WEBVTT
00:00:53.829 --> 00:00:58.390
You're listening to the award-winning Serious Privacy Podcast sponsored by TrustArc.
00:00:58.390 --> 00:01:02.950
Please welcome your hosts, Paul Breitbart, Ralph O'Brien, and Dr.
00:01:02.950 --> 00:01:04.230
K Royal.
00:01:06.310 --> 00:01:08.310
Today's episode is long overdue.
00:01:08.310 --> 00:01:18.310
You know that in this podcast we like to discuss what is happening in the privacy and data protection community around the globe, but if we are honest, the main focus tends to be on Europe and the United States.
00:01:18.310 --> 00:01:21.109
No wonder with the co-host from those regions.
00:01:21.109 --> 00:01:25.349
Today, however, we turn our lens in another direction and we go down under.
00:01:25.349 --> 00:01:32.789
Our guest today is none other than the Privacy Commissioner of Australia, Carly Kind, a role she has fulfilled for the past two and a half years.
00:01:32.789 --> 00:01:43.909
And before becoming Commissioner, Carly was the director of the UK-based Ada Laughless Institute, an independent research institute with a mission to ensure data and AI work for people and society.
00:01:43.909 --> 00:01:51.109
Before that, she had an extensive career as a digital and fundamental rights lawyer, mainly at international organizations and NGOs.
00:01:51.109 --> 00:01:53.030
My name is Paul Breitbart.
00:01:53.510 --> 00:01:55.030
And my name is Ralph O'Brien.
00:01:55.030 --> 00:01:59.430
And I get to say it today, welcome to Serious Privacy.
00:01:59.430 --> 00:02:06.870
First of all, thank you so much for joining us, Commissioner Carly Kind, which I've got to say is almost a superhero name.
00:02:07.189 --> 00:02:11.349
Yes, I do try and get my children and family members to call me Commissioner when I can.
00:02:11.509 --> 00:02:15.750
It does sound more formal, but it's also a very nice alliteration, right?
00:02:15.750 --> 00:02:18.949
Yeah, it's Peter Parker, Scott Summers.
00:02:18.949 --> 00:02:21.349
I very much, I very much appreciate it.
00:02:21.349 --> 00:02:21.750
Yeah.
00:02:21.750 --> 00:02:24.550
And we always start with an unexpected question.
00:02:24.550 --> 00:02:26.949
We say, are we ready for the unexpected question?
00:02:26.949 --> 00:02:28.629
But that's a really unfair thing to say.
00:02:28.629 --> 00:02:30.230
So I'll just jump in today.
00:02:30.230 --> 00:02:37.269
And my unexpected question today, because K isn't here, is what's your hot beverage of choice?
00:02:37.750 --> 00:02:49.750
My hot beverage of choice is a large, long, black and taken dark black, usually, no milk added, because I have three little kids who still refuse to sleep through the night.
00:02:49.750 --> 00:02:54.629
So I wake up extremely tired and in need of caffeination every morning.
00:02:55.110 --> 00:02:55.909
Fair enough.
00:02:55.909 --> 00:02:57.590
I remember those days well.
00:02:57.590 --> 00:03:05.830
Paul, mine would be a double espresso, especially this time of day, because we are not recording at our regular hour because of the time difference with Australia.
00:03:05.830 --> 00:03:10.469
Some double espresso are indeed needed to get up and running for the podcast.
00:03:10.789 --> 00:03:17.990
Yeah, perhaps one of the reasons why we do sometimes end up being a little bit Europe and uh US focused is mainly for the time difference.
00:03:18.390 --> 00:03:20.710
Ralph, what is your beverage of choice?
00:03:21.830 --> 00:03:25.349
Like most English people, I'm currently enjoying a cup of tea in the morning.
00:03:25.349 --> 00:03:26.629
Black or white?
00:03:26.629 --> 00:03:28.710
White, white.
00:03:28.710 --> 00:03:33.189
We have this expression in the military we call NATO standard, which is white with sugar, right?
00:03:33.189 --> 00:03:34.469
Disgusting.
00:03:34.469 --> 00:03:38.710
But I have swapped sugar for honey, because it's more uh more healthy.
00:03:38.710 --> 00:03:45.509
And in the evenings, I then tend to s to go to a red bush and at the weekend a chai latte.
00:03:45.509 --> 00:03:49.189
How's that for a full and comprehensive response?
00:03:49.189 --> 00:03:50.710
Very fancy.
00:03:50.710 --> 00:03:52.069
Commissioner Kind.
00:03:52.069 --> 00:04:08.469
We normally start by just giving, I know Paul gave a little bit of background shoe in the introduction, but we normally start by asking our guests to just give a short little biography of how you got here, how you got into this wonderful world that we like to call data protection and privacy.
00:04:08.870 --> 00:04:09.669
Yeah, absolutely.
00:04:09.669 --> 00:04:10.390
Thank you.
00:04:10.390 --> 00:04:24.230
I started out as a lawyer here in Australia, really interested in human rights law, and myself casting abroad out of frustration at the few opportunities there were to work in human rights law at the time in the early 2000s.
00:04:24.230 --> 00:04:37.029
Now Australia has a few more human rights legislative instruments, but at the time had none, including being the only Western democracy without uh human rights in the constitution or a bill of rights or a human rights act.
00:04:37.029 --> 00:04:37.669
Yes.
00:04:37.669 --> 00:04:43.590
I I moved to Europe and worked first in Geneva with the United Nations.
00:04:43.590 --> 00:04:50.870
I spent some time interning in London at the International Vir Association and started to build a career in human rights law.
00:04:50.870 --> 00:05:23.509
And then in 2012, I was excited to find an opportunity to segue into technology and human rights law by virtue of an opportunity to take up a role as head of international advocacy at Privacy International, which is a London-based NGO and campaign group, and really was very lucky to get that role at a time in which the organization was growing only from three to four people and was able to be part of that growth that PI went through over the next period of time, including as the issue of privacy really started to raise up the public agenda.
00:05:23.509 --> 00:05:38.149
So I cut my teeth in privacy law first as a campaigner advocate, later doing strategic litigation at Privacy International, and then went on to work really in an advisory space, both in terms of data protection, advisory for international organizations.
00:05:38.149 --> 00:06:01.269
So I spent some time, for example, advising UNHCR in West Africa on their data protection frameworks, but also in terms of technology policy, working with NGOs and other organizations, thinking through some of these tricky issues that arise at the issue of at the intersection of technology and human rights, like misinformation, censorship, surveillance and other privacy interferences.
00:06:01.269 --> 00:06:22.309
And then was really fortunate to get the opportunity to be the founding director of the Ada Lovelace Institute, which was being set up in 2019, to be, I think, what now looks like a very early thought leader on issues of AI and society and how to ensure that AI and its design and deployment serves humanity and not the other way around.
00:06:22.309 --> 00:06:24.470
And that occupied me for five years.
00:06:24.470 --> 00:06:30.389
And obviously that job wasn't quite done when I left it and still continues to really occupy my thoughts a lot.
00:06:30.389 --> 00:06:38.070
But I had the opportunity to take up this role as privacy commissioner, both an exciting personal and professional opportunity.
00:06:38.070 --> 00:06:41.110
I hadn't been back in Australia for 16 years.
00:06:41.110 --> 00:06:53.429
So I used the opportunity to move my family here for some time and get my young boys who all had Australian citizenship had but had never lived here, to experience life in Dan Undacks.
00:06:53.429 --> 00:07:09.750
But also I had been really for the five years that I was at the Ada Lovelace Institute, and even before, often regulation was posited as the answer to many of the rights, issues, and harms and vulnerabilities that we were identifying, including in the context of AI.
00:07:09.750 --> 00:07:22.710
And I was very intrigued to understand what is it to be on the other side of regulation and how do you make regulation work in a way that advocates such as myself had been anticipating or hoping that regulation would be effective in practice.
00:07:22.710 --> 00:07:34.309
So it was really about being on the other side of that and understanding how do you regulate in practice in a way that actually meets community expectations and really means something for people.
00:07:34.309 --> 00:07:38.789
And so that has been the wonderful experience I've been lucky to have since I took up this role.
00:07:39.350 --> 00:07:41.269
How difficult is that reality?
00:07:41.669 --> 00:07:48.470
A lot more difficult than I think I quite realized, or at least maybe difficult isn't the right word, but much more complex.
00:07:48.470 --> 00:08:16.389
I think the the architecture of regulation, the intersection of the laws that are on the books with the evidentiary and investigative challenges that exist to establish compliance or non-compliance, then cast against the people, the skills and capabilities you have in your hands and the constraints thereon, as well as the politics, which are also relevant to the work that we do, even as independent regulators.
00:08:16.389 --> 00:08:19.429
That is a really complex jigsaw puzzle.
00:08:19.429 --> 00:09:22.110
And it's not as straightforward as I perhaps naively thought from the outside, as saying if something's a law on the books, then it will certainly act as contributing that will be held accountable, they'll be held accountable in timely and effective ways.
00:09:22.110 --> 00:09:52.349
There's a lot that goes into thinking about how to regulate and when, how to use the resources you have with respect to which entities, with respect to which violation, and also how to have the outsized effect that you need to really have as a small regulator in the context of a global market, immense entities who have priced the cost of litigation into the cost of doing business, and really try to think about how to most effectively achieve your regulatory objectives using all the tools in your toolbox.
00:09:52.349 --> 00:09:55.469
So it's been a really hugely eye-opening experience.
00:09:55.469 --> 00:09:58.349
And I'm learning on the job every day, I would say.
00:09:58.829 --> 00:10:04.029
We often hear commissioners say using all the tools in their toolbox.
00:10:04.029 --> 00:10:06.829
It's something we often hear from the regulators.
00:10:06.829 --> 00:10:25.149
But for those people who might not be familiar with the sort of Australian law and the Australian Privacy Framework, Privacy Act 88, the 13 apps, perhaps quickly you could tell us what tools you have available because the Australian law is very interesting, almost co-regulatory law.
00:10:25.149 --> 00:10:29.309
Which is very different from some of the laws we see elsewhere.
00:10:29.309 --> 00:10:31.309
And of course, and there's the federal nature as well.
00:10:31.309 --> 00:10:40.349
Some of our previous podcasts hope, people like Nalise and Alexandra have come down to Australia as sort of territory commissioners as well.
00:10:40.349 --> 00:10:42.189
So how does it all pull together?
00:10:42.589 --> 00:10:43.629
Yeah, absolutely.
00:10:43.629 --> 00:10:45.709
It is a complex regulatory landscape.
