I move:

That this House:

(1) recognises the Attorney-General's announcement on privacy law reform aimed at strengthening Australia's privacy framework and ensuring it remains fit for purpose in an increasingly digital economy;

(2) notes that the reforms are intended to:

(a) provide Australians with greater control over their personal information;

(b) enhance transparency and accountability in the collection, use, disclosure and retention of personal information;

(c) strengthen protections against interferences with privacy and misuse of personal data; and

(d) improve confidence in the digital economy by ensuring privacy settings and protections keep pace with technological change; and

(3) further notes that the Government:

(a) has undertaken an extensive consultation process on privacy reform, including through the Privacy Act Review; and

(b) is continuing to consult with business, industry groups, consumer representatives, privacy experts, civil society organisations and members of the public to ensure privacy laws can effectively address privacy risks associated with emerging technologies.

Every day, information is collected about us: what we buy, what we look at online, where we go, what interests us and who we interact with. Some of it is particularly personal: our identity, our health, our face and even our precise location over time. One piece of information might not tell you much. Put enough pieces together, and you can build a pretty detailed picture of someone: their habits, their interests, their movements, their preferences and their circumstances.

Increasingly, technology can work things out about us that we actually didn't tell it. We don't necessarily hand over the picture; we hand over the pieces. Technology can put together that picture, and that picture can be valuable. It can help businesses understand us, reach us and target us with advertising. Sometimes that is useful. But our personal information can also be sold, traded for money. Information about us can become a product. That is why having some control matters and why businesses, particularly large businesses holding huge amounts of information about Australians, need to be disciplined about how and what they collect and what they do with it. Do you need it? Do you need all of it? What are you using it for? Would the reasonable person expect that? Did they actually have a real choice? Those are some pretty basic questions, and they sit at the heart of these reforms.

The main change is the new fair and reasonable test. If an organisation collects, uses or shares your personal information, what it does must be fair and reasonable. It has to consider things like whether an ordinary person would expect it, whether it could do the same job with less personal information and whether the person had real, genuine choice. In simple terms, just because you can collect information doesn't mean you should.

The reforms also make consent mean more. We all know the routine: pages of terms and conditions, a tick box at the bottom, and you just click 'I agree'. Sometimes the box is even already ticked. Sometimes a whole lot of different permissions are all bundled together, and you're supposed to be consenting to a whole lot of things at once. That can look like consent without giving people much of a real choice. Under these reforms, consent has to be voluntary, informed, current, specific and clear. Pre-ticked boxes and bundled consent may not meet that standard. If you need my consent, get my real consent. That matters particularly when money is involved. The proposal says that an organisation generally cannot trade your personal information without your consent. Put plainly, if you're going to sell my personal information, I should know about it, and I should have a real say.

The reforms also include a right to erasure. That is important. Large digital platforms can build up a lot of information about a person over time. Australians should have a way to say, 'I don't want you holding this information about me anymore,' particularly if they're leaving a platform. The proposal would give people the right to ask large digital platforms, including social media and search platforms, to erase their personal information. Australians strongly support that idea. Ninety-three per cent support a legal right to request deletion of their personal information. There are sensible limits, of course. This isn't a way to erase legitimate journalism or news reporting, and there is an exception where raising the information is technically impossible or infeasible. But the principle is right: if a large platform holds information about me, I should have a meaningful right to ask for it to be erased.

The reforms also deal with new technology—AI, facial recognition, smart glasses and connected vehicles. The technology changes; the basic rules shouldn't. Then, when things go wrong, organisations need to act quickly. Eligible data breaches would have to be reported to the Information Commissioner within 72 hours so that people can take steps to protect themselves from scams and identity theft. ID lock will also give Australians a practical way to protect their identity. Through MyGov, people will be able to block, unblock and monitor the use of their eligible identity documents through the document verification service.

