In this policy update our Director of Policy and Regulatory Affairs, Sarah Waladan, provides members with important information on privacy reform in Australia including misinformation in the public debate on privacy. She also provides an important update on a breaking Government review on the implementation of new messaging for gambling advertising. If your organisation would like to discuss either of these policy areas with the IAB, please email sarah@iabaustralia.com.au
Privacy reforms
Some reforms likely to be pushed through more urgently
The Attorney-General confirmed at a Press Club address last week that, while the Government is still working to finalise the review of the Privacy Act by the end of the year, they will look at bringing forward some reforms more urgently following the Optus data breach. The reforms they are considering addressing more urgently include:
- Increased penalties to disincentivise breaches
- Enabling better sharing of personal information with financial institutions to minimise harm from data breaches when they occur
- Minimising personal information that organisations hold and the timeframes that they hold that information, to minimise the consequences of breaches when they occur
The Attorney-General indicated that the government is still deliberating exactly what these more urgent reforms will look like, and the timing is not yet clear. We will let IAB members know once we have more information.
Misinformation in the public debate on privacy reforms
The public debate on privacy reform is heating up in the wake of recent data breaches. There are very complex and important issues to be worked through in terms of how we balance the law. On the one hand, we need to ensure data is kept safe and secure and privacy harms are minimised. On the other, these issues need to be resolved in a manner that maintains a functioning digital economy. However, there have been some issues that have clearly been misrepresented by some advocates lobbying for “stronger” protections, in particular:
The definition of personal information requires there to be a link to the identity of an actual person.
To be regulated by the Privacy Act as “personal information”, the law requires that information must be able to reasonably identify an individual. This is a fundamental aspect of our privacy law. The public debate on this issue sometimes misstates the current law, suggesting that information can be “personal information” regardless of whether it is linked to any actual identifying information. This is not correct or logical. If we extend privacy law to situations where no individual is reasonably identifiable, we are going well beyond the currently understood meaning of the term. Privacy rights and potential harms arise at the point where information is attributed to an actual person. This is a live debate in the current privacy review and IAB has made submissions on this and will be speaking to Government to highlight the critical importance of this issue.
In IAB’s view, Australia should adopt a similar approach to countries like the UK or Canada, looking at practical standards to determine whether data reasonably identifies a person or whether data is sufficiently de-identified, based on the relevant context; factors such as costs, the amount of time required, technologies available, and operational barriers in place to prevent identification in the circumstances.
Data enrichment practices are routinely done in a lawful manner
Data-enrichment can and routinely does occur in a manner which is legally compliant. Data enrichment using de-identified or anonymised data (which is not “personal information”) from third parties is lawful and the Privacy Act does not prohibit this. There are a number of privacy practitioners whose business it is to assist companies to ensure their data practices, including data enrichment, are conducted in a privacy-safe and Privacy Act compliant way.
Data segmentation does not create a high privacy risk for individuals if done in a privacy compliant manner.
This is not the case if done in a Privacy Act compliant way. Ultimately, whether or not someone is identifiable depends on factors such as; how detailed the segments are, how many people are in the relevant segments and what data practices are adhered to in order to ensure identification does not occur.
A person in a segment containing people who are (1) Female and (2) interested in purchasing fashion items; and which may have 5000+ people, may pose a different risk of becoming ‘reasonably identifiable’, to a person in a much more detailed/broken down segment. This is what organisations need to have measures in place to manage and ensure that consumers’ privacy is sufficiently protected and that they are not reasonably identifiable.
Consumers do actually want a personalised experience – going back to a pre-internet age is not really an option.
Numerous surveys have shown that consumers want a personalised experience. The OAIC’s Australian Community Attitudes to Privacy Survey 2020 found that while privacy is a major concern for Australians, and most want more choice and control over the personal information, 48% of people surveyed said they preferred personalised ads compared with non-personalised ads, with a further 29% not indicating a preference.
IAB will continue working on these issues and talking to Government to try to ensure we are having an honest and balanced conversation about the law as it stands now and how we can build a better privacy framework going forward.
Gambling Advertising
In 2018 the Commonwealth, State and Territory Governments agreed to the National Consumer Protection Framework, which provides for the development of a national approach to minimum protections for consumers of wagering services, including ‘consistent evidence-based gambling messaging’.
The Government is currently in the process of implementing the new messaging and briefing industry about a revised set of taglines that will replace the current ‘gamble responsibly’ tagline on gambling ads across all media.
For digital advertising the new taglines, which will be required to be rotated equally, are:
- Chances are you’re about to lose.
- Think. Is this a bet you really want to place?
- What’s gambling really costing you?
- What are you prepared to lose today? Set a deposit limit.
- Imagine what you could be buying instead.
- What are you really gambling with?
In addition, digital ads will be required to include the call to action ‘Set a deposit limit’.
The Government has indicated that the new rules are required to be implemented by 30 March 2023.
IAB is working to ensure that the new rules are practically feasible, and that industry is consulted throughout the remainder of the implementation process. Please get in touch if you have concerns or would like further information.