00:10:45.709 --> 00:10:50.269
I'd at a high level, the following things are true about the Australian system.
00:10:50.269 --> 00:11:01.789
It's heavily, it's obviously a common law system, and the contents of the act are very germane to common law systems in the sense that they're highly principles-based.
00:11:01.789 --> 00:11:23.069
They utilize a lot of concepts that are common in the common law, such as reasonableness, fairness, necessity, both kinds of concepts, which are really effective in making sure that the legislation is highly technology neutral and potentially quite flexible and applicable to different contexts, the downside of which is that it is remains quite high level.
00:11:23.069 --> 00:11:31.149
So, in terms of providing certainty to entities in terms of what compliance looks like, it's not necessarily clear on the face of the act itself.
00:11:31.149 --> 00:11:35.789
It requires a lot in the way of guidance and application into particular circumstances.
00:11:35.789 --> 00:11:40.749
There is also a long-running reform effort to update the act in various ways.
00:11:40.749 --> 00:11:43.869
But it is, it is, it is very different from the GDPR.
00:11:43.869 --> 00:11:49.389
And I I really came up with the GDPR as my first kind of data protection framework that I was familiar with.
00:11:49.389 --> 00:11:55.709
So it has required a shift in thinking and it's less, obviously less codified than the European approach.
00:11:55.709 --> 00:12:09.949
I think at first glance, I thought it was a lesser framework, but I've come to really appreciate its positives and advantages in terms of what it leaves open, particularly in countering the worst risks that arise in new technologies.
00:12:09.949 --> 00:12:14.589
But as you say, in addition to the main act, there's a range of other pieces of legislation.
00:12:14.589 --> 00:12:17.789
I think 39 other pieces of legislation that intersect with the Act.
00:12:17.789 --> 00:12:29.949
There are bespoke privacy regimes under certain legislative schemes in the fields of health, for example, taxation information, social media, which I know we're going to come to, digital identity and data portability.
00:12:29.949 --> 00:12:32.509
So there's separate legislative schemes there.
00:12:32.509 --> 00:12:44.669
Then in terms of jurisdiction, we have the entire private sector is within the remit of the federal act, albeit only those entities with an annual turnover of more than 3 million Australian dollars.
00:12:44.669 --> 00:12:47.709
So we don't capture small, small enterprises.
00:12:47.709 --> 00:12:51.389
We do have an extraterrestrial application of the Act.
00:12:51.389 --> 00:12:57.149
So there's a connection with Australia is required, but not domicile in Australia or anything like that.
00:12:57.149 --> 00:13:01.629
So we do have, for example, big tech companies within our jurisdiction.
00:13:01.629 --> 00:13:06.909
And then in terms of government actors, that's where the state territory commonwealth difference applies.
00:13:06.909 --> 00:13:09.869
So we only regulate federal government agencies.
00:13:09.869 --> 00:13:21.069
So that would include, for example, the Australian Federal Police or Home Affairs for Immigration, whereas the state and territory regulators regulate state and territory government agencies.
00:13:21.069 --> 00:13:27.949
And in Australia, those departments provide many of the main essential government services, such as health and education.
00:13:27.949 --> 00:13:30.269
So that that is the distinction.
00:13:30.269 --> 00:13:32.029
It is a complicated landscape.
00:13:32.029 --> 00:13:35.629
And we work pretty closely with our state and territory peers.
00:13:35.629 --> 00:13:40.829
Each of their separate pieces of legislation are, of course, different from each other and from the Federal Act as well.
00:13:40.829 --> 00:13:48.189
So it's a privacy professional's dream because there's endless advice to be provided to meets the requirement.
00:13:48.189 --> 00:13:52.989
But yes, from a compliance perspective, it is a relatively muddled picture at times.
00:13:52.989 --> 00:13:56.989
And the government's constantly looking for ways to streamline and simplify.
00:14:08.029 --> 00:14:11.789
Kidding aside, there is also a lot of talk about legislative change.
00:14:11.789 --> 00:14:13.709
You've recently had a new law.
00:14:13.709 --> 00:14:20.589
Well, recently in 2024, I believe, a new legislative change come into effect, but there is talk about doing more.
00:14:20.589 --> 00:14:38.109
Is that to align Australia's legislation more to the trends that we see around the world, or is this really something that is required natively because of things that are happening in Australia or where you as office see that things are not good enough right now?
00:14:38.429 --> 00:14:39.869
Yeah, it's a great question, Paul.
00:14:39.869 --> 00:14:49.149
And it's a very kind of storied history to Privacy Act reform, which was first initiated by the Australian Law Reform Commission in 2012, I believe.
00:14:49.149 --> 00:14:55.949
So we're going on almost 15 years since the concept of reforming the Privacy Act was first contemplated.
00:14:55.949 --> 00:15:03.789
And the government conducted a reform of a review of the Privacy Act in 2022, and that reported in 2023.
00:15:03.789 --> 00:15:07.869
So again, almost three years since that more comprehensive review was done.
00:15:07.869 --> 00:15:14.429
The inciting motivations behind, for example, that 2022 review, I think were twofold.
00:15:14.429 --> 00:15:26.349
One was around updating the act in light of the digital era, acknowledging that many of the technologies that now pose the largest privacy risks were not in contemplation at the time of the act's adoption in 1988.
00:15:26.349 --> 00:15:34.189
But I think a branch of the motivation also related to harmonization with other legal frameworks.
00:15:34.189 --> 00:15:39.149
And of course, at that time, GDPR was certainly one of those reference points.
00:15:39.149 --> 00:15:43.789
I think there's that Australia doesn't have an adequacy arrangement with the European Union.
00:15:43.789 --> 00:15:46.349
So that was no doubt a relevant factor.
00:15:46.349 --> 00:15:51.869
But also just being seen to keep up with the changes in kind of state-of-the-art privacy regulation.
00:15:51.869 --> 00:16:08.749
In time, in the recent years, I think there has been recognition of other objectives that can be achieved through Privacy Act reform and perhaps acknowledgement of the virtues of the Australian system that might allow it to take complementary but different approaches to the European approach.
00:16:08.749 --> 00:16:22.669
For example, really the flagship reform that is now under consideration and we expect will be taken forward by the government in the next couple of months is the introduction of a fair and reasonable test to all data processing.
00:16:22.669 --> 00:16:54.829
And the proposal is to essentially try to address the ineffective nature of current privacy consent processes and terms and condition processes, which put a lot of responsibility on individuals' shoulders and absolve entities themselves of having to do any of the hard work to think through costs and benefits and potential risks and harms to data subjects, but rather just allow individuals to consent away or click away some of the protections that they should otherwise deserve.
00:16:54.829 --> 00:17:06.109
And so the fair and reasonable test will say, in all the circumstances, in addition to being law, lawful, sorry, collection data collection use and disclosure will have to be fair and reasonable in the circumstances.
00:17:06.109 --> 00:17:21.390
And what is fair and reasonable will have a range of characteristics associated with it, including the whether the benefits to the individual are outweighed by any of the risks and harms, where the best interests of the child play in, what the individual's reasonable expectations were, et cetera.
00:17:21.390 --> 00:17:27.789
So I think that's actually, in a way, it's quite a novel way of starting to think about how to strengthen privacy law.
00:17:27.789 --> 00:17:48.990
And it, I think, what corresponds well with what we're seeing in data protection and privacy discourses, which is increasing appreciation of the intersection between privacy and data protection rights and consumer issues around fairness, around cost, cost of living, access to services, exploitation, predatory services online.
00:17:48.990 --> 00:17:57.950
I think lots of these are really starting to at least hit the Australian economy in ways that is really problematic and particularly targeting vulnerable communities.
00:17:57.950 --> 00:18:18.190
And I think by putting fairness right at the heart of privacy regulation, the government hopes, and I think it's the right aspiration to really be about creating a fairer playing field for consumers whose data is being treated like a commodity and who aren't necessarily getting the kind of dividends from that value exchange.
00:18:18.190 --> 00:18:20.910
It's in a way it's quite a radical change.
00:18:20.910 --> 00:18:32.829
And then I will stop in a second, appreciate I'm rattling on, but the some of the other changes are more technical or are more in line with that aspiration of aligning with, for example, the GDPR.
00:18:32.829 --> 00:18:42.029
So, for example, the definition of personal information under Australian law still uses a term which is about an individual rather than relates to the individual.
00:18:42.029 --> 00:18:45.149
So that will be changed to align with GDPR, for example.
00:18:45.629 --> 00:18:54.750
I really like the fairness part because fairness is, of course, also a principle in Article 5 of the GDPR of the UK Data Protection Act as well.
00:18:54.750 --> 00:19:04.269
But it's only very recently that it seems that data protection authorities really start to care about the fairness part of data processing.
00:19:04.269 --> 00:19:19.309
So to put it front and center in a legislative reform also really makes it clear to organizations operating in Australia that this is something that they should take into account and that not everything is just about the letter of the law.
00:19:19.309 --> 00:19:32.829
Ralph, you've been saying this on the podcast before, if you do assessment is not just about ticking the boxes and making sure that you address everything that is in the legislation, but also continuously asking the question, who are we doing this for?
00:19:32.829 --> 00:19:36.349
Is it what is the interest of the individual here?
00:19:36.750 --> 00:19:41.470
Recital one, personal data should be used to serve humankind, right?
00:19:41.470 --> 00:19:41.950
Yeah.
00:19:41.950 --> 00:19:49.950
We actually had a court case and I mentioned it on the podcast last week, which is one of the first court cases we've ever seen to actually actually use fairness.
00:19:49.950 --> 00:19:55.629
It's principle one in the GDPR and the UK GDPR, and fair, lawful, and transparent.
00:19:55.629 --> 00:19:58.109
But we often don't see fairness talked about enough.
00:19:58.109 --> 00:20:00.589
Lawful and transparent, sure, but not fairness.
00:20:00.589 --> 00:20:06.909
And actually I didn't even realise, so I've learned something today that was missing from the apps, the Australian privacy principles.
00:20:07.549 --> 00:20:12.109
Fairness is there, but the means of collection have to be fair currently.
00:20:12.109 --> 00:20:13.629
So it's quite a kind of narrow.
00:20:13.629 --> 00:20:14.109
Yeah.
00:20:14.109 --> 00:20:19.549
Whereas this is very much going to put it right at the centre of collection and handling altogether.
00:20:20.029 --> 00:20:33.309
So when you spoke about the legislative regime in Australia, for want of a better word, do you have any specific provisions also for the native people of Australia in your legislation?
00:20:33.309 --> 00:20:36.269
Do they have their own privacy approach maybe?