These reforms are out for consultation at the moment, and we need to make sure they'll work in practice. The opinion of businesses and Australians is really going to matter and inform this, and we also need to get the balance right. What we're trying to achieve is not complicated. Living a modern life means that information about us will be collected. It shouldn't mean losing all say over what happens to it, though. If you collect our information, treat it properly. If you want to sell it, get our real consent. If you hold it, keep it safe. Where Australians have the right to ask for it to be erased, respect that choice. Our personal information is valuable. Some of it is precious. Those we trust with it should treat it that way.

I commend the Attorney-General and her wonderful office for the incredible work they've done on this proposal, and I encourage all Australians interested in this policy to have their say as part of the process.

Is the motion seconded?

I second the motion and reserve my right to speak.

I thank the member for Deakin for bringing this motion to the House. Privacy law reform is overdue. The Privacy Act review reported to the government back in 2023, and the first tranche of reforms passed in 2024. Since then, Australians have been waiting for the second tranche, the part that actually deals with how organisations collect, use and disclose personal information. In the meantime, emerging technologies like AI are consuming data at an ever-increasing rate. Three years between identifying the problem and legislating a serious fix is too slow for an issue that's moving this quickly.

The Attorney-General has finally released the exposure draft of that second tranche for consultation, and submissions close on 18 September. This is a meaningful step forward. There's a right to erasure from large platforms, stronger and more meaningful consent standards, new limits on trading personal information without permission and a mandate to make the privacy regulator more efficient.

Each of these deserve scrutiny in their own right, but I want to use this time today to focus on two issues: the importance of the 'fair and reasonable' test and the continuing exemption of political parties from privacy laws. On the 'fair and reasonable' test, here's the problem that we're trying to solve: Australia's Privacy Act was built for a world of discreet data collection—a form filled out here, a subscription signed up to there. It wasn't built for a world where AI systems ingest billions of data points to train models and where consent is buried in terms and conditions that nobody reads.

Under the current law, if a company gets your consent, it can generally use personal data however it wishes. Consent buried deep in 40 pages of terms and conditions means a company can sell your data or use it however it wants. That is not meaningful consent. Most Australians have no idea how their data are being used and no practical way to stop it. Earlier this year, my office ran a community survey across Curtin, asking residents about their views on AI. Privacy came through as one of the issues people are most worried about.

The fair and reasonable test adds a second requirement on top of consent to ensure the use of personal data must also be objectively fair and reasonable. In practice, this would stop an AI company from training a model on someone's health records, financial information or private communications based on a permission buried on page 40 of a terms of service document. Getting the drafting right is only half the job. A fair and reasonable test is only as strong as the regulator enforcing it, and the Office of the Australian Information Commissioner has been underresourced for years. If we pass a stronger standard, we also need adequate funding for enforcement at the same time.

The second issue I want to raise is the ongoing exemption of political parties from privacy laws. I've previously drawn attention to the deceptive practice of political parties using the postal voting process to harvest personal information. In my electorate of Curtin and across the country, before the last election the Liberal Party sent out what looked like an AEC form to apply for a postal vote with an envelope enclosed addressed to the processing centre, which makes it sound like it's going to the AEC. This actually goes to a Liberal Party controlled PO box where the Liberal Party presumably records all the data—name, address, phone number, email address, secret question and answer—and then forwards the forms on to the AEC. We have no idea how they use that data. It would almost certainly be added to the Liberal mailing lists, but it may also be sold, and that would all be within the current rules. Both parties do this, and the AEC hates it.

The AEC is one of our most trusted institutions, and postal voting is increasingly common. Political parties should not be able to insert themselves into this process and benefit from data harvesting. They can currently do this because they've exempted themselves from privacy laws. When it comes to privacy, the same rules should apply to political parties as any other organisation, but getting them to agree to this will take a lot of public pressure.

In short, I'm pleased to see the fair and reasonable test and other overdue improvements to our privacy laws. The OAIC will need greater resources to actually enforce them, and there's further work to do when it comes to actually requiring political parties to protect personal data.

