Australians would gain greater control of their personal information, including the ability to opt out of targeted ads, erase their data and sue for serious breaches of privacy, under a proposal to the Albanese government.
On Thursday the attorney general, Mark Dreyfus, will release a review conducted by his department into modernisation of the Privacy Act which calls to expand its remit to small businesses and add new safeguards for use of data by political parties.
Although the document is not government policy, in January Dreyfus told Guardian Australia the right to sue for privacy breaches and European-style reforms such as the right to be forgotten would be considered for the next tranche of legislation.
In 2022 the Albanese government passed a bill increasing penalties for companies that fail to protect customer data in the wake of major data breaches at telco Optus and health insurer Medibank.
A summary section of the review, seen in advance by Guardian Australia, called for the exemption from the Privacy Act for small businesses to be abolished, citing community expectations that if small businesses are provided personal information “they will keep it safe”.
But first the government should conduct an “impact analysis” and give support to ensure small businesses can comply with their obligations, it said.
Despite calls to abolish the privacy exemptions for political parties, the review proposed only increased safeguards, such as for parties to publish a privacy policy and not target voters “based on sensitive information or traits” except for political opinions, membership of a political association, or a trade union.
“There was very strong support for increasing the protections for personal information under the Act,” the review said.
The review called for new limits on targeted advertising, including to prohibit targeting to a child except where it is in their “best interests”, and to provide others with an “an unqualified right to opt-out” of targeted ads and their information being disclosed for direct marketing purposes.
The Privacy Act should include a new overarching requirement that “the collection, use and disclosure of personal information must be fair and reasonable in the circumstances”, it said.
The review also proposes individual rights modelled on the European Union’s general data protection regulation including to: object to the collection, use or disclosure of personal information; request erasure of personal information; and to de-index online search results containing sensitive information, excessive detail or “inaccurate, out-of-date, incomplete, irrelevant, or misleading” information.
The review suggested that consent should be required for collection and use of precise geolocation tracking data.
The government should “consult on introducing a criminal offence for malicious re-identification of de-identified information where there is an intention to harm another or obtain an illegitimate benefit”, it said.
The report said that individuals wanted “more agency to seek redress for interferences with their privacy”, proposing the creation of a right to sue for “serious invasions of privacy”, which was also a recommendation of the Australian Law Reform Commission in 2014.
On Wednesday Dreyfus said “large-scale data breaches of 2022 were distressing for millions of Australians, with sensitive personal information being exposed to the risk of identity fraud and scams”.
“The Australian people rightly expect greater protections, transparency and control over their personal information and the release of this report begins the process of delivering on those expectations.
“The government is now seeking feedback on the 116 proposals in this report before deciding what further steps to take.”
In January Sunita Bose, the managing director of Digital Industry Group Inc – whose members include Google, Apple, Meta, Twitter and TikTok – told Guardian Australia it was in favour of aligning Australia’s law with the European GDPR “which has a lot of strong elements, including consumer rights around data erasure”.
Breach of privacy could prove controversial for media companies which fear the right to sue can provide the wealthy and powerful further legal weapons to constrain freedom of the press.
The Business Council of Australia opposed the law reform in earlier consultations, labelling it “premature to introduce a tort that would often overlap with the protections of the Australian Privacy Principles”.