00:20:36.269 --> 00:20:43.069
We've spoken to people about Indigenous privacy before and know that Australia has a large Indigenous community.
00:20:43.069 --> 00:20:44.750
What's the approach there?
00:20:45.149 --> 00:21:02.189
Yeah, so we don't have specific provisions around Indigenous data, but Indigenous data sovereignty is a very important concept that is and kind of policy and initiative that is well embedded in a range of Australian government departments and initiatives, and certainly something that we have reference to.
00:21:02.189 --> 00:21:07.789
We have a range of different ways in which we seek to serve Indigenous communities specifically.
00:21:07.789 --> 00:21:13.549
So, for example, we're currently in the process of ensuring our guidance is available in some Indigenous languages.
00:21:13.549 --> 00:21:29.230
We're also quite engaged in some of the work that's still being done in Australia about access to records pertaining to the stolen generation of Indigenous individuals in the 50s and 60s and probably as late as the 70s.
00:21:29.230 --> 00:21:41.869
One of the issues that continues to arise is that privacy protections are sometimes held out as ways of preventing Indigenous people from getting access to the information about their families and their heritage, et cetera.
00:21:41.869 --> 00:21:52.990
So it's there's kind of a kind of complex web of ways in which Indigenous data sovereignty and Indigenous data rights need to be given attention and really taken forward in Australia.
00:21:52.990 --> 00:22:04.029
And it's not necessarily through any particular legislative instrument, but rather through various initiatives that are scattered across government departments and within which our own agency participates.
00:22:04.589 --> 00:22:08.429
You mentioned the fact that the regime is somewhat complex.
00:22:08.429 --> 00:22:32.829
As it goes forward, you mentioned that the fairness change, you mentioned things like the penalty increase, you've mentioned things like looking at it in various tranches to add various sort of rights and freedoms as you've gone forwards.
00:22:32.829 --> 00:22:48.750
So then how is it regulated to you keep organizations up to date, keep organizations in a place where they can understand the changes and also individuals understanding their the their rights and freedoms?
00:22:48.750 --> 00:22:55.629
If you're if you've got this law that's constantly evolving, constantly changing, does there be any of you to looking at it wholesale?
00:22:55.629 --> 00:23:00.589
Get rid of the 88 Act and just bring something new in to consolidate everything?
00:23:00.589 --> 00:23:06.909
Or are we just going to see these more incremental changes and you updating organizations as as you go forwards?
00:23:07.230 --> 00:23:14.429
Yeah, I think the the historical preference in Australian legislative history is this kind of updating, tinkering approach.
00:23:14.429 --> 00:23:17.789
And I'm not sure the Privacy Act gets a pass from that.
00:23:17.789 --> 00:23:22.669
So to my knowledge, there hasn't been any suggestion of a wholesale change.
00:23:22.669 --> 00:23:30.750
And that's maybe that's an interesting cultural or legal tradition issue that is different from European approaches, for example.
00:23:30.750 --> 00:23:36.189
Yeah, it's it is a challenge to say the act has in the last five years, for example, the act has been amended.
00:23:36.189 --> 00:23:51.470
Amended at least twice, once in 2024 to introduce new enforcement penalties, to introduce a mandate for us to develop a children's online privacy code, to introduce new obligations around disclosure of automated decision-making systems in privacy policies.
00:23:51.470 --> 00:23:54.990
And then prior to that, in 2022, to increase penalties.
00:23:54.990 --> 00:24:00.349
And then there are a range of, as I said, bespoke privacy schemes that have been specifically legislated.
00:24:00.349 --> 00:24:09.149
So the social media minimum age scheme, which you'll know as the social media ban, that legislative scheme, which is contained in the Online Safety Act, has it.
00:24:09.149 --> 00:24:09.710
Yeah.
00:24:09.710 --> 00:24:16.349
So look what the way we do it in practice is a set we try to use a kind of range of communications tools.
00:24:16.349 --> 00:24:20.750
Sometimes we'll use a block to explain a small change to the legislation.
00:24:20.750 --> 00:24:22.909
Sometimes we'll do bespoke guidance.
00:24:22.909 --> 00:24:27.950
So we did guidance, for example, on age assurance technologies, guidance on the social media ban.
00:24:27.950 --> 00:24:30.509
And we try to do things like webinars.
00:24:30.509 --> 00:24:32.109
We try to provide fact sheets.
00:24:32.109 --> 00:24:36.829
And where we can, we try to provide templates for collection notices or privacy policies, et cetera.
00:24:36.829 --> 00:24:47.710
So this year, for example, changes to the money laundering counterrorist financing law came into Australia to bring a range of small and median enterprises within the scope of the Privacy Act.
00:24:47.710 --> 00:24:52.189
Our jurisdiction expanded by 120,000 organizations overnight.
00:24:52.189 --> 00:24:57.789
And those organizations had particular needs because they had never had to comply with privacy law before.
00:24:57.789 --> 00:25:02.269
So we needed really easy, off-the-shelf ways to help them get to compliance.
00:25:02.269 --> 00:25:12.269
But at the end of the day, we are a small agency where fewer than 200 people, and we need to use our resources in the most efficient and effective way possible.
00:25:12.269 --> 00:25:22.509
So we do we basically take a risk-based approach to what needs guidance, what needs spelling out, what can be dealt with on an ad hoc basis or in blogs and other forms of guidance material.
00:25:22.990 --> 00:25:30.509
Those extra people, as I understand it, real estate professionals, lawyers, accountants, conveyancers, precious metals, stone.
00:25:30.509 --> 00:25:32.990
Very big in Australia, obviously.
00:25:32.990 --> 00:25:33.789
Yeah.
00:25:33.789 --> 00:25:37.549
And then you've got a core around C money and uh AML, CTF.
00:25:38.909 --> 00:25:39.309
That's right.
00:25:39.309 --> 00:25:39.950
Exactly.
00:25:39.950 --> 00:25:46.990
So they now have Privacy Act obligations only insofar as it pertains to their compliance with AML-CTF regulation.
00:25:46.990 --> 00:25:52.829
But it's quite an important area of privacy regulation, as you'll know, because it traditionally involves the acquisition of identity documents.
00:25:52.829 --> 00:26:06.829
And what we see in particularly in our administration of the mandatory data breach notification scheme is that in every time there's a large data breach, every entity is sitting on top of copies of passports and ID documents that they do not need to have.
00:26:06.829 --> 00:26:23.549
And so what we're trying to achieve through that AML CTF regime, which is in one lens expanding obligations to cite identity documents and take copies of them, is to really make sure entities understand what the limits of those obligations are and what the retention requirements are as well.
00:26:23.950 --> 00:26:33.549
Well, speaking about data breaches, the Australian National Airline Qantas last year had a very big data break through a third-party platform used by the Contact Centre.
00:26:33.549 --> 00:26:41.149
And I saw in your recent press releases that you've just concluded the preliminary inquiry into that data breach.
00:26:41.149 --> 00:26:50.909
And surprisingly for me, you come to the conclusion we're not going to further investigate because basically there is no flesh to the bone here.
00:26:50.909 --> 00:26:55.149
This is a breach that could have happened to anyone.
00:26:55.149 --> 00:26:58.509
Nobody did anything particularly wrong.
00:26:58.509 --> 00:27:02.269
That is not something we hear a lot from data protection commissioners.
00:27:02.269 --> 00:27:03.710
So I was positively surprised.
00:27:03.710 --> 00:27:04.990
Let me be clear about that.
00:27:04.990 --> 00:27:08.509
But maybe you want to shed some more light on your decision there.
00:27:08.909 --> 00:27:09.789
Yeah, absolutely.
00:27:09.789 --> 00:27:17.149
So the obligation under Australian law with respect to security is to take reasonable steps in the circumstances to secure personal information.
00:27:17.149 --> 00:27:21.389
So that's a scalable obligation depending on all the circumstances of the entity.
00:27:21.389 --> 00:27:31.869
And reasonable steps is a kind of we're still in our in the nasancy of understanding judicial interpretation of reasonable steps in the context of cybersecurity in particular.
00:27:31.869 --> 00:27:48.589
We've had one case before the courts last year, which concluded we've got two more on foot with respect to the OPTIS data breach of 2022, which was a major data breach that affected many millions of Australians, and the Medibank data breach, which again affected more somewhere around 9 million Australians.
00:27:48.589 --> 00:27:55.389
So we're still working through some of the earliest cases in terms of what judicial interpretation requires of reasonable steps.
00:27:55.389 --> 00:28:04.829
But suffice it to say that it's it's not a kind of strict liability provision and it does require an analysis of what steps were taken, whether those steps adequately mitigated the risks.
00:28:04.829 --> 00:28:10.829
And the fact of having been subject to a data breach in and of itself does not make you run afoul of the law.
00:28:10.829 --> 00:28:32.269
And I think that's important to recognize that, particularly in this AI-driven era in which we know very well how many vulnerabilities are going, are now being exploited through advanced AI technologies, it may be that an entity takes all reasonable steps and yet is still subject to a cyber hack or attack that could not have been prevented or mitigated.
00:28:32.269 --> 00:28:56.750
So we wanted to, we obviously saw the immense regulatory need to investigate Qantas, but likewise, when we found ourselves relatively satisfied that they did take reasonable steps, and I'll talk about some of them in a second, we thought it was really important that we took the opportunity to spell out why we decided we're deciding to close down the investigation, chiefly to ensure confidence in our decision making.
00:28:56.750 --> 00:29:04.189
What we didn't want to happen is that to quietly close down an investigation and then to appear on the back foot when asked what's happening with Qantas.
00:29:04.189 --> 00:29:11.389
We wanted to be out in the open to spell out exactly how we make decisions about what to investigate and not what not to investigate.
00:29:11.389 --> 00:29:17.869
In this circumstance, there had been a social engineering attack on a third-party service provider that was based abroad.
00:29:17.869 --> 00:29:26.029
And so the obligation on Qantas was to manage how that third-party service provider was securing the personal information it held.
00:29:26.029 --> 00:29:40.269
And we found that Qantas did that relatively robustly, including through visiting on-site visits, the provision of training, the requirement for certain ISO standards to be met by that provider, contractual arrangements and the like.
00:29:40.269 --> 00:29:53.549
And while we didn't, our report didn't exonerate Qantas, we were able to conclude that in the present moment, the facts of the matter don't warrant our investigation in light of competing priorities and other issues.
00:29:53.549 --> 00:29:58.429
And of course, in light of the low evidence available to suggest there had been a contravention.
