Explainer: What's next for privacy laws?

Privacy expert Anna Johnston on some of the expected changes to the Australian and global privacy landscape

IAB Australia hosted a data governance and consumer privacy webinar recently. As part of this, principal of one of Australia's most respected experts in privacy law and practice, Salinger Privacy, Anna Johnston, shared her thoughts on the future of privacy for the Australian and global media and marketing industry.

For Johnston, privacy laws are not a barrier to innovation, but actually an enabler. To begin with, it’s important to recognise privacy law is not only about what might be described as private data. The Privacy Act regulates all personal information, whether the information is publicly found or privately held.

“It doesn't matter if it's considered private in the sense of things secret or something embarrassing, what the law protects is actually very broad,” Johnston explained.

But it’s not about companies, which don't have privacy, it's an individual human right. “That individual must be identified, or reasonably identifiable. If you can put two and two together to maybe figure out who the person is, it will make the definition of personal information and the Privacy Act will apply and privacy principles which define your legal obligations will kick in,” she said.

Privacy regulations apply from collection, storage, use and eventual destruction of personal information - that is, its lifecycle. The regulatory environment, both locally and globally, is also covered by numerous privacy laws, creating new challenges for organisations to ensure they comply across all jurisdictions. It’s an environment which is increasingly complex as privacy requirements are changing, Johnston said.

The local context

The Office of the Australian Information Commissioner (OAIC), which includes the Privacy Commissioner, is the regulator in this space. Following the Australian Competition and Consumer Commission (ACCC) Digital Platforms Inquiry, the OAIC is expected to put out a legally binding code on digital platforms in regard to privacy requirements.

Following the inquiry, the Federal Government made an in-principle agreement to review and reform the federal Privacy Act along the lines of most of the ACCC's recommendations. Johnston expected there to be a focus on improving and bolstering the definitions of consent.

There's also the potential to recast the definition of personal information in line with the recommendation from the ACCC that it explicitly include online identifiers, including cookies, beacons and other kinds of tracking technologies, even if you can't necessarily link the identifier to a named or nameable person. This, in turn, could lead to potentially tougher rules around the secondary use or disclosure of personal information, Johnston said.

The co-regulatory model is another potential development that would involve cooperation between the OAIC and ACCC as the consumer protection and trade practices regulator. It's for this reason Johnston saw the two regulatory bodies increasingly joining forces to tackle industries such as digital platforms.

Loyalty schemes and adtech could also be subject to collection principles on invasive or unfair practices. “The OAIC more recently has started to call out things like whether or not the means of collection of personal information is fair. And if it's not fair, does that not even meet the law? It’s not just an ethical test, it’s also a legal test," Johnston continued.

“The OAIC is potentially looking at an overriding fairness test and maybe targeted marketing and profiling for adtech will be opt-in only.”

Australian privacy law may also be bolstered to include data subject rights - in addition to the current right of access and correction -  to include erasure or deletion, algorithmic fairness and transparency, similar to the GDPR laws in Europe.

“We could see an increased focus on accountability through methodologies like privacy impact assessments on new projects, possibly making the idea of privacy by design mandatory," Johnston said. "This is the idea that when building new products, services and technology systems, it must start from a position of privacy by  design, possibly privacy by default.

“We could also possibly see direct right of action, meaning consumers could sue companies directly for breaches of the privacy principles, rather than have to go through the privacy regulator.”

The global context

We have witnessed the backlash against big tech, nicknamed the ‘techlash’, after the Facebook Cambridge Analytics scandal in particular. But it also pushes back against the big tech platforms like Google and Amazon and the sense they have gone too far in infringing on people’s privacy.

Johnston suggested we could see consumer protection and privacy regulators joining forces and noted the ACCC globally is being watched very carefully by the privacy community. “The ACCC is very much the first ones to come out and do a big inquiry into the digital platforms,” she pointed out.

“That focus on big tech is also coming from the privacy regulators. It's not just privacy advocates or consumer advocates, it's the regulator's themselves.”

