Consumer groups have called for a radical overhaul of privacy laws to provide greater protections for consumers to counterbalance the increased use and exploitation of big data by business and industry.

A joint submission by Financial Rights Legal Centre together with Consumer Action Law Centre and Financial Counselling Australia to the Attorney-General’s Department Privacy Act Review, Issues Paper, October 2020 argues that substantial reform is needed to rebalance Australians’ right to privacy and ensure our laws keep pace with future economic and technological change.

Financial Rights Chief Executive Officer Karen Cox said the review of the Privacy Act 1988 is well overdue.

“Australians want a safe and secure data environment that puts their privacy ahead of the increasingly rapacious data desires of industry,” Ms Cox said. “Australians have had very little power to stop the trade, misuse and abuse of their personal information. The time to strengthen our right to privacy is now.”

The joint submission describes how the rapid pace of technological change has led to a data saturated economy and the development of new business models and markets centred on the harvesting of surplus behavioural data for predictive purposes.

Calls coincide with research released by the Consumer Policy Research Centre today which reveals:

• 94% of Australian consumers are uncomfortable with how their personal information is collected and shared online;
• 88% of Australian consumers do not have a clear understanding of how their personal information is being collected and shared;
• 94% of Australian consumers reported not reading all of the privacy policies or T&Cs that applied to them in the past 12 months.
• Of consumers who had read privacy policies, 69% reported accepting terms even though they weren’t comfortable with them – the main reason for doing so was it was the only way to access the product or service.

Consumers should be free to decide how much or how little of their information they wish to share in exchange for the use of services, Ms Cox said.

“Privacy agreements, privacy preferences, and terms and conditions are often complex and unclear so consumers don’t know what they are consenting to,” she said.

“Yet, declining to participate in data driven technologies is increasingly not an option for many consumers. Services are offered on a like it or lump it basis, meaning people have the choice to either fully participate in the modern economy or retain reasonable control of their personal data, you simply can’t do both.”

The Consumer Policy Research Centre research also found that Australian consumers believe that government has an important responsibility to ensure that consumers are protected:

• 94% of consumers expected government to protect them against the collection and sharing of their personal information (67% high responsibility, 27% moderate responsibility);
• 93% of consumers expected government to improve their understanding of how personal information may be collected and shared (67% high responsibility, 26% moderate responsibility);
• 94% of consumers expected government to protect them from having their information being used in a way that makes them worse off.

Consumer Policy Research Centre Chief Executive Officer Lauren Solomon said the message from Australian consumers is clear.

“Companies have too much control over their personal information. Australians expect a modern protection and enforcement regime that gives them more control and ultimately ensures that they receive fair treatment,” Ms Solomon said.

Ms Cox said while ensuring consent is freely given and informed is difficult if not impossible, there are simple reforms that could improve the process in line with reform under the Consumer Data Right.

Data collection and use exists on a spectrum from the relatively benign, through invasive but justifiable, to outright exploitation. Regulation should reflect this, with controls appropriate to the circumstance and clear prohibitions on more egregious practices, she said.

“The concept of consent has been rendered completely meaningless when it comes to protecting our privacy.” Ms Cox said. “It is time for the Privacy Act be overhauled to deliver real life protections for the modern world, rather than a cloak of legitimacy for poor practices and exploitation.”

The submission can be found here

Background

Key recommendations

• Update the Objectives of the Act to among other things recognise that Australians have a right to privacy and the Act must promote the protection of that right;
• Acknowledge the failures of disclosure, notice and consent as an effective regulatory tool;
• Build privacy and safety into the very design of data collection and handling;
• Overhaul notification and consent process to make them more effective;
• Introduce higher privacy standards including restricting, limiting or prohibiting certain uses and disclosures that are anathema to privacy rights such as screen-scraping, secondary direct marketing, the collection of genetic test results in life insurance, for-profit trade in personal data through data brokers/data vultures;
• Establish a right to erasure, a direct right of action, a statutory tort and an unfair trade practices law;
• Establish specific privacy protections for children.

New research from the Consumer Policy Research Centre:

Transparency and informed choice

• Privacy Policies and Terms and Conditions (T&Cs) continue to be ineffective at informing consumers of company data-handling practices – with 94% of Australians reported not reading all policies that applied to them in the past 12 months
• Of consumers who had read Privacy Policy or T&Cs in the past 12 months, 69% admitted to having agreed to them for at least a few products/services despite feeling uncomfortable doing so

Fair practices and treatment

• 85% of consumers consider it is unfair for companies to share personal information they’ve provided with other companies – while 90% think it is unfair for this information to be sold to other companies. 
• A large majority of consumers also find it unfair when companies collect more information than is necessary to deliver the product or service they are receiving (88%).

Expectations of companies and government

The vast majority of Australians think government has a significant responsibility to:

• Protect consumers against collection and sharing of their personal information (67% high level of responsibility, 27% moderate level of responsibility);
  • Protect consumers against information being used in ways that make them worse off (79% high level of responsibility, 15% moderate level of responsibility);
  • Improve consumer understanding of how personal information may be collected and shared (67% high level of responsibility, 26% moderate level of responsibility);
  • Ensure options to opt out of what data consumers provide, how it can be used and shared with others (68% high level of responsibility, 25% moderate level of responsibility);
  • Develop protections to ensure no one is excluded from essential products and services based on their data and/or profile (80% high level of responsibility, 17% moderate level of responsibility).

Full results of this research can be found on the Consumer Policy Research Centre website.