00:29:58.909 --> 00:30:16.589
That's not to say that the Australian law is about teeth on the Australian clinical labs, 5.8 million Australian dollars, uh Meta, 50 million settlement, optus, civil proceedings, medium civil proceedings, clear view AI, determination.
00:30:16.589 --> 00:30:27.309
It's fair to say that you do have some level of enforcement if you choose to, but I appreciate we're only got a certain amount of time, so we do have to turn to the elephant in the room at some point.
00:30:27.309 --> 00:30:40.269
Or the rather baby elephant, I should call it, because you little trendsetters you, you have set the world on fire with the under 16 social media ban, which a lot of countries, including the UK, has then followed suit to consider.
00:30:40.269 --> 00:30:43.389
What's the commission's role in that?
00:30:43.389 --> 00:30:47.549
Where do you sit and how have you found that whole thing?
00:30:47.549 --> 00:30:52.189
Because there's some interesting reports coming out now on whether that's been effective or not.
00:30:52.189 --> 00:30:52.750
So yeah.
00:30:52.750 --> 00:30:54.349
Over two year commission.
00:30:54.750 --> 00:31:04.269
It's a fa it's a fascinating case study on policy design, legislative design, and the effect of regulation on market incentives, all sorts of things.
00:31:04.269 --> 00:31:09.149
And obviously it's still really unfurling, I think, in its early stages.
00:31:09.149 --> 00:31:20.269
To cast back to the prior to the obligation being legislated, I was publicly speaking out against the notion of a social media ban, primarily for two primary reasons.
00:31:20.269 --> 00:31:38.990
One is because I didn't like the premise of a ban, which is that social media companies can't be forced to change their platforms into safe spaces, but also that it could catalyse a whole lot of personal information collection that would impact the privacy of every internet user, not only the privacy of children.
00:31:39.549 --> 00:31:41.629
You won't find a disagreement from either.
00:31:42.189 --> 00:31:43.230
Yeah, yeah, indeed.
00:31:43.230 --> 00:31:45.869
And I think that is still a really live risk.
00:31:45.869 --> 00:31:56.829
So I voice those opinions, but the legislation went ahead very rapidly, and I think that's really indicative of the kind of clear policy commitment that existed in the Australian government to get that over the line.
00:31:56.829 --> 00:32:02.750
And the OAIC became the co-regulator of that scheme alongside the e-Safety Commissioner.
00:32:02.750 --> 00:32:22.109
And the way that works is that the e-Safety Commissioner regulates the obligation to exclude children from platforms, and the OAIC regulates the privacy protections that are built into the legislation, which include, for example, that you have to immediately delete any personal information collected for the purposes of assuring age, unless you have the individual's consent to keep it.
00:32:22.109 --> 00:32:30.429
And so we have had very little role to date in actually responding to any complaints or issues that have arisen.
00:32:30.429 --> 00:32:34.750
We've had very few complaints relating to the privacy protections.
00:32:34.750 --> 00:32:38.509
And that could probably be attributed to a few factors.
00:32:38.509 --> 00:32:52.429
I think that's clear from the evidence so far that there's not yet been widespread compliance with the law, and you'll have the facts before you in a way that I don't, in terms of what the figures are suggesting, in terms of how many children are still on the platforms.
00:32:52.429 --> 00:33:00.429
Some of that I suspect is down to kind of recalcitrance of the platforms themselves to implement the obligation as required.
00:33:00.429 --> 00:33:04.109
Some of it is no doubt circumvention by children themselves.
00:33:04.109 --> 00:33:11.869
And some of it is probably due to the kind of technical implementation, which really is differing largely.
00:33:11.869 --> 00:33:29.389
We're seeing some use of third-party age assurance providers, which is on its face, seems to be highly privacy-preserving in some respects, in the sense that those third-party providers are almost universally doing a pretty good job on data minimization and deletion destruction.
00:33:29.389 --> 00:33:37.629
But of course, the fact of having to age assure in the first place, many do find to be affronting from a privacy perspective.
00:33:37.629 --> 00:33:46.589
There is there's also this question of how much age inference is being done or should being being, should be being done on certain platforms.
00:33:46.589 --> 00:33:53.869
And I think this is something that the age, the e-safety commissioner is really active in trying to understand more.
00:33:53.869 --> 00:34:21.550
Of course, we know many of these platforms have extensive information about every user and no doubt have the ability to ascertain with it a reasonably good level of accuracy how old a user is and the extent to which they are obliged to do that, and whether the extent to which privacy law prohibits them from doing that is a kind of emerging issue of compliance that is probably going to get more tricky in the coming months.
00:34:21.550 --> 00:34:26.030
I think we haven't seen widespread rollout of age assurance across the piece.
00:34:26.030 --> 00:34:33.070
As a user of many social media services here in Australia, I have not encountered any age assurance at any stage.
00:34:33.070 --> 00:34:40.510
So again, you can put that down to either non-compliance with the law or some kind of in the background age inference that's being done.
00:34:40.510 --> 00:34:48.829
The fact that I've held a Facebook profile for more than 20 years is likely a factor that means that they're assuring me on the back end and I'm not being made aware of it.
00:34:48.829 --> 00:34:59.470
But I think the the top-level takeaway is we don't we still don't have a lot of understanding about how entities purport to be complying with this law and whether or not they're doing everything they should be doing.
00:34:59.869 --> 00:35:02.510
I'm hearing some investigations on the horizon.
00:35:02.829 --> 00:35:03.389
Yes, yeah.
00:35:03.389 --> 00:35:05.150
Hopefully, I'm sure that's right.
00:35:05.150 --> 00:35:12.269
And and there's a kind of slight lacuna in terms of powers that the e-safety commissioner is trying to address at the moment.
00:35:12.269 --> 00:35:19.150
I don't necessarily think she had all of the enforcement and investigation powers she needed to have in order to understand compliance.
00:35:19.150 --> 00:35:26.510
But I I the other thing I'd just observe is I think com you know, community attitudes to privacy in Australia aren't weakening in any way.
00:35:26.510 --> 00:35:35.710
We see that people are more concerned about their privacy today than they were five years ago, are highly engaged in privacy issues at a kind of community level in Australia.
00:35:35.710 --> 00:35:42.030
We survey the community every three years that we've just put out our most recent survey, and people care, they care a lot.
00:35:42.030 --> 00:35:48.030
So I don't think there's an apathy emerging with respect to privacy, even despite things like this.
00:35:48.030 --> 00:35:50.269
So I think that's important and good to know.
00:35:50.269 --> 00:36:01.630
I think one of the risks around widespread age assurance is that people have become veneured or used to being asked to identify themselves all the time and stop caring about things like anonymity and privacy, which would be really concerning.
00:36:01.630 --> 00:36:02.510
So that's positive.
00:36:02.510 --> 00:36:16.350
And the other positive I would say is I do think that there's a kind of interesting social, cultural impact of the ban that means people are having different conversations at home, things are starting to move in terms of social acceptability, et cetera.
00:36:16.350 --> 00:36:18.350
But that's obviously a long game.
00:36:18.350 --> 00:36:25.070
And I think we could also ask whether that's the an appropriate objective for legislation to catalyze cultural change.
00:36:25.070 --> 00:36:28.510
Maybe it isn't, but it's an interesting aspect of the debate.
00:36:28.910 --> 00:36:59.550
I'm hopeful that it would also come at some point with some form of education for minors on on how to deal with social media, especially if they now come of social media age and are allowed to create accounts that because they are so eager to try it, that they don't do so unthinkingly or with without thinking, but have some conscience on do's and don'ts that are also provided to them through their parents, through education, maybe even through the responsibility of the platforms themselves.
00:37:00.110 --> 00:37:01.390
I think that that's right.
00:37:01.390 --> 00:37:11.230
The other thing it's worth noting is that we are currently developing the children's online privacy code, which will be brought into effect by December this year.
00:37:11.230 --> 00:37:19.630
And that we hope will be really complementary to the ban in the sense that it will cover a far greater set of online services.
00:37:19.630 --> 00:37:31.550
It will extend to gaming, streaming platforms, etc., and will really be about making sure that when children do go online, that they are afforded much higher privacy protections than they have been historically.
00:37:31.550 --> 00:37:35.950
And indeed than adults are under the current Privacy Act.
00:37:35.950 --> 00:37:44.269
And I think it's important that, as you say, as children start to come online, they also do, they benefit from that education awareness, but also those protections.
00:37:44.269 --> 00:37:47.309
It shouldn't just be a free-for-all after they turn 16.
00:37:48.350 --> 00:37:55.710
As we would fall in love, just had a both looked at each other, expecting each other to speak, which I don't think we've ever done on the podcast before.
00:37:55.710 --> 00:37:57.230
We'd always just jump in.
00:37:57.230 --> 00:38:02.030
But I was going to say, I think that's probably a perfect place to wrap things up.
00:38:02.030 --> 00:38:04.910
It's sad that K could not join us today.
00:38:05.230 --> 00:38:07.789
In all fairness, it's between 2 and 3 a.m.
00:38:07.789 --> 00:38:09.789
in the morning now that we're recording for her.
00:38:09.870 --> 00:38:13.390
So it is between 2 and 3 in the morning for us.
00:38:13.390 --> 00:38:19.550
The love go could goes out to K, but in the meantime, it just remains for me to say thank you to Commissioner Carly Kind.
00:38:19.550 --> 00:38:33.309
And and very much uh appreciated that you've come on and all the best for the way that the complicated web that is Australian data protection law, which must be quite a difficult job to regulate, comes out.
00:38:33.309 --> 00:38:35.550
Until then, it's goodbye from me.
00:38:35.870 --> 00:38:36.590
Thank you very much.
00:38:36.590 --> 00:38:37.789
Goodbye from me as well.
00:38:37.789 --> 00:38:39.870
We hope to see you in Brussels at the GPA.
00:38:40.190 --> 00:38:40.750
Absolutely.
00:38:40.750 --> 00:38:41.630
Look forward to it.
00:38:41.630 --> 00:38:43.070
Thanks again for having me.
00:38:43.390 --> 00:38:44.190
See you next week.
00:38:44.190 --> 00:38:44.750
Goodbye.
00:38:44.750 --> 00:38:46.990
Now that was serious privacy.
00:38:46.990 --> 00:38:51.070
Please subscribe on your favorite podcast app and leave us a review.
00:38:51.070 --> 00:38:55.950
You can find us on LinkedIn, Instagram, and Blue Sky at Sirious Privacy.
00:38:55.950 --> 00:38:58.590
Feel free to drop us a question or a comment.
00:38:58.590 --> 00:39:00.350
We'd love to hear from you.