I'm pleased to rise to speak in support of this motion, which addresses the significant reforms being proposed to Australia's privacy framework recently published as the second tranche of reforms. The reforms proposed are significant, but they need to be. They need to be decisive and seek to fairly and comprehensively address the immeasurable complexities that we are now faced with as we live and work firmly in the digital age, an age that is constantly changing, constantly evolving and constantly moving the goalposts with respect to how we manage risk.

In my prepolitics career as a lawyer, I held the role of privacy officer at one of the organisations I worked for. This involved becoming very familiar with the Australian Privacy Principles and advising different business units on their obligations and compliance strategies. This was at a defence organisation, and I can tell you that balancing personal privacy obligations with national security obligations left me needing a lie down with a cold face washer over my forehead some days after work. This was during the digital age, but it was before the onslaught of the digital era and before the genie started to emerge from the bottle with respect to AI.

There are two aspects of the reform that I think are worth focusing on and which were of great interest to me. The first is the right to erasure. The new reforms will introduce a right to erasure for individuals whose personal information is held by a large digital platform, which are providers of social media, relevant electronic or designated internet services that meet one or both of the following thresholds: gross revenue of at least $500 million for the business, including overseas entities, and/or at least 2.5 million average monthly end users in Australia. Large digital platforms must, if requested, destroy the personal information, give written notice of the outcome within a reasonable period and explain any exemption relied on, noting that there are exceptions and that they are, in my view, reasonable as they include permitted general or health situations or legal retention requirements.

Large digital platforms will need to be on notice of this because of the other highly relevant change, which is a definition change in respect of personal information from information 'about' an individual to information that 'relates to' an identified or 'reasonably identifiable' individual. Australians should take note too. This represents a significantly broader protection for you and your interactions with a large digital platform. Is it going to be easy to implement for these platforms? Maybe not. But is it a path we must pursue because of the protections offered to Australians? Yes, it is.

The second change proposed by these reforms that piqued my interest is the introduction of the fair and reasonable test with respect to the collection, use and disclosure of personal and sensitive information, which was previously subject to three different tests. The new, proposed test is whether the collection, use and disclosure of personal or sensitive information is fair and reasonable in the circumstances and lawful. This is significant because, currently, companies and organisations, including the one that I used to work for, would rely on privacy policies and procedures, together with consent and collection notices, as the main compliance tool in their toolkit. Consent was sometimes offered on a 'take it or leave it' basis, as in 'give consent or you, as the employee, won't be able to do something or access something'. In that sense, it was a limitation on an employee's role unless they gave consent, which could be unnerving, particularly with respect to sensitive information.

Companies can still go down this path, but the proposed reforms present an extra protection, because, even if an employee gives consent, the collection, use or disclosure will need to also be fair and reasonable in the circumstances. For most companies most of the time, this won't be an issue. Things companies are currently doing in the collection, use and disclosure space will already be fair and reasonable in the circumstances and most likely completely lawful. But, if they are not, a company will now have to reconsider their position and, in doing so, that previous limitation I spoke about for the employee will fall away. This is a fair and reasonable test condensing three different tests into one and providing extra protections for employees of organisations. Guidance will be provided as to what qualifies as fair and reasonable, with an emphasis on data minimisation, choice and proportionality.

These are significant reforms, and I commend the government and the Attorney-General for taking this on, given its substantial impact on the Australian people.

I rise to speak on this motion in relation to privacy law reform. From the many listening posts and engagements I have out in the community, it's very clear that the people of the southern Gold Coast consider their privacy to be one of the most important concerns that they have, especially in this day and age, as we see the rise of artificial intelligence and of new technologies. So it is fitting that we are having a discussion on privacy law reform. It is definitely something that we need to consider in this place. In fact, I'd say it is well overdue. Look at some of the advancements in technology. Smart glasses, for example, have been available in this country since 2023, yet it's taken until 2026 for the Attorney-General to ask the privacy commissioner to urgently examine the issue. We can't be behind the cart on this. We need to be taking the initiative and being proactive in this place.

