Australians who routinely click “accept” on privacy terms could gain stronger protections over how businesses collect and use their personal information under a proposed overhaul of federal privacy laws.
The Albanese government’s second tranche of Privacy Act reforms would introduce a new “fair and reasonable” test governing how organisations collect, use and disclose personal information.
The changes could prevent businesses from relying on lengthy terms and conditions to justify collecting more customer information than necessary or using it in ways consumers would not reasonably expect.
In practice, that could affect common situations such as signing up to a loyalty program, downloading an app or creating an online account that asks for more personal information than is reasonably needed to provide the service.
“Businesses cannot rely on a customer clicking ‘accept’ to justify information handling that is not fair and reasonable,” a spokesperson for Attorney-General Michelle Rowland said.
The proposed reforms would affect entities covered by the Privacy Act, including Australian government agencies and organisations with annual turnover of more than $3m, subject to existing exceptions.
The new test would replace some existing rules governing the collection, use and disclosure of information with a broader assessment of whether an organisation’s handling of personal information was fair and reasonable.
LegalVision practice leader Phoebe Chester said the changes could force businesses collecting large amounts of customer information to reconsider their practices.
“This is significant because broad consent would no longer be enough,” Ms Chester said.
“A business may not be able to justify excessive data collection simply because a customer clicked ‘accept’.”
The reforms would also tighten consent requirements and impose a 72-hour deadline for notifying the Australian Information Commissioner once an organisation had reasonable grounds to believe an eligible data breach had occurred.
But Electronic Frontiers Australia chair John Pane warned the proposed overhaul did not go far enough.
“It’s a start, but it’s not good enough. We need to do more,” Mr Pane said.
He criticised the retention of exemptions covering employee records, small businesses and political parties, arguing they should be abolished.
Former Australian Privacy Foundation chair David Vaile warned the proposed test risked repeating decades of weak enforcement under Australia’s existing privacy laws.
He also raised concerns about the small business exemption, warning it could create a loophole allowing personal information to be handled through smaller operators outside the law’s general protections.
Mr Pane also criticised the proposed right to erasure, which would allow Australians to request the destruction of personal information held by large digital platforms meeting specified thresholds.
“By limiting the right to erasure exclusively to ‘large digital platforms’, the Bill fails to provide Australians with a universal right to delete their data,” he said.
Under the proposal, the right would apply to large digital platforms with annual gross revenue of $500m or more, or 2.5 million or more average monthly end users in Australia over a year.
Any individual could exercise the proposed right, although exceptions would apply, including where destroying information was technically impossible or infeasible.
The existing journalism exemption would remain unchanged, meaning the proposed erasure right would not apply to media organisations covered by it.
The reforms were released for consultation in August, with submissions closing in September.
Ms Rowland said in August she hoped to introduce the bill this year and have it passed “sooner than a year”.
Her office said the government was considering consultation feedback to ensure the final reforms were workable and in Australians’ interests.