00:00:53.829 --> 00:00:58.390
You're listening to the award-winning Serious Privacy Podcast sponsored by TrustArc.
00:00:58.390 --> 00:01:02.950
Please welcome your hosts, Paul Breitbart, Ralph O'Brien, and Dr.
00:01:02.950 --> 00:01:04.230
K Royal.
00:01:06.310 --> 00:01:08.310
Today's episode is long overdue.
00:01:08.310 --> 00:01:18.310
You know that in this podcast we like to discuss what is happening in the privacy and data protection community around the globe, but if we are honest, the main focus tends to be on Europe and the United States.
00:01:18.310 --> 00:01:21.109
No wonder with the co-host from those regions.
00:01:21.109 --> 00:01:25.349
Today, however, we turn our lens in another direction and we go down under.
00:01:25.349 --> 00:01:32.789
Our guest today is none other than the Privacy Commissioner of Australia, Carly Kind, a role she has fulfilled for the past two and a half years.
00:01:32.789 --> 00:01:43.909
And before becoming Commissioner, Carly was the director of the UK-based Ada Laughless Institute, an independent research institute with a mission to ensure data and AI work for people and society.
00:01:43.909 --> 00:01:51.109
Before that, she had an extensive career as a digital and fundamental rights lawyer, mainly at international organizations and NGOs.
00:01:51.109 --> 00:01:53.030
My name is Paul Breitbart.
00:01:53.510 --> 00:01:55.030
And my name is Ralph O'Brien.
00:01:55.030 --> 00:01:59.430
And I get to say it today, welcome to Serious Privacy.
00:01:59.430 --> 00:02:06.870
First of all, thank you so much for joining us, Commissioner Carly Kind, which I've got to say is almost a superhero name.
00:02:07.189 --> 00:02:11.349
Yes, I do try and get my children and family members to call me Commissioner when I can.
00:02:11.509 --> 00:02:15.750
It does sound more formal, but it's also a very nice alliteration, right?
00:02:15.750 --> 00:02:18.949
Yeah, it's Peter Parker, Scott Summers.
00:02:18.949 --> 00:02:21.349
I very much, I very much appreciate it.
00:02:21.349 --> 00:02:21.750
Yeah.
00:02:21.750 --> 00:02:24.550
And we always start with an unexpected question.
00:02:24.550 --> 00:02:26.949
We say, are we ready for the unexpected question?
00:02:26.949 --> 00:02:28.629
But that's a really unfair thing to say.
00:02:28.629 --> 00:02:30.230
So I'll just jump in today.
00:02:30.230 --> 00:02:37.269
And my unexpected question today, because K isn't here, is what's your hot beverage of choice?
00:02:37.750 --> 00:02:49.750
My hot beverage of choice is a large, long, black and taken dark black, usually, no milk added, because I have three little kids who still refuse to sleep through the night.
00:02:49.750 --> 00:02:54.629
So I wake up extremely tired and in need of caffeination every morning.
00:02:55.110 --> 00:02:55.909
Fair enough.
00:02:55.909 --> 00:02:57.590
I remember those days well.
00:02:57.590 --> 00:03:05.830
Paul, mine would be a double espresso, especially this time of day, because we are not recording at our regular hour because of the time difference with Australia.
00:03:05.830 --> 00:03:10.469
Some double espresso are indeed needed to get up and running for the podcast.
00:03:10.789 --> 00:03:17.990
Yeah, perhaps one of the reasons why we do sometimes end up being a little bit Europe and uh US focused is mainly for the time difference.
00:03:18.390 --> 00:03:20.710
Ralph, what is your beverage of choice?
00:03:21.830 --> 00:03:25.349
Like most English people, I'm currently enjoying a cup of tea in the morning.
00:03:25.349 --> 00:03:26.629
Black or white?
00:03:26.629 --> 00:03:28.710
White, white.
00:03:28.710 --> 00:03:33.189
We have this expression in the military we call NATO standard, which is white with sugar, right?
00:03:33.189 --> 00:03:34.469
Disgusting.
00:03:34.469 --> 00:03:38.710
But I have swapped sugar for honey, because it's more uh more healthy.
00:03:38.710 --> 00:03:45.509
And in the evenings, I then tend to s to go to a red bush and at the weekend a chai latte.
00:03:45.509 --> 00:03:49.189
How's that for a full and comprehensive response?
00:03:49.189 --> 00:03:50.710
Very fancy.
00:03:50.710 --> 00:03:52.069
Commissioner Kind.
00:03:52.069 --> 00:04:08.469
We normally start by just giving, I know Paul gave a little bit of background shoe in the introduction, but we normally start by asking our guests to just give a short little biography of how you got here, how you got into this wonderful world that we like to call data protection and privacy.
00:04:08.870 --> 00:04:09.669
Yeah, absolutely.
00:04:09.669 --> 00:04:10.390
Thank you.
00:04:10.390 --> 00:04:24.230
I started out as a lawyer here in Australia, really interested in human rights law, and myself casting abroad out of frustration at the few opportunities there were to work in human rights law at the time in the early 2000s.
00:04:24.230 --> 00:04:37.029
Now Australia has a few more human rights legislative instruments, but at the time had none, including being the only Western democracy without uh human rights in the constitution or a bill of rights or a human rights act.
00:04:37.029 --> 00:04:37.669
Yes.
00:04:37.669 --> 00:04:43.590
I I moved to Europe and worked first in Geneva with the United Nations.
00:04:43.590 --> 00:04:50.870
I spent some time interning in London at the International Vir Association and started to build a career in human rights law.
00:04:50.870 --> 00:05:23.509
And then in 2012, I was excited to find an opportunity to segue into technology and human rights law by virtue of an opportunity to take up a role as head of international advocacy at Privacy International, which is a London-based NGO and campaign group, and really was very lucky to get that role at a time in which the organization was growing only from three to four people and was able to be part of that growth that PI went through over the next period of time, including as the issue of privacy really started to raise up the public agenda.
00:05:23.509 --> 00:05:38.149
So I cut my teeth in privacy law first as a campaigner advocate, later doing strategic litigation at Privacy International, and then went on to work really in an advisory space, both in terms of data protection, advisory for international organizations.
00:05:38.149 --> 00:06:01.269
So I spent some time, for example, advising UNHCR in West Africa on their data protection frameworks, but also in terms of technology policy, working with NGOs and other organizations, thinking through some of these tricky issues that arise at the issue of at the intersection of technology and human rights, like misinformation, censorship, surveillance and other privacy interferences.
00:06:01.269 --> 00:06:22.309
And then was really fortunate to get the opportunity to be the founding director of the Ada Lovelace Institute, which was being set up in 2019, to be, I think, what now looks like a very early thought leader on issues of AI and society and how to ensure that AI and its design and deployment serves humanity and not the other way around.
00:06:22.309 --> 00:06:24.470
And that occupied me for five years.
00:06:24.470 --> 00:06:30.389
And obviously that job wasn't quite done when I left it and still continues to really occupy my thoughts a lot.
00:06:30.389 --> 00:06:38.070
But I had the opportunity to take up this role as privacy commissioner, both an exciting personal and professional opportunity.
00:06:38.070 --> 00:06:41.110
I hadn't been back in Australia for 16 years.
00:06:41.110 --> 00:06:53.429
So I used the opportunity to move my family here for some time and get my young boys who all had Australian citizenship had but had never lived here, to experience life in Dan Undacks.
00:06:53.429 --> 00:07:09.750
But also I had been really for the five years that I was at the Ada Lovelace Institute, and even before, often regulation was posited as the answer to many of the rights, issues, and harms and vulnerabilities that we were identifying, including in the context of AI.
00:07:09.750 --> 00:07:22.710
And I was very intrigued to understand what is it to be on the other side of regulation and how do you make regulation work in a way that advocates such as myself had been anticipating or hoping that regulation would be effective in practice.
00:07:22.710 --> 00:07:34.309
So it was really about being on the other side of that and understanding how do you regulate in practice in a way that actually meets community expectations and really means something for people.
00:07:34.309 --> 00:07:38.789
And so that has been the wonderful experience I've been lucky to have since I took up this role.
00:07:39.350 --> 00:07:41.269
How difficult is that reality?
00:07:41.669 --> 00:07:48.470
A lot more difficult than I think I quite realized, or at least maybe difficult isn't the right word, but much more complex.
00:07:48.470 --> 00:08:16.389
I think the the architecture of regulation, the intersection of the laws that are on the books with the evidentiary and investigative challenges that exist to establish compliance or non-compliance, then cast against the people, the skills and capabilities you have in your hands and the constraints thereon, as well as the politics, which are also relevant to the work that we do, even as independent regulators.
00:08:16.389 --> 00:08:19.429
That is a really complex jigsaw puzzle.
00:08:19.429 --> 00:09:22.110
And it's not as straightforward as I perhaps naively thought from the outside, as saying if something's a law on the books, then it will certainly act as contributing that will be held accountable, they'll be held accountable in timely and effective ways.
00:09:22.110 --> 00:09:52.349
There's a lot that goes into thinking about how to regulate and when, how to use the resources you have with respect to which entities, with respect to which violation, and also how to have the outsized effect that you need to really have as a small regulator in the context of a global market, immense entities who have priced the cost of litigation into the cost of doing business, and really try to think about how to most effectively achieve your regulatory objectives using all the tools in your toolbox.
00:09:52.349 --> 00:09:55.469
So it's been a really hugely eye-opening experience.
00:09:55.469 --> 00:09:58.349
And I'm learning on the job every day, I would say.
00:09:58.829 --> 00:10:04.029
We often hear commissioners say using all the tools in their toolbox.
00:10:04.029 --> 00:10:06.829
It's something we often hear from the regulators.
00:10:06.829 --> 00:10:25.149
But for those people who might not be familiar with the sort of Australian law and the Australian Privacy Framework, Privacy Act 88, the 13 apps, perhaps quickly you could tell us what tools you have available because the Australian law is very interesting, almost co-regulatory law.
00:10:25.149 --> 00:10:29.309
Which is very different from some of the laws we see elsewhere.
00:10:29.309 --> 00:10:31.309
And of course, and there's the federal nature as well.
00:10:31.309 --> 00:10:40.349
Some of our previous podcasts hope, people like Nalise and Alexandra have come down to Australia as sort of territory commissioners as well.
00:10:40.349 --> 00:10:42.189
So how does it all pull together?
00:10:42.589 --> 00:10:43.629
Yeah, absolutely.
00:10:43.629 --> 00:10:45.709
It is a complex regulatory landscape.
