Colleen
Hello, folks. Welcome to the privacy huddle. My guest today grew up in Australia, lives in Singapore, and now spends her days explaining Australian privacy law to the rest of the world. And it just so happens that some of that law is being rewritten right now. So what better time to discuss? Let's go ahead and dig into a special episode of the privacy huddle where we often focus on US regulation and litigation activity. But today, we're gonna talk about Australia, and so I'm here with Lauren. Lauren, it's such a pleasure to have you on. Thank you
Loren
so much for having me, Colleen. It's a pleasure to be here.
Colleen
Yes. So this is the privacy huddle. My name is Colleen. I lead marketing at Ketch, and this is our almost weekly show hosted by by myself and Ketch where we try to unpack just what is happening in the ever changing landscape privacy from tips, tricks, best practices, headlines, all sorts of stuff. And so thrilled to be with you here today, Lauren. You're a partner at Bird and Bird, and you have a front row seat to Australian privacy from Singapore. A lot of our listeners are starting to see Australian customers show up. There's a lot moving. And so I wanna talk about kind of the the backdrop of what privacy has been like in Australia, but then also this kind of interesting recent movement. So we have a lot of listeners with global customer bases, consumers that live in Australia, and so always looking to give them a well rounded perspective. So excited to dig in with you. Now, Lauren, I have to start up. Everyone I talked to has an interesting way that they've made it into privacy. It seems like we're in the stage where nobody... Everybody doing it today didn't study it in school. So how did you get into privacy? Tell us your journey.
Loren
Yeah. Well, I mean, I didn't have much of a choice, really. I joined a new firm a few years ago. My boss did privacy. GDPR just came into effect, so suddenly I was privacy lawyer. To be honest, I think when I first started, I didn't think it was the most fascinating topic, but then the more I did, I think the more interesting it got and especially when it came to comparing different regimes in different jurisdictions. And I think growing up in an Asian household, I didn't think there was much of a concept of privacy, you know, within the kind of household context. And I remember writing a paper in university on the concept of privacy in Chinese culture or rather the lack thereof, and I started to realize that I could see those cultural influences in the way that different countries regulate privacy from something as simple as the name of the law itself. You know? Is it called a privacy law versus a personal data protection law and right through to the actual rights and obligations within the law?
Colleen
That is so interesting. You often hear about people having different proclivities. You know? Do you hit accept all, or do you hit reject all? And these kind of things, but I never thought about how that could be so deeply rooted in your family and how... What your parents teach you. Right? That's so funny. Yeah. I love it. So let's start kind of back at the at the beginning. Right? When you and I started talking about having this conversation and, you know, history of Australian privacy, many folks may not realize that, you know, the Australian privacy act was once a front runner, and maybe it's playing catch up now, but it was one of the first to the scene. So, Lauren, for listeners that are not familiar with history of privacy in Australia, what's the backdrop here in terms of how the country has handled data privacy?
Loren
Yep. You're absolutely right. The privacy act first came out in 1988, which is quite a while ago, long before the Internet was mainstream. Most people probably didn't even have their own computers back then, so it's no surprise that it is getting a little bit out of date. Of course, there have been a number of amendments made since then. So 2014, there was a big change where we saw the introduction of the Australian privacy principles, which are really the main set of privacy obligations that sit under the privacy act. Then in 2018, there was the introduction of the notifiable data breach scheme, which essentially mandated reporting of data breaches and really reflected the growing number of cybersecurity incidents, data breaches that were happening at the time and continue to happen. And then in 2022, we had increased penalties under the privacy act again to reflect the scale and potential impact of privacy related breaches. And then we come to what we call the current round of reforms. I say current because they actually started back in 2020, and they were designed to bring the act into the digital age and to uplift protections for individuals.
Colleen
Got it.
Loren
The first tranche of reforms was passed back in December 2024. They included requirements around automated decision making and the development of a children's online privacy code, and those two things are actually about to come into effect in December this year. And then now, finally, you know, about six years later, we're finally looking at the second tranche of reforms, and the drafts for that were just published about just over a month ago.
