PRIVATE MEMBERS' BUSINESS

Ms CLUTTERHAM (Sturt) (17:47): I'm pleased to rise to speak in support of this motion, which addresses the significant reforms being proposed to Australia's privacy framework recently published as the second tranche of reforms. The reforms proposed are significant, but they need to be. They need to be decisive and seek to fairly and comprehensively address the immeasurable complexities that we are now faced with as we live and work firmly in the digital age, an age that is constantly changing, constantly evolving and constantly moving the goalposts with respect to how we manage risk.

In my prepolitics career as a lawyer, I held the role of privacy officer at one of the organisations I worked for. This involved becoming very familiar with the Australian Privacy Principles and advising different business units on their obligations and compliance strategies. This was at a defence organisation, and I can tell you that balancing personal privacy obligations with national security obligations left me needing a lie down with a cold face washer over my forehead some days after work.

This was during the digital age, but it was before the onslaught of the digital era and before the genie started to emerge from the bottle with respect to AI. There are two aspects of the reform that I think are worth focusing on and which were of great interest to me. The first is the right to erasure.

The new reforms will introduce a right to erasure for individuals whose personal information is held by a large digital platform, which are providers of social media, relevant electronic or designated internet services that meet one or both of the following thresholds: gross revenue of at least $500 million for the business, including overseas entities, and/or at least 2.5 million average monthly end users in Australia.

Large digital platforms must, if requested, destroy the personal information, give written notice of the outcome within a reasonable period and explain any exemption relied on, noting that there are exceptions and that they are, in my view, reasonable as they include permitted general or health situations or legal retention requirements. Large digital platforms will need to be on notice of this because of the other highly relevant change, which is a definition change in respect of personal information from information 'about' an individual to information that 'relates to' an identified or 'reasonably identifiable' individual.

Australians should take note too. This represents a significantly broader protection for you and your interactions with a large digital platform. Is it going to be easy to implement for these platforms?

Maybe not. But is it a path we must pursue because of the protections offered to Australians? Yes, it is.

The second change proposed by these reforms that piqued my interest is the introduction of the fair and reasonable test with respect to the collection, use and disclosure of personal and sensitive information, which was previously subject to three different tests. The new, proposed test is whether the collection, use and disclosure of personal or sensitive information is fair and reasonable in the circumstances and lawful.

This is significant because, currently, companies and organisations, including the one that I used to work for, would rely on privacy policies and procedures, together with consent and collection notices, as the main compliance tool in their toolkit. Consent was sometimes offered on a 'take it or leave it' basis, as in 'give consent or you, as the employee, won't be able to do something or access something'.

In that sense, it was a limitation on an employee's role unless they gave consent, which could be unnerving, particularly with respect to sensitive information. Companies can still go down this path, but the proposed reforms present an extra protection, because, even if an employee gives consent, the collection, use or disclosure will need to also be fair and reasonable in the circumstances.

For most companies most of the time, this won't be an issue. Things companies are currently doing in the collection, use and disclosure space will already be fair and reasonable in the circumstances and most likely completely lawful. But, if they are not, a company will now have to reconsider their position and, in doing so, that previous limitation I spoke about for the employee will fall away.

This is a fair and reasonable test condensing three different tests into one and providing extra protections for employees of organisations. Guidance will be provided as to what qualifies as fair and reasonable, with an emphasis on data minimisation, choice and proportionality. These are significant reforms, and I commend the government and the Attorney-General for taking this on, given its substantial impact on the Australian people.