00:10:45.709 --> 00:10:50.269
I'd at a high level, the following things are true about the Australian system.
00:10:50.269 --> 00:11:01.789
It's heavily, it's obviously a common law system, and the contents of the act are very germane to common law systems in the sense that they're highly principles-based.
00:11:01.789 --> 00:11:23.069
They utilize a lot of concepts that are common in the common law, such as reasonableness, fairness, necessity, both kinds of concepts, which are really effective in making sure that the legislation is highly technology neutral and potentially quite flexible and applicable to different contexts, the downside of which is that it is remains quite high level.
00:11:23.069 --> 00:11:31.149
So, in terms of providing certainty to entities in terms of what compliance looks like, it's not necessarily clear on the face of the act itself.
00:11:31.149 --> 00:11:35.789
It requires a lot in the way of guidance and application into particular circumstances.
00:11:35.789 --> 00:11:40.749
There is also a long-running reform effort to update the act in various ways.
00:11:40.749 --> 00:11:43.869
But it is, it is, it is very different from the GDPR.
00:11:43.869 --> 00:11:49.389
And I I really came up with the GDPR as my first kind of data protection framework that I was familiar with.
00:11:49.389 --> 00:11:55.709
So it has required a shift in thinking and it's less, obviously less codified than the European approach.
00:11:55.709 --> 00:12:09.949
I think at first glance, I thought it was a lesser framework, but I've come to really appreciate its positives and advantages in terms of what it leaves open, particularly in countering the worst risks that arise in new technologies.
00:12:09.949 --> 00:12:14.589
But as you say, in addition to the main act, there's a range of other pieces of legislation.
00:12:14.589 --> 00:12:17.789
I think 39 other pieces of legislation that intersect with the Act.
00:12:17.789 --> 00:12:29.949
There are bespoke privacy regimes under certain legislative schemes in the fields of health, for example, taxation information, social media, which I know we're going to come to, digital identity and data portability.
00:12:29.949 --> 00:12:32.509
So there's separate legislative schemes there.
00:12:32.509 --> 00:12:44.669
Then in terms of jurisdiction, we have the entire private sector is within the remit of the federal act, albeit only those entities with an annual turnover of more than 3 million Australian dollars.
00:12:44.669 --> 00:12:47.709
So we don't capture small, small enterprises.
00:12:47.709 --> 00:12:51.389
We do have an extraterrestrial application of the Act.
00:12:51.389 --> 00:12:57.149
So there's a connection with Australia is required, but not domicile in Australia or anything like that.
00:12:57.149 --> 00:13:01.629
So we do have, for example, big tech companies within our jurisdiction.
00:13:01.629 --> 00:13:06.909
And then in terms of government actors, that's where the state territory commonwealth difference applies.
00:13:06.909 --> 00:13:09.869
So we only regulate federal government agencies.
00:13:09.869 --> 00:13:21.069
So that would include, for example, the Australian Federal Police or Home Affairs for Immigration, whereas the state and territory regulators regulate state and territory government agencies.
00:13:21.069 --> 00:13:27.949
And in Australia, those departments provide many of the main essential government services, such as health and education.
00:13:27.949 --> 00:13:30.269
So that that is the distinction.
00:13:30.269 --> 00:13:32.029
It is a complicated landscape.
00:13:32.029 --> 00:13:35.629
And we work pretty closely with our state and territory peers.
00:13:35.629 --> 00:13:40.829
Each of their separate pieces of legislation are, of course, different from each other and from the Federal Act as well.
00:13:40.829 --> 00:13:48.189
So it's a privacy professional's dream because there's endless advice to be provided to meets the requirement.
00:13:48.189 --> 00:13:52.989
But yes, from a compliance perspective, it is a relatively muddled picture at times.
00:13:52.989 --> 00:13:56.989
And the government's constantly looking for ways to streamline and simplify.
00:14:08.029 --> 00:14:11.789
Kidding aside, there is also a lot of talk about legislative change.
00:14:11.789 --> 00:14:13.709
You've recently had a new law.
00:14:13.709 --> 00:14:20.589
Well, recently in 2024, I believe, a new legislative change come into effect, but there is talk about doing more.
00:14:20.589 --> 00:14:38.109
Is that to align Australia's legislation more to the trends that we see around the world, or is this really something that is required natively because of things that are happening in Australia or where you as office see that things are not good enough right now?
00:14:38.429 --> 00:14:39.869
Yeah, it's a great question, Paul.
00:14:39.869 --> 00:14:49.149
And it's a very kind of storied history to Privacy Act reform, which was first initiated by the Australian Law Reform Commission in 2012, I believe.
00:14:49.149 --> 00:14:55.949
So we're going on almost 15 years since the concept of reforming the Privacy Act was first contemplated.
00:14:55.949 --> 00:15:03.789
And the government conducted a reform of a review of the Privacy Act in 2022, and that reported in 2023.
00:15:03.789 --> 00:15:07.869
So again, almost three years since that more comprehensive review was done.
00:15:07.869 --> 00:15:14.429
The inciting motivations behind, for example, that 2022 review, I think were twofold.
00:15:14.429 --> 00:15:26.349
One was around updating the act in light of the digital era, acknowledging that many of the technologies that now pose the largest privacy risks were not in contemplation at the time of the act's adoption in 1988.
00:15:26.349 --> 00:15:34.189
But I think a branch of the motivation also related to harmonization with other legal frameworks.
00:15:34.189 --> 00:15:39.149
And of course, at that time, GDPR was certainly one of those reference points.
00:15:39.149 --> 00:15:43.789
I think there's that Australia doesn't have an adequacy arrangement with the European Union.
00:15:43.789 --> 00:15:46.349
So that was no doubt a relevant factor.
00:15:46.349 --> 00:15:51.869
But also just being seen to keep up with the changes in kind of state-of-the-art privacy regulation.
00:15:51.869 --> 00:16:08.749
In time, in the recent years, I think there has been recognition of other objectives that can be achieved through Privacy Act reform and perhaps acknowledgement of the virtues of the Australian system that might allow it to take complementary but different approaches to the European approach.
00:16:08.749 --> 00:16:22.669
For example, really the flagship reform that is now under consideration and we expect will be taken forward by the government in the next couple of months is the introduction of a fair and reasonable test to all data processing.
00:16:22.669 --> 00:16:54.829
And the proposal is to essentially try to address the ineffective nature of current privacy consent processes and terms and condition processes, which put a lot of responsibility on individuals' shoulders and absolve entities themselves of having to do any of the hard work to think through costs and benefits and potential risks and harms to data subjects, but rather just allow individuals to consent away or click away some of the protections that they should otherwise deserve.
00:16:54.829 --> 00:17:06.109
And so the fair and reasonable test will say, in all the circumstances, in addition to being law, lawful, sorry, collection data collection use and disclosure will have to be fair and reasonable in the circumstances.
00:17:06.109 --> 00:17:21.390
And what is fair and reasonable will have a range of characteristics associated with it, including the whether the benefits to the individual are outweighed by any of the risks and harms, where the best interests of the child play in, what the individual's reasonable expectations were, et cetera.
00:17:21.390 --> 00:17:27.789
So I think that's actually, in a way, it's quite a novel way of starting to think about how to strengthen privacy law.
00:17:27.789 --> 00:17:48.990
And it, I think, what corresponds well with what we're seeing in data protection and privacy discourses, which is increasing appreciation of the intersection between privacy and data protection rights and consumer issues around fairness, around cost, cost of living, access to services, exploitation, predatory services online.
00:17:48.990 --> 00:17:57.950
I think lots of these are really starting to at least hit the Australian economy in ways that is really problematic and particularly targeting vulnerable communities.
00:17:57.950 --> 00:18:18.190
And I think by putting fairness right at the heart of privacy regulation, the government hopes, and I think it's the right aspiration to really be about creating a fairer playing field for consumers whose data is being treated like a commodity and who aren't necessarily getting the kind of dividends from that value exchange.
00:18:18.190 --> 00:18:20.910
It's in a way it's quite a radical change.
00:18:20.910 --> 00:18:32.829
And then I will stop in a second, appreciate I'm rattling on, but the some of the other changes are more technical or are more in line with that aspiration of aligning with, for example, the GDPR.
00:18:32.829 --> 00:18:42.029
So, for example, the definition of personal information under Australian law still uses a term which is about an individual rather than relates to the individual.
00:18:42.029 --> 00:18:45.149
So that will be changed to align with GDPR, for example.
00:18:45.629 --> 00:18:54.750
I really like the fairness part because fairness is, of course, also a principle in Article 5 of the GDPR of the UK Data Protection Act as well.
00:18:54.750 --> 00:19:04.269
But it's only very recently that it seems that data protection authorities really start to care about the fairness part of data processing.
00:19:04.269 --> 00:19:19.309
So to put it front and center in a legislative reform also really makes it clear to organizations operating in Australia that this is something that they should take into account and that not everything is just about the letter of the law.
00:19:19.309 --> 00:19:32.829
Ralph, you've been saying this on the podcast before, if you do assessment is not just about ticking the boxes and making sure that you address everything that is in the legislation, but also continuously asking the question, who are we doing this for?
00:19:32.829 --> 00:19:36.349
Is it what is the interest of the individual here?
00:19:36.750 --> 00:19:41.470
Recital one, personal data should be used to serve humankind, right?
00:19:41.470 --> 00:19:41.950
Yeah.
00:19:41.950 --> 00:19:49.950
We actually had a court case and I mentioned it on the podcast last week, which is one of the first court cases we've ever seen to actually actually use fairness.
00:19:49.950 --> 00:19:55.629
It's principle one in the GDPR and the UK GDPR, and fair, lawful, and transparent.
00:19:55.629 --> 00:19:58.109
But we often don't see fairness talked about enough.
00:19:58.109 --> 00:20:00.589
Lawful and transparent, sure, but not fairness.
00:20:00.589 --> 00:20:06.909
And actually I didn't even realise, so I've learned something today that was missing from the apps, the Australian privacy principles.
00:20:07.549 --> 00:20:12.109
Fairness is there, but the means of collection have to be fair currently.
00:20:12.109 --> 00:20:13.629
So it's quite a kind of narrow.
00:20:13.629 --> 00:20:14.109
Yeah.
00:20:14.109 --> 00:20:19.549
Whereas this is very much going to put it right at the centre of collection and handling altogether.
00:20:20.029 --> 00:20:33.309
So when you spoke about the legislative regime in Australia, for want of a better word, do you have any specific provisions also for the native people of Australia in your legislation?
00:20:33.309 --> 00:20:36.269
Do they have their own privacy approach maybe?