Colleen
Got it. Okay. Very helpful. Now when you think about... Maybe, again, with listeners that are not as familiar with the Australian law, if you're an in house counsel at a company that's largely maybe based in The US, you have customers in Australia, just historically, right, how would you figure out whether the act even applies to your customer?
Loren
Okay. So if you have a company that's incorporated in Australia, you know, you've got a local entity, then it's definitely gonna apply. So that one's easy. But it does also apply to foreign companies that carry on business in Australia. So what does carry on business mean? It's not actually defined, but it's pretty broadly interpreted. So even if you don't have an entity, you don't have a physical presence, it could still apply to you. So you need to think about things like, do you have a website that offers goods and services in Australia? Do you fulfill business orders or purchase orders in Australia? Do you have registered trademarks in Australia or engage any agents to act on your behalf in Australia? There is no one single definitive factor. Although the mere fact that you can simply access a website from Australia may not be enough in itself. But if you do more actively target Australia in some way, for example, you can choose Australia as your location on your website or you're selling things in Australian dollars or offering delivery to Australia, for example, then you're more likely to be captured. So just because you're not actually physically in Australia, don't assume it doesn't apply to you.
Colleen
Got it. Okay. Very helpful table setting. I love it. So let's move into... I would love your take on this kind of latest reform package. Right? As you said at the beginning, end of August, the government released this this draft of the second tranche of reforms, and it's not law yet. They said they wanna pass by end of the year. Right? And so there's some interesting changes in here and language that they're using, and I'd love your take on some of these things. So let's kinda walk through. Now the first one I wanna call out is they're using this phrase, the fair and reasonable test. Right? My understanding is this is not an entirely new concept in Australia, but I think to to privacy leaders that are less familiar with the Australia law, it's kind of a new term and not something you necessarily see in other regimes. So can you unpack this term for us? What does the law mean by fair and reasonable, and does anything change with this second tranche of reforms?
Loren
Right. So what this requires is essentially that you can't collect, use, or disclose personal information unless it is fair and reasonable in the circumstances. So that might sound a little bit alarming and that it sounds like a kind of prohibition in the first place, but you are bright in that the test or at least some of these concepts or, you know, ideas of fairness and reasonableness are not entirely new. So the current act already includes a requirement that personal information can only be collected by fair and lawful means and that any subsequent use and disclosure must be within the individual's reasonable expectations. So you can see those concepts of fairness, reasonableness not entirely new, but there are some key differences. So firstly, the the new fair and reasonable test applies to each collection use and disclosure of information. Under the current regime, the fairness test only applies at the point of collection and only to the means of collections of how you're actually collecting the personal information. The new test requires both the purposes and the means to be fair and reasonable, and that doesn't apply just to collection, but also to all use and disclosure. So you can see, you know, an extension of what that requirement is. Another key difference is that consent is not a cure. So under the current regime for the use and disclosure part, you can actually use and disclose personal information with consent even if it's not within reasonable expectations. So either it's already within reasonable expectations or if it's not, then all you need to do is tell people what you're doing, what you're gonna use and disclose the information for, and then you can get consent and you can go ahead and use or disclose that information. Under the new regime, even that's not enough. Even if you get consent, it still needs to be fair and reasonable. What that means in practice is that you'll need to consider all of the relevant factors around fairness, reasonableness from the outset taking into account what you're currently doing, what you're planning to do.
Colleen
Yeah. Got it. Okay. Very interesting. I mean, as you talk about it, it does... You know, I'm a marketer. I'm not as deep as you on these topics, Lauren, but it reminds me of the concept of legitimate interest in GDPR. Am I right to kind of think of it in that way?
Loren
Yes. Absolutely. That is at least one element of it. You know, part of it is about thinking about a balancing test. You know, what is the impact to the individual? What, you know, other measures you can take to kind of make that collection use or disclosure more proportionate with the individual's rights and interests. So it does draw many parallels with the legitimate interest basis in that test, and there's other things you need to think about as well. The good news is that there are some familiar principles also, you know, things like transparency, data minimization, again, concepts that are in other laws. So I think we can also draw inspiration and experience from those considerations as well.