Johnston gave the example of New Zealand Privacy Commissioner, John Edwards, who in a recent speech called on regulators to join forces to deal with the power of symmetry of the big tech companies. She noted after the Christchurch massacre, New Zealand has taken a particular interest in regulating digital platforms.

“He [Edwards] is talking about not just the consumer and competition regulators and privacy regulators, but also online safety regulators and, to a lesser extent, those covering intellectual property and publishing issues like copyright and defamation,” she explained.

In Europe, the Court of Justice of the European Union said third-party and tracking cookies need the consent of the user of that website, or the consent of the consumer must be opt-in and proactive. The French privacy regulator issued a 50 million euro fine for Google on the grounds where the law in Europe said you need consent to deliver personalised ads, and the way Google had gone about trying to gain that consent was not considered valid under European privacy law, Johnston said.

“Coming out of Europe, eventually we should see a new ePrivacy regulation, specifically regulating cookies and email marketing and related topics to provide better uniformity across the EU,” she predicted.

In closing, Johnston said the breadth of what is covered by the definition of personal information can surprise people. “It's not just about protecting private data. And privacy is not just about protecting secrets. It's about how organisations handle all the data they have that is not secret,” she concluded.

“Privacy is not just about data security, it's not just about preventing disclosure. It is also about how personal information can and can't be collected and used in a way that does no harm to individuals. And above all else, privacy law is about fairness, accuracy and transparency.”

“The key trends, both locally and globally, include applying a consumer protection lens or top of privacy law and asking how the law might need to expand to cover all forms of privacy.”

Follow CMO on Twitter: @CMOAustralia, take part in the CMO conversation on LinkedIn: CMO ANZ, follow our regular updates via CMO Australia's Linkedin company page, or join us on Facebook: https://www.facebook.com/CMOAustralia.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Show Comments

Latest Videos

Conversations over a cuppa with CMO: The Star's George Hughes

It's been an incredibly tough three months for the Star as it shut its doors and stood down staff in response to the COVID-19 lockdown. Yet innovation has shone through, and if the CMO, George Hughes, has anything to say about it, such lateral thinking will continue as we start to recover from the crisis.

More Videos

I am 56 years old and was diagnosed with Parkinson's disease after four years of decreasing mobility to the point of having family dress ...

Nancy Tunick

The personal digital approach that's helping Vision RT ride out the crisis

Read more

I am 57 and diagnosed in June 2009. I had a very long list of symptoms, some of which were. Keeping right arm close to my side while walk...

Nancy Tunick

Gartner survey: CMO spending hit by COVID-19

Read more

Audible did such a great job on their marketing and at the same time, there are no false promises. The support, quality, variety all good...

Vitaliy Lano

Audible's brand plan to build the value of audiobooks

Read more

I am 56 years old and was diagnosed with Parkinson's disease after four years of decreasing mobility to the point of having family dress ...

Nancy Tunick

Parkinson's NSW creates a lorem ipsum generator and goes digital to mark Parkinson's Awareness month

Read more

We would like to invite you to the Virtual Exhibition about IoT Trends in 2020, 7 - 9 July, organised by Must.We developed a new B2B matc...

hayfa

Want to master digital transformation? Stop thinking about your own problems

Read more

Blog Posts

Business quiet? Now is the time to review your owned assets

For businesses and advertiser categories currently experiencing a slowdown in consumer activity, now is the optimal time to get started on projects that have been of high importance, but low urgency.

Olia Krivtchoun

CX discipline leader, Spark Foundry

Bottoms up: Lockdown lessons for an inverted marketing world

The effects of the coronavirus slammed the brakes on retail sales in pubs, clubs and restaurants. Fever-Tree’s Australia GM Andy Gaunt explains what they have learnt from some tricky months of trading

Andy Gaunt

General manager, Fever-Tree Australia and New Zealand

Younger demos thought lost are now found: But what about the missing money?

There is much talk about what VOZ will bring to the media industry. New ways to slice and dice audiences and segments. A clearer understanding of screen consumption. Even new ways to plan and buy. The most interesting result could be finding something many thought we lost - younger viewers, specifically the valuable 18-39s.

Michael Stanford

Head of 10 Imagine and national creative director, Network 10

Sign in