00:20:36.269 --> 00:20:43.069
We've spoken to people about Indigenous privacy before and know that Australia has a large Indigenous community.
00:20:43.069 --> 00:20:44.750
What's the approach there?
00:20:45.149 --> 00:21:02.189
Yeah, so we don't have specific provisions around Indigenous data, but Indigenous data sovereignty is a very important concept that is and kind of policy and initiative that is well embedded in a range of Australian government departments and initiatives, and certainly something that we have reference to.
00:21:02.189 --> 00:21:07.789
We have a range of different ways in which we seek to serve Indigenous communities specifically.
00:21:07.789 --> 00:21:13.549
So, for example, we're currently in the process of ensuring our guidance is available in some Indigenous languages.
00:21:13.549 --> 00:21:29.230
We're also quite engaged in some of the work that's still being done in Australia about access to records pertaining to the stolen generation of Indigenous individuals in the 50s and 60s and probably as late as the 70s.
00:21:29.230 --> 00:21:41.869
One of the issues that continues to arise is that privacy protections are sometimes held out as ways of preventing Indigenous people from getting access to the information about their families and their heritage, et cetera.
00:21:41.869 --> 00:21:52.990
So it's there's kind of a kind of complex web of ways in which Indigenous data sovereignty and Indigenous data rights need to be given attention and really taken forward in Australia.
00:21:52.990 --> 00:22:04.029
And it's not necessarily through any particular legislative instrument, but rather through various initiatives that are scattered across government departments and within which our own agency participates.
00:22:04.589 --> 00:22:08.429
You mentioned the fact that the regime is somewhat complex.
00:22:08.429 --> 00:22:32.829
As it goes forward, you mentioned that the fairness change, you mentioned things like the penalty increase, you've mentioned things like looking at it in various tranches to add various sort of rights and freedoms as you've gone forwards.
00:22:32.829 --> 00:22:48.750
So then how is it regulated to you keep organizations up to date, keep organizations in a place where they can understand the changes and also individuals understanding their the their rights and freedoms?
00:22:48.750 --> 00:22:55.629
If you're if you've got this law that's constantly evolving, constantly changing, does there be any of you to looking at it wholesale?
00:22:55.629 --> 00:23:00.589
Get rid of the 88 Act and just bring something new in to consolidate everything?
00:23:00.589 --> 00:23:06.909
Or are we just going to see these more incremental changes and you updating organizations as as you go forwards?
00:23:07.230 --> 00:23:14.429
Yeah, I think the the historical preference in Australian legislative history is this kind of updating, tinkering approach.
00:23:14.429 --> 00:23:17.789
And I'm not sure the Privacy Act gets a pass from that.
00:23:17.789 --> 00:23:22.669
So to my knowledge, there hasn't been any suggestion of a wholesale change.
00:23:22.669 --> 00:23:30.750
And that's maybe that's an interesting cultural or legal tradition issue that is different from European approaches, for example.
00:23:30.750 --> 00:23:36.189
Yeah, it's it is a challenge to say the act has in the last five years, for example, the act has been amended.
00:23:36.189 --> 00:23:51.470
Amended at least twice, once in 2024 to introduce new enforcement penalties, to introduce a mandate for us to develop a children's online privacy code, to introduce new obligations around disclosure of automated decision-making systems in privacy policies.
00:23:51.470 --> 00:23:54.990
And then prior to that, in 2022, to increase penalties.
00:23:54.990 --> 00:24:00.349
And then there are a range of, as I said, bespoke privacy schemes that have been specifically legislated.
00:24:00.349 --> 00:24:09.149
So the social media minimum age scheme, which you'll know as the social media ban, that legislative scheme, which is contained in the Online Safety Act, has it.
00:24:09.149 --> 00:24:09.710
Yeah.
00:24:09.710 --> 00:24:16.349
So look what the way we do it in practice is a set we try to use a kind of range of communications tools.
00:24:16.349 --> 00:24:20.750
Sometimes we'll use a block to explain a small change to the legislation.
00:24:20.750 --> 00:24:22.909
Sometimes we'll do bespoke guidance.
00:24:22.909 --> 00:24:27.950
So we did guidance, for example, on age assurance technologies, guidance on the social media ban.
00:24:27.950 --> 00:24:30.509
And we try to do things like webinars.
00:24:30.509 --> 00:24:32.109
We try to provide fact sheets.
00:24:32.109 --> 00:24:36.829
And where we can, we try to provide templates for collection notices or privacy policies, et cetera.
00:24:36.829 --> 00:24:47.710
So this year, for example, changes to the money laundering counterrorist financing law came into Australia to bring a range of small and median enterprises within the scope of the Privacy Act.
00:24:47.710 --> 00:24:52.189
Our jurisdiction expanded by 120,000 organizations overnight.
00:24:52.189 --> 00:24:57.789
And those organizations had particular needs because they had never had to comply with privacy law before.
00:24:57.789 --> 00:25:02.269
So we needed really easy, off-the-shelf ways to help them get to compliance.
00:25:02.269 --> 00:25:12.269
But at the end of the day, we are a small agency where fewer than 200 people, and we need to use our resources in the most efficient and effective way possible.
00:25:12.269 --> 00:25:22.509
So we do we basically take a risk-based approach to what needs guidance, what needs spelling out, what can be dealt with on an ad hoc basis or in blogs and other forms of guidance material.
00:25:22.990 --> 00:25:30.509
Those extra people, as I understand it, real estate professionals, lawyers, accountants, conveyancers, precious metals, stone.
00:25:30.509 --> 00:25:32.990
Very big in Australia, obviously.
00:25:32.990 --> 00:25:33.789
Yeah.
00:25:33.789 --> 00:25:37.549
And then you've got a core around C money and uh AML, CTF.
00:25:38.909 --> 00:25:39.309
That's right.
00:25:39.309 --> 00:25:39.950
Exactly.
00:25:39.950 --> 00:25:46.990
So they now have Privacy Act obligations only insofar as it pertains to their compliance with AML-CTF regulation.
00:25:46.990 --> 00:25:52.829
But it's quite an important area of privacy regulation, as you'll know, because it traditionally involves the acquisition of identity documents.
00:25:52.829 --> 00:26:06.829
And what we see in particularly in our administration of the mandatory data breach notification scheme is that in every time there's a large data breach, every entity is sitting on top of copies of passports and ID documents that they do not need to have.
00:26:06.829 --> 00:26:23.549
And so what we're trying to achieve through that AML CTF regime, which is in one lens expanding obligations to cite identity documents and take copies of them, is to really make sure entities understand what the limits of those obligations are and what the retention requirements are as well.
00:26:23.950 --> 00:26:33.549
Well, speaking about data breaches, the Australian National Airline Qantas last year had a very big data break through a third-party platform used by the Contact Centre.
00:26:33.549 --> 00:26:41.149
And I saw in your recent press releases that you've just concluded the preliminary inquiry into that data breach.
00:26:41.149 --> 00:26:50.909
And surprisingly for me, you come to the conclusion we're not going to further investigate because basically there is no flesh to the bone here.
00:26:50.909 --> 00:26:55.149
This is a breach that could have happened to anyone.
00:26:55.149 --> 00:26:58.509
Nobody did anything particularly wrong.
00:26:58.509 --> 00:27:02.269
That is not something we hear a lot from data protection commissioners.
00:27:02.269 --> 00:27:03.710
So I was positively surprised.
00:27:03.710 --> 00:27:04.990
Let me be clear about that.
00:27:04.990 --> 00:27:08.509
But maybe you want to shed some more light on your decision there.
00:27:08.909 --> 00:27:09.789
Yeah, absolutely.
00:27:09.789 --> 00:27:17.149
So the obligation under Australian law with respect to security is to take reasonable steps in the circumstances to secure personal information.
00:27:17.149 --> 00:27:21.389
So that's a scalable obligation depending on all the circumstances of the entity.
00:27:21.389 --> 00:27:31.869
And reasonable steps is a kind of we're still in our in the nasancy of understanding judicial interpretation of reasonable steps in the context of cybersecurity in particular.
00:27:31.869 --> 00:27:48.589
We've had one case before the courts last year, which concluded we've got two more on foot with respect to the OPTIS data breach of 2022, which was a major data breach that affected many millions of Australians, and the Medibank data breach, which again affected more somewhere around 9 million Australians.
00:27:48.589 --> 00:27:55.389
So we're still working through some of the earliest cases in terms of what judicial interpretation requires of reasonable steps.
00:27:55.389 --> 00:28:04.829
But suffice it to say that it's it's not a kind of strict liability provision and it does require an analysis of what steps were taken, whether those steps adequately mitigated the risks.
00:28:04.829 --> 00:28:10.829
And the fact of having been subject to a data breach in and of itself does not make you run afoul of the law.
00:28:10.829 --> 00:28:32.269
And I think that's important to recognize that, particularly in this AI-driven era in which we know very well how many vulnerabilities are going, are now being exploited through advanced AI technologies, it may be that an entity takes all reasonable steps and yet is still subject to a cyber hack or attack that could not have been prevented or mitigated.
00:28:32.269 --> 00:28:56.750
So we wanted to, we obviously saw the immense regulatory need to investigate Qantas, but likewise, when we found ourselves relatively satisfied that they did take reasonable steps, and I'll talk about some of them in a second, we thought it was really important that we took the opportunity to spell out why we decided we're deciding to close down the investigation, chiefly to ensure confidence in our decision making.
00:28:56.750 --> 00:29:04.189
What we didn't want to happen is that to quietly close down an investigation and then to appear on the back foot when asked what's happening with Qantas.
00:29:04.189 --> 00:29:11.389
We wanted to be out in the open to spell out exactly how we make decisions about what to investigate and not what not to investigate.
00:29:11.389 --> 00:29:17.869
In this circumstance, there had been a social engineering attack on a third-party service provider that was based abroad.
00:29:17.869 --> 00:29:26.029
And so the obligation on Qantas was to manage how that third-party service provider was securing the personal information it held.
00:29:26.029 --> 00:29:40.269
And we found that Qantas did that relatively robustly, including through visiting on-site visits, the provision of training, the requirement for certain ISO standards to be met by that provider, contractual arrangements and the like.
00:29:40.269 --> 00:29:53.549
And while we didn't, our report didn't exonerate Qantas, we were able to conclude that in the present moment, the facts of the matter don't warrant our investigation in light of competing priorities and other issues.
00:29:53.549 --> 00:29:58.429
And of course, in light of the low evidence available to suggest there had been a contravention.
