PRIVATE MEMBERS' BUSINESS
Ms CHANEY (Curtin) (17:42): I thank the member for Deakin for bringing this motion to the House. Privacy law reform is overdue. The Privacy Act review reported to the government back in 2023, and the first tranche of reforms passed in 2024.
Since then, Australians have been waiting for the second tranche, the part that actually deals with how organisations collect, use and disclose personal information. In the meantime, emerging technologies like AI are consuming data at an ever-increasing rate. Three years between identifying the problem and legislating a serious fix is too slow for an issue that's moving this quickly.
The Attorney-General has finally released the exposure draft of that second tranche for consultation, and submissions close on 18 September. This is a meaningful step forward. There's a right to erasure from large platforms, stronger and more meaningful consent standards, new limits on trading personal information without permission and a mandate to make the privacy regulator more efficient.
Each of these deserve scrutiny in their own right, but I want to use this time today to focus on two issues: the importance of the 'fair and reasonable' test and the continuing exemption of political parties from privacy laws. On the 'fair and reasonable' test, here's the problem that we're trying to solve: Australia's Privacy Act was built for a world of discreet data collection—a form filled out here, a subscription signed up to there.
It wasn't built for a world where AI systems ingest billions of data points to train models and where consent is buried in terms and conditions that nobody reads. Under the current law, if a company gets your consent, it can generally use personal data however it wishes. Consent buried deep in 40 pages of terms and conditions means a company can sell your data or use it however it wants.
That is not meaningful consent. Most Australians have no idea how their data are being used and no practical way to stop it. Earlier this year, my office ran a community survey across Curtin, asking residents about their views on AI.
Privacy came through as one of the issues people are most worried about. The fair and reasonable test adds a second requirement on top of consent to ensure the use of personal data must also be objectively fair and reasonable. In practice, this would stop an AI company from training a model on someone's health records, financial information or private communications based on a permission buried on page 40 of a terms of service document.
Getting the drafting right is only half the job. A fair and reasonable test is only as strong as the regulator enforcing it, and the Office of the Australian Information Commissioner has been underresourced for years. If we pass a stronger standard, we also need adequate funding for enforcement at the same time.
The second issue I want to raise is the ongoing exemption of political parties from privacy laws. I've previously drawn attention to the deceptive practice of political parties using the postal voting process to harvest personal information. In my electorate of Curtin and across the country, before the last election the Liberal Party sent out what looked like an AEC form to apply for a postal vote with an envelope enclosed addressed to the processing centre, which makes it sound like it's going to the AEC.
This actually goes to a Liberal Party controlled PO box where the Liberal Party presumably records all the data—name, address, phone number, email address, secret question and answer—and then forwards the forms on to the AEC. We have no idea how they use that data. It would almost certainly be added to the Liberal mailing lists, but it may also be sold, and that would all be within the current rules.
Both parties do this, and the AEC hates it. The AEC is one of our most trusted institutions, and postal voting is increasingly common. Political parties should not be able to insert themselves into this process and benefit from data harvesting.
They can currently do this because they've exempted themselves from privacy laws. When it comes to privacy, the same rules should apply to political parties as any other organisation, but getting them to agree to this will take a lot of public pressure. In short, I'm pleased to see the fair and reasonable test and other overdue improvements to our privacy laws.
The OAIC will need greater resources to actually enforce them, and there's further work to do when it comes to actually requiring political parties to protect personal data.