Colleen
Yeah. So speaking of drawing on things that people are familiar with, you know, if a company already has CCPA style, you know, sale and sharing workflows... Know I it's early days with this, but do you think those can extend to cover these these rules, or does fair and reasonable change how they think about those workflows of consent?
Loren
Okay. So on the sale and share kind of concept, there's something else that we need to think about. So, yes, there is the fair and reasonable test, but there's also another new test which is... Or another new requirement which is... Relates to the trading of personal information. And what trading means is any sharing of personal information for monetary or other type of consideration or for direct marketing purposes. And it's not prohibited, but you do need to get consent in addition to the fair and reasonable test. I see. So that's another layer, and it means that anytime you're sharing any personal information for direct marketing, and I should say direct marketing includes serving online ads as well, then you do need to get consent. And that consent needs to be voluntary, informed, specific, current, and unambiguous. So the draft itself has not actually explicitly says that this needs to be an active opt in, but the guidance around it says that getting consent through preselected settings or preticked boxes is not going to be enough. So I think when you consider that together with the fair and reasonableness requirement, which also talks about, you know, offering genuine choice to users, then it's very likely that you're going to have to provide an active opt in rather than an opt out for trading of information.
Colleen
Okay. Yeah. I got it.
Loren
Yeah. I would just quickly add also that there is also a requirement for each marketing communication or each ad to be accompanied with information on how to opt out. So as you might imagine, there's been a little bit of concern about how this works in the online ad kind of environment. It's a bit different to, you know, an email footer or something saying click here to opt out. So I have seen actually a number of companies try and push back on this requirement. But if the draft does go ahead as it is, then we're likely going to have to put some kind of opt out or ad choices type link or banner on each online ad.
Colleen
Yeah. So it's so interesting. You know, it's always helpful to apply these kind of these practical use cases, and advertising is, of course, one of them for marketing teams. So even if a marketing team has valid consent, we're saying that they still have to clear that fair and reasonable bar if they wanna serve an ad. So, yeah, how do you even think about that? It's with that. It's with providing just additional kinda choice, this transparency information. That's how you combat that as a marketer?
Loren
Yeah. I think that would be the key things. So the the draft does provide a list of seven factors that you need to think about. We've already talked about some of these things, reasonable expectations, transparency, genuine choice. There's also other things like what's the relationship to your functions or business activities, what's the impact to the individual, and so on. So what I would focus on really in that marketing context is kind of bolstering your arguments on those factors that that you can so that... What really helps, for example, is transparency. So... Especially if the advertising is less obvious. In some context, you know, it's very obvious, you know, we're an advertising supported business where it's serving ads to you. Sometimes it's less obvious, or if you're providing an essential service, it might not be obvious that Right. You know, we're serving ads to you as part of our business. Or if you're using things like cookies, pixels to collect information online, and then using that to serve ads, that's not obvious to everyone. So it's really helpful if you tell people that you are using personal information in this way. And it's not just that you tell them, but it's how you tell them. So it may not be enough just to tuck it away in a privacy policy somewhere as much as it pains me to say this because I spend most of my days writing them. But, honestly, who even reads the privacy policies? Right? So, yeah, you really need to think about how am I telling people about this. Is it obvious? Is it in plain language? Is it understandable? And then the other one is... The other key one I would say is really around that genuine choice factor. So, you know, is it easy to opt out? What alternatives do you have? And, anyway, you might need to do that to satisfy other parts of the law and other laws anyway.
Colleen
I see. Okay. Got it. Alright. So we have this fair and reasonable concept related to that that person's kind of fair notice and choice related to consent. And then we have trading data, which is, again, for familiar context, a little bit more similar to kind of that CCPA concept of do not sell share. So they're equating trading with the sell share of data, right, with third parties. Yep. Okay. Exactly. Following. Okay. Got it. So two new updates there. The other one I wanted to ask you about is the erasure. Right? Seems like there's new Reform around right to erase for the consumer. Can you tell me more about what's the change here? Who does it apply to?