00:29:58.909 --> 00:30:16.589
That's not to say that the Australian law is about teeth on the Australian clinical labs, 5.8 million Australian dollars, uh Meta, 50 million settlement, optus, civil proceedings, medium civil proceedings, clear view AI, determination.
00:30:16.589 --> 00:30:27.309
It's fair to say that you do have some level of enforcement if you choose to, but I appreciate we're only got a certain amount of time, so we do have to turn to the elephant in the room at some point.
00:30:27.309 --> 00:30:40.269
Or the rather baby elephant, I should call it, because you little trendsetters you, you have set the world on fire with the under 16 social media ban, which a lot of countries, including the UK, has then followed suit to consider.
00:30:40.269 --> 00:30:43.389
What's the commission's role in that?
00:30:43.389 --> 00:30:47.549
Where do you sit and how have you found that whole thing?
00:30:47.549 --> 00:30:52.189
Because there's some interesting reports coming out now on whether that's been effective or not.
00:30:52.189 --> 00:30:52.750
So yeah.
00:30:52.750 --> 00:30:54.349
Over two year commission.
00:30:54.750 --> 00:31:04.269
It's a fa it's a fascinating case study on policy design, legislative design, and the effect of regulation on market incentives, all sorts of things.
00:31:04.269 --> 00:31:09.149
And obviously it's still really unfurling, I think, in its early stages.
00:31:09.149 --> 00:31:20.269
To cast back to the prior to the obligation being legislated, I was publicly speaking out against the notion of a social media ban, primarily for two primary reasons.
00:31:20.269 --> 00:31:38.990
One is because I didn't like the premise of a ban, which is that social media companies can't be forced to change their platforms into safe spaces, but also that it could catalyse a whole lot of personal information collection that would impact the privacy of every internet user, not only the privacy of children.
00:31:39.549 --> 00:31:41.629
You won't find a disagreement from either.
00:31:42.189 --> 00:31:43.230
Yeah, yeah, indeed.
00:31:43.230 --> 00:31:45.869
And I think that is still a really live risk.
00:31:45.869 --> 00:31:56.829
So I voice those opinions, but the legislation went ahead very rapidly, and I think that's really indicative of the kind of clear policy commitment that existed in the Australian government to get that over the line.
00:31:56.829 --> 00:32:02.750
And the OAIC became the co-regulator of that scheme alongside the e-Safety Commissioner.
00:32:02.750 --> 00:32:22.109
And the way that works is that the e-Safety Commissioner regulates the obligation to exclude children from platforms, and the OAIC regulates the privacy protections that are built into the legislation, which include, for example, that you have to immediately delete any personal information collected for the purposes of assuring age, unless you have the individual's consent to keep it.
00:32:22.109 --> 00:32:30.429
And so we have had very little role to date in actually responding to any complaints or issues that have arisen.
00:32:30.429 --> 00:32:34.750
We've had very few complaints relating to the privacy protections.
00:32:34.750 --> 00:32:38.509
And that could probably be attributed to a few factors.
00:32:38.509 --> 00:32:52.429
I think that's clear from the evidence so far that there's not yet been widespread compliance with the law, and you'll have the facts before you in a way that I don't, in terms of what the figures are suggesting, in terms of how many children are still on the platforms.
00:32:52.429 --> 00:33:00.429
Some of that I suspect is down to kind of recalcitrance of the platforms themselves to implement the obligation as required.
00:33:00.429 --> 00:33:04.109
Some of it is no doubt circumvention by children themselves.
00:33:04.109 --> 00:33:11.869
And some of it is probably due to the kind of technical implementation, which really is differing largely.
00:33:11.869 --> 00:33:29.389
We're seeing some use of third-party age assurance providers, which is on its face, seems to be highly privacy-preserving in some respects, in the sense that those third-party providers are almost universally doing a pretty good job on data minimization and deletion destruction.
00:33:29.389 --> 00:33:37.629
But of course, the fact of having to age assure in the first place, many do find to be affronting from a privacy perspective.
00:33:37.629 --> 00:33:46.589
There is there's also this question of how much age inference is being done or should being being, should be being done on certain platforms.
00:33:46.589 --> 00:33:53.869
And I think this is something that the age, the e-safety commissioner is really active in trying to understand more.
00:33:53.869 --> 00:34:21.550
Of course, we know many of these platforms have extensive information about every user and no doubt have the ability to ascertain with it a reasonably good level of accuracy how old a user is and the extent to which they are obliged to do that, and whether the extent to which privacy law prohibits them from doing that is a kind of emerging issue of compliance that is probably going to get more tricky in the coming months.
00:34:21.550 --> 00:34:26.030
I think we haven't seen widespread rollout of age assurance across the piece.
00:34:26.030 --> 00:34:33.070
As a user of many social media services here in Australia, I have not encountered any age assurance at any stage.
00:34:33.070 --> 00:34:40.510
So again, you can put that down to either non-compliance with the law or some kind of in the background age inference that's being done.
00:34:40.510 --> 00:34:48.829
The fact that I've held a Facebook profile for more than 20 years is likely a factor that means that they're assuring me on the back end and I'm not being made aware of it.
00:34:48.829 --> 00:34:59.470
But I think the the top-level takeaway is we don't we still don't have a lot of understanding about how entities purport to be complying with this law and whether or not they're doing everything they should be doing.
00:34:59.869 --> 00:35:02.510
I'm hearing some investigations on the horizon.
00:35:02.829 --> 00:35:03.389
Yes, yeah.
00:35:03.389 --> 00:35:05.150
Hopefully, I'm sure that's right.
00:35:05.150 --> 00:35:12.269
And and there's a kind of slight lacuna in terms of powers that the e-safety commissioner is trying to address at the moment.
00:35:12.269 --> 00:35:19.150
I don't necessarily think she had all of the enforcement and investigation powers she needed to have in order to understand compliance.
00:35:19.150 --> 00:35:26.510
But I I the other thing I'd just observe is I think com you know, community attitudes to privacy in Australia aren't weakening in any way.
00:35:26.510 --> 00:35:35.710
We see that people are more concerned about their privacy today than they were five years ago, are highly engaged in privacy issues at a kind of community level in Australia.
00:35:35.710 --> 00:35:42.030
We survey the community every three years that we've just put out our most recent survey, and people care, they care a lot.
00:35:42.030 --> 00:35:48.030
So I don't think there's an apathy emerging with respect to privacy, even despite things like this.
00:35:48.030 --> 00:35:50.269
So I think that's important and good to know.
00:35:50.269 --> 00:36:01.630
I think one of the risks around widespread age assurance is that people have become veneured or used to being asked to identify themselves all the time and stop caring about things like anonymity and privacy, which would be really concerning.
00:36:01.630 --> 00:36:02.510
So that's positive.
00:36:02.510 --> 00:36:16.350
And the other positive I would say is I do think that there's a kind of interesting social, cultural impact of the ban that means people are having different conversations at home, things are starting to move in terms of social acceptability, et cetera.
00:36:16.350 --> 00:36:18.350
But that's obviously a long game.
00:36:18.350 --> 00:36:25.070
And I think we could also ask whether that's the an appropriate objective for legislation to catalyze cultural change.
00:36:25.070 --> 00:36:28.510
Maybe it isn't, but it's an interesting aspect of the debate.
00:36:28.910 --> 00:36:59.550
I'm hopeful that it would also come at some point with some form of education for minors on on how to deal with social media, especially if they now come of social media age and are allowed to create accounts that because they are so eager to try it, that they don't do so unthinkingly or with without thinking, but have some conscience on do's and don'ts that are also provided to them through their parents, through education, maybe even through the responsibility of the platforms themselves.
00:37:00.110 --> 00:37:01.390
I think that that's right.
00:37:01.390 --> 00:37:11.230
The other thing it's worth noting is that we are currently developing the children's online privacy code, which will be brought into effect by December this year.
00:37:11.230 --> 00:37:19.630
And that we hope will be really complementary to the ban in the sense that it will cover a far greater set of online services.
00:37:19.630 --> 00:37:31.550
It will extend to gaming, streaming platforms, etc., and will really be about making sure that when children do go online, that they are afforded much higher privacy protections than they have been historically.
00:37:31.550 --> 00:37:35.950
And indeed than adults are under the current Privacy Act.
00:37:35.950 --> 00:37:44.269
And I think it's important that, as you say, as children start to come online, they also do, they benefit from that education awareness, but also those protections.
00:37:44.269 --> 00:37:47.309
It shouldn't just be a free-for-all after they turn 16.
00:37:48.350 --> 00:37:55.710
As we would fall in love, just had a both looked at each other, expecting each other to speak, which I don't think we've ever done on the podcast before.
00:37:55.710 --> 00:37:57.230
We'd always just jump in.
00:37:57.230 --> 00:38:02.030
But I was going to say, I think that's probably a perfect place to wrap things up.
00:38:02.030 --> 00:38:04.910
It's sad that K could not join us today.
00:38:05.230 --> 00:38:07.789
In all fairness, it's between 2 and 3 a.m.
00:38:07.789 --> 00:38:09.789
in the morning now that we're recording for her.
00:38:09.870 --> 00:38:13.390
So it is between 2 and 3 in the morning for us.
00:38:13.390 --> 00:38:19.550
The love go could goes out to K, but in the meantime, it just remains for me to say thank you to Commissioner Carly Kind.
00:38:19.550 --> 00:38:33.309
And and very much uh appreciated that you've come on and all the best for the way that the complicated web that is Australian data protection law, which must be quite a difficult job to regulate, comes out.
00:38:33.309 --> 00:38:35.550
Until then, it's goodbye from me.
00:38:35.870 --> 00:38:36.590
Thank you very much.
00:38:36.590 --> 00:38:37.789
Goodbye from me as well.
00:38:37.789 --> 00:38:39.870
We hope to see you in Brussels at the GPA.
00:38:40.190 --> 00:38:40.750
Absolutely.
00:38:40.750 --> 00:38:41.630
Look forward to it.
00:38:41.630 --> 00:38:43.070
Thanks again for having me.
00:38:43.390 --> 00:38:44.190
See you next week.
00:38:44.190 --> 00:38:44.750
Goodbye.
00:38:44.750 --> 00:38:46.990
Now that was serious privacy.
00:38:46.990 --> 00:38:51.070
Please subscribe on your favorite podcast app and leave us a review.
00:38:51.070 --> 00:38:55.950
You can find us on LinkedIn, Instagram, and Blue Sky at Sirious Privacy.
00:38:55.950 --> 00:38:58.590
Feel free to drop us a question or a comment.
00:38:58.590 --> 00:39:00.350
We'd love to hear from you.
