Kylea Tink (North Sydney, Independent) Share this | Hansard source

by leave—I move amendments (1) to (4) as circulated in my name together:

(1) Schedule 2, item 10, page 67 (line 19), after "privacy was", insert "expressly".

(2) Schedule 2, item 10, page 71 (line 13), after "journalistic material", insert "about matters of public interest".

(3) Schedule 2, item 10, page 72 (lines 6 to 8), omit all the words from and including "reasonably believes" to the end of clause 16, substitute:

: (a) reasonably believes that the invasion of privacy is reasonably necessary for one or more enforcement related activities conducted by, or on behalf of, an enforcement body; and

(b) is conducting a lawful investigation in respect of a serious crime.

(4) Schedule 2, item 10, page 72 (line 15), at the end of clause 17, add:

; to the extent that the intelligence agency is conducting a lawful national security operation.

Australia's Privacy Act is not only outdated; it's simply not fit for purpose anymore, and it fundamentally failing to keep up with the rapid rise of technologies that rely on vast quantities of personal information. But given the act was introduced in 1988, prior to Australia even joining the global internet—the same year that the Brisbane Expo, I might add, here in Australia, espoused that by 1988 we would all be living lives of wonderful luxury because the internet would have helped us become obsolete—it's not surprising that this act no longer works.

Fast forward to today, and the reality is that digital technologies are rapidly making all elements of this act almost obsolete. Artificial intelligence has stretched beyond the confines of science fiction. Our biometric data is used by shopping centres for targeted advertising. Our social media photos are used to train AI. Our devices record and often share the details of our daily lives, our habits and our behaviours. I am sure every single person in this room has had that experience where they will have a discussion with someone that they love about something that they might be considering purchasing or doing, only to then to find, when they go onto a social platform on the next iteration on their device, that option is sitting right in front of them amongst its advertising.

Recent major data breaches have definitely raised public awareness and have further highlighted the need for wide-ranging reform of our privacy safeguards. According to the Office of the Australian Information Commissioner, just under half of all Australians say that they were affected by a data breach in the previous year, and three-quarters have experienced harm as a result of that breach. They report having their personal information stolen, being unable to unsubscribe from marketing communications and having to provide sensitive information when they preferred not to. As a result, many are left feeling disempowered, stressed and anxious.

The bill before us then is welcome, particularly the new civil penalties, the pathway towards establishing a children's online privacy code and the statutory tort for serious invasions. However, while the measures in the bill will strengthen Australia's privacy law, this modest legislation alone will not bring Australian privacy law into line with global best practice, and it is disappointing that the government has stopped short of truly modernising our privacy legislation. Ultimately the Privacy Act review report put forward 116 proposals for reform of Australia's privacy framework, of which the government has agreed or agreed in principle to 106. Yet this bill aims to implement just 23 of those proposals. For this reason I will continue to call on the government to introduce the second tranche of privacy reforms before the next federal election.

But dealing with what we have here, among the many shortfalls in this bill are: the absence of a fair and reasonable test for dealing with personal information; no requirement that entities take steps to mitigate harm to individuals following a data breach; no clarification of timeframes for notification of data breaches; and no updated definitions of personal information or consent. Yet one of the most significant reforms that is included in this bill is the introduction of a statutory tort, or a civil wrong, that will allow Australians to sue for damages for serious invasions of privacy and enable courts to award damages, grant injunctions and make a range of other orders. While I do think this is a good development, I am concerned that the proposed exemptions are unnecessarily broad.

Specifically the bill introduces new and broad exemptions for journalists, enforcement bodies and intelligence agencies that deviate from the model proposed by the Australian Law Reform Commission and endorsed by the Privacy Act review. The journalism exemption would exclude any acts ostensibly done while developing journalistic material and would apply regardless of the content or the purpose of the journalism. This would mean that blatantly illegal and unjustifiable infringements of privacy by journalists that are not in the public interest would be exempt from the right of action. This might include illegal phone hacking by a news corporation or upskirting photos taken of celebrities by a tabloid. I can't help but think that many people would rightly expect that this is precisely the type of infringement that this tort should apply to—serious infringements of privacy without a principled justification.

In addition, the exemptions for enforcement bodies and intelligence agencies are unjustifiably broad, in my opinion, given there is a separate defence already for invasions of privacy that are required or authorised by law that would already cover lawful government interference with privacy. The detailed amendments I'm moving today would narrow the journalism exemption to apply to public interest journalism and better clarify the application of the enforcement bodies and national security agencies exemptions. I commend the amendments to the government.

See this speech in context