Loren
So this one is... Yeah. This one's a little bit of a tricky one as well, and there is no trigger in that anyone can ask for their data to be deleted. There's not, you know, any particular circumstances that you need to check off in order to be able to ask. The good news is that it only applies to so called large digital platforms. So those are platforms with over 500,000,000 Australian dollars in revenue. I think that's probably around 400,000,000 United States USD, I'd say, or over 2,500,000 monthly users. So, of course, a lot of people are saying, well, why does it only apply to large digital platforms? And and really what the consultation paper that came out with the draft says that the thresholds are designed to capture organizations that are big enough to comply, or they have a really a lot of end users and they handle a lot of Australian special information, so they should need to comply. And I think this does recognize that the right or rather the corresponding obligation to actually delete is quite onerous. So I think it's trying to strike that balance between enhancing individual rights and imposing what is quite a technically and administratively burdensome process on smaller companies. Having said that, there is a catchall that allows the subsidiary regulations to prescribe a specific platform or class of platform as a large digital platform. So it might be that you don't meet either threshold, but you do collect significant amounts of personal information or you're doing something that's a little bit riskier, keep an eye out for the regulations. You might still be caught.
Colleen
Got it. Okay. Very helpful. So high level tour of these news changes in the second tranche. I mean, Lauren, how are your clients feeling about this overall? What's the sentiment in Australia amongst your client base?
Loren
Well, it has been a long time coming, and, honestly, a lot of the changes were already agreed in principle as part of the, you know, the whole process that started five, six years ago. So I think a lot of us were expecting these to happen even earlier than they have. Apart from the the big ones that we've already discussed, there's, you know, heightened consent requirements that we touched on briefly before, additional notice requirements for privacy notice to be clear, concise, readily understandable, new requirements relating to security and breach notifications. So for example, there's now a seventy two hour reporting timeline and requirements to, you know, implement breach response processes and risk mitigation measures in the event of a breach and, you know, a bunch of other things as well. But I think, to be honest, a lot of these things, they either codify existing guidance or kind of case law on concepts that are already in the privacy act, or they're very similar to or aligned with concepts that exist under things like GDPR, CCPA, and so on. So a lot of it is not overly surprising. Having said that, of course, the devil is in the detail, and this is the first time where we've actually seen any drafting around it. And so a lot of companies are still working through the draft and trying to figure out what needs to be done to comply, what do we need to change, what, you know, what processes we might need to put in place. The other thing I would flag is that the the consultation as part of this is also sought input on two other areas that there is no drafting available on yet. So the first one is... Relates to enhancing the regulator's powers. So the... It's proposed that amongst other things, they'll have a broader power to compel assistance in investigations. So, essentially, they can go to anyone to provide assistance, reasonable assistance in the event of any investigations and also to enable more efficient management of representative complaints so the regulator will be able to more easily group and determine similar complaints together. The second one is that the government's also seeking feedback on whether we need additional measures to address the risk of emerging technologies, things like AI, surveillance wearables, and connected vehicles. There's not a lot of detail on what they're looking at here. It's really just a series of questions at the moment, but it will be interesting to see how this one plays out because the privacy act has always been and has been designed to be technology neutral. So whether this would still be principles based in the privacy act or, you know, whether we might see separate legislation on AI, for example, is yet to be seen.
Colleen
Right. And I suppose that's the beauty of something that's holding up since 1988. Right? That's the benefit to keeping it neutral on the tech side.
Loren
Exactly. Exactly. But, of course, you know, in today's day and age, every month, there's some new technology. AI is changing. So, yeah, we'll have to wait and see.
Colleen
Yeah. Interesting. And your comments about the regulator, just investments and, you know, getting reasonable support and grouping complaints together seems to me that they already have an eye towards how they're gonna be enforcing these laws, which is, I guess, depending on your perspective, encouraging or not encouraging, that it looks like they're trying to... They're hoping enforcement will quickly follow. What's your thoughts on that?
Loren
I think so. And because it's not a completely new law and we've been talking about these changes for so long, I do think that the OAIC is gonna move relatively quickly. There's currently no indication of whether there will be a grace period. I think from experience from other recent laws, new laws, or amendments, we might see a grace period of maybe six to twelve months, but that's not guaranteed. And, of course, the regulator can still go and enforce existing provisions of the privacy act. It has stated repeatedly in the past year that it's gonna be taking a more active approach to enforcement, and we have already seen this in action this year. In particular, things like tracking pixels is an enforcement priority as well as other harder to detect privacy activity and harm such as collecting personal information through scraping and other online technologies. The other thing that the OAIC has started doing is privacy compliance sweep. So when they're actually proactively going out looking at privacy policies and other compliance efforts and investigating those. If we do see broadened powers under the latest tranche of reforms as well, then I think we can only expect to see even more active enforcement.
