stuff through because they’re the government that have said they prioritise some of this stuff. You know who? Knows what happens at the next election. You know, there’s a there’s a referendum going on that you know that this government is is sponsoring that at the moment on all polls is not going particularly well there. There’s a lot of political capital going into that. What are what? Are they? What do things look like on the other side of that referendum in? Terms of political capital. Appetite to push things through what happens in in the next election. Question on the back of. All of that, you know, so This is why it’s the kind of, you know, it’s the once in a generation type opportunity that’s been described as we haven’t done this since, you know, the actors in 1988, there’s been some tweaks along the way, but this was the attempt to modernise it. This was the sort of once in a generation opportunity and. Yeah, I don’t know that we’re fully grasping.
Jordan
It Yep for sure so. Yeah, that’s it. That’s the take.
Arj
Cheery, cheery, cheery way to.
Jordan
I don’t want to finish so, so down. I am genuinely super optimistic. I I’m I think this is like really significant, really progressive, really import. Set of policy positions on those key facts, even though there’s still a lot of work to do. And yeah, it’s, you know, it’s sunny and bright in Melbourne today. I am resolutely optimistic. So yeah, look forward to seeing how this develops.
Arj
OK.
Arj
Well, you can keep keep working on me. And I will. I will join the.
Jordan
Yeah, I’m pretty good.
Arj
I’m happy. Happy.
To be brought along for. The for the more optimistic great. Thanks Zach.
Let’s thanks, Jordan. Next week next time.