Colleen
Yeah. Now with the sweeps, the way I understand them based on what The US regulators say at conferences I've seen them on stage at is that they... People should pay very close attention to these sweeps because it's a very big signal of what they're gonna be looking at in terms of enforcement coming down. Is it the same for the Australian regulator?
Loren
Yeah. Absolutely. So I think this year was the first time the privacy regulators started doing sweeps. They mentioned last year that they would start. They did the first round early this year, which focused on businesses that actually collect personal information in person. And they did find a lot of noncompliance, and they've indicated that they're gonna keep doing these sweeps and enforcing. So definitely something to look out for. The other thing I mentioned was on that more online side, so tracking pixels, scraping, that kind of thing, and we've already seen a few determinations on that this year. So there were two cases involving tracking pixels. The findings talked a lot about how using tracking pixels to collect information online is considered the collection of personal information even if you're storing the information on third party servers, and it talks about how individuals can be reasonably identifiable, as in that you are collecting their personal information even if you don't actually know who they are specifically as long as you're singling them out or distinguishing them from other people. And that is actually a concept that has been reflected in the latest tranche of reforms and that there's been a clarification to the definition of personal information to make clear that it includes anything that says something about somebody or can be used to single somebody out even if you don't know who the specific person is. The other one that I will just touch on briefly is another landmark case this year which considered the use of dark patterns and online choice architecture as part of the fairness test. And it found that the use of confirm shaming language, so, you know, say using emotive language to make someone feel guilty if they don't provide you with more personal information or biased framing, you know, suggesting that if you give more information, there'll be a better outcome for you, or using things like bundled consent, you know, bundling consent with your t's and c's or for multiple purposes. So this kind of online choice architecture or dark patterns, in this case, contributed quite significantly to a finding that the personal information was not collected by fair means. So I think that's gonna be an indication as well of something that might be considered as part of the fair and reasonable test.
Colleen
Yeah. Certainly. I mean, with such a... I don't know. Fair and reasonable, on one hand, it sounds so, well, straightforward to the basic eye. You could decide what's fair and reasonable, but on the other hand, it's so nebulous. So these these orders, I imagine, are so helpful and these use cases are so helpful to the Australian kind of privacy lead trying to figure out, you know, how they need to change their notices or slap their marketing team on their wrist or what have you. Right? It's very helpful to see the orders.
Loren
Yeah. Exactly.
Colleen
Well, last topic before we get to closing here, Lauren. Such a pleasure talking with you. I know in addition to these... This second tranche of reforms and just the kind of increased regulatory landscape, the more more active landscape in Australia, you mentioned at the top as you were talking through the Australian history of regulation here, these additional add ons coming up quickly. Right? Separate from this new draft, we have a couple things that have already been passed with December dates, that automated decision making rule, and then, of course, that children's online privacy code. For leaders that are doing things in these areas, I'd love to give them kind of a basic idea of what's included in these two items. Can you give us a quick tour? What are they, and who should be paying attention?
Loren
Sure. So the automated decision making, that's transparency obligation. So that will require you to update your privacy policies to include information about what kinds of personal information you're using in ADM and what kinds of decisions you're making using ADM. And that applies to anybody who is using ADM. It sounds relatively simple in that it's just transparency obligation at this stage, but the tricky part is that it's quite broad in terms of scope. So it's not just decisions made solely using ADM, but also substantially and directly using ADM. So it is a bit broader than the formulation under other types of law such as the GDPR. And the guidance, which was just published last week, has made clear that it can capture any automated processes that influence a decision, which is potentially quite a low bar. And secondly, the thing to watch out for is that it doesn't just capture, you know, generative AI or AI powered decisions, but more low tech or everyday automated processes such as, you know, potentially simple word processing tools or preprogrammed rule based processes as well. Having said that, the decision does need to significantly impact an individual's rights and interests. So, obviously, that captures things that relate to, you know, granting benefits like eligibility for housing or access to health care. I think that's more obvious. But if you... Even if you're not doing that kind of thing, don't assume that you're captured. It also extends to things like, for example, if you provide differential pricing for access to significant goods like household essentials. For example, if you show a different price for someone who lives in a certain area because the demographics show that people in that area have more money than people who live in another area. So if you're showing a different price, that could be captured in ADM as well as potentially things like job ads, which target certain demographics. So, you know, if someone's not shown a certain job ad because they're not considered to be within that target demographic, that can be considered ADM. So that's one to really look out for as well. Because if you're using, for example, third party recruitment platforms or software that might be doing these things, you might not even be aware. So if you are using third party platforms that do things like that, always ask the question, you know, what are your processes? What algorithms do you use to serve ads or to serve targeted content? And then if they do use it, then you'll need to disclose it. And I think the guidance that just came out makes it very clear. If in doubt, include it in your privacy policy.
Colleen
Right. Right. Much broader than you might guess. Okay. Very helpful. Yeah. And then this children's privacy code. Yeah. The children and teen privacy topic is just so fascinating now across multiple regimes, and I think the headline is often it... Even if you don't think you're specifically marketing to children or teens, your company may often still be in scope. Right? It's not just kids companies that maybe needs to think about these laws. So Yeah. What's in this Australian order? What's in scope? What should a company that isn't obviously a kids company be thinking about?
Loren
Yeah. Exactly. So it applies to online services, which are likely to be accessed by children or primarily concerned with the activities of children. So you're absolutely right. It doesn't require an active targeting, and that I think is similar to things like the copper as well as The UK's age appropriate design code. The extra limb is that second part, which is services primarily concerned with the activities of children, and these are things like, you know, student management systems or parental control software, family photo sharing apps, connected baby monitors, and things like that. So they may not be targeted or even accessible to the child itself. But if it's handling a lot of children's personal information, then that would be captured as well.
Colleen
Got it, Lauren. And so can you clarify? Because there's so many children. Teens' privacy is lost to remember across the globe. Who qualifies? What's the age for this one in Australia?
Loren
So for this one, the parental consent requirement is for under fifteens, which is kinda confusing because Australia also has other laws that are attached to under eighteens in terms of content, and there's also the social media ban, which applies to under sixteens. So it is a little bit confusing because there's all these different thresholds.
Colleen
I mean, these guys couldn't get together and just make it 15 or 16. Like, come on. You know? It's just... It's something else.
Loren
Yeah. And that's just in Australia where it's going to looking at all the different countries.
Colleen
No. It's crazy. Oh, man. It's something else. Well, it's been such a pleasure chatting with you, Lauren. I I... I'll wrap it up. And... Wow. I mean, if anybody thought the Australian privacy landscape was sleepy, I would direct you to the last thirty minutes because it seems like there's plenty going on to me. As I mentioned at the top, we have so many US listeners. I mean, if a US in house privacy lead is listening to this, they know they have consumers or services they're offering in Australia, what are kinda, like, first priorities? What would you tell them to focus on in light of this recent activity?
Loren
First of all, if you are doing ADM, update your privacy policies. This one is coming to effect in December. And then start to look at your privacy practices more broadly. Are they fair and reasonable? What are you doing in terms of marketing, advertising? Are you trading personal information? And then what other processes and policies do you need to put in place or update? You know, how do you respond to data subject requests? Do you know what to do in the event of a breach? And I think the key is don't wait until it's too late. The OAIC is definitely ready to act, so you need to be too.
Colleen
I love it. Well, very helpful, Lauren. Any any closing words for our listeners as they just add yet another topic under their privacy hat, something else to keep an eye out? Any words of wisdom?
Loren
Just don't forget about Australia. It's right up there on your list of places to look out for and to... The laws to comply with.
Colleen
I love it. Great. Well, Lauren, such a pleasure talking with you. Thank you for taking the time. This has been another episode of the and you've been a lovely guest. So I appreciate you taking the time to join us.
Loren
Thanks. Thanks for having me, Colleen.