I'm going to speak to this motion, and there are a few parts that I'd like to touch on. Firstly, the coalition does support strong privacy protections and laws that are going to keep pace with the rapid evolution that we are seeing in the AI and tech space. There is no doubt about that. The government has released an exposure draft of these further Privacy Act reforms, and we will consider that, but we're going to consider that carefully because, as we know when it comes to this government, the devil is always in the detail. There are already concerns that are being raised by industry and by businesses, and we will take those on board.

This motion congratulates the government on undertaking an extensive consultation process. I think we need to unpack that and we need to be a little bit honest and not stretch the truth here. This exposure draft was released on 31 August, and submissions are closing on 18 September. That's less than three weeks for stakeholders and businesses to work through what is a substantial and technically complex legislative package. If, by an extensive consultation process, this motion is referring to that three weeks, I say that I think the government needs to reconsider its wording.

The other point I want to make is in relation to the burden this legislation could put on small business. Small businesses, as we all know in this place—we say it every day—are struggling at the moment. We're seeing record insolvencies across the place. I represent an electorate with more than 20,000 small businesses, and they are doing it tough, quite frankly. Part of the issue for them, even if we put cost of living to the side, is the fact that they are being tied in knots when it comes to regulatory complexity. And in relation to any privacy law reform we need to make sure the government is up-front and honest with small businesses about who is going to, firstly, cover the cost of the reform and, secondly, have to deal with the regulatory burden of it. If history is anything to go by, under this government, small businesses aren't going to be better off as a result of these reforms, and they can't, in the middle of a cost-of-living crisis, be burdened with the compliance costs and the time costs of complying with these reforms.

So any legislation needs to be very clear—and we will be keeping a very close eye on this—about who's going to be responsible for those various elements of compliance and costs. I say that because small businesses shouldn't be dragged into an environment that's more complex and expensive. I visited a small business in my electorate recently—actually, it's not a small business anymore; it's progressed a little bit past that, which is fantastic. It's a technical business, and they have 50 per cent of their staff employed for compliance. This is a business of about 45 people. So we have to make sure that with the decisions in this place—even if they are motivated by good intentions and wanting to make sure that, as a country, we are complying with our privacy obligations—small businesses aren't going to have to bear the brunt of that.

So I say to the government, this is a conversation we should be having. It is. But we need to go about it in the right way. We need to make sure that meaningful consultation is in fact meaningful consultation. And those on this side of the parliament will hold those on that side to account. It is something that is so important to the people of the southern Gold Coast and around the country.

I rise to support the motion moved by the member for Deakin on strengthening Australia's privacy protections. Privacy is not an abstract issue. It is about whether Australians can go about their daily lives confident that their identity, personal information and movements will not be exploited without their knowledge or consent. It's about dignity. It's about security and giving people genuine control in a fast-changing digital world.

I know how important these protections are to the people of Barton, and I thank the residents who have contacted my electorate office to share their concerns. Those concerns range from the use of AI-enabled smart glasses and other wearable devices to identity-based scams to the excessive collection of personal information. In our local community we have seen scammers particularly target older and vulnerable Chinese residents through identity traps, false threats, and deceptive emails and text messages.

In response, I partnered with St George Police Area Command, Westpac, Commonwealth Bank and CASS to deliver an anti-scam forum. The aim was very practical: to help residents recognise warning signs, protect their personal information and avoid falling victim in the future. We were pretty much blown away by the number of people who wanted to attend and who were seeking in-language advice on the traps that they had seen themselves or had seen their friends fall a victim to.

Community education matters, and I'm happy to play a small role in delivering it. But we also need legislative reform. Governments, businesses and digital platforms must build stronger protections into the systems Australians rely on every single day. That is why I welcome the government's introduction of IDLock, a new digital identity protection service that will be available securely through myGov. IDLock will enable Australians to block, unblock and monitor the use of eligible identity documents through a document verification service. It's designed to help prevent compromised documents from being used fraudulently and to give people greater control before harm occurs, not simply assist after the damage has been done.

The proposed privacy reforms also include a right to erasure for personal information held by large digital platforms. In practical terms, this would allow Australians to ask those platforms to destroy their personal information, and that matters when social media and search platforms can retain detailed profiles of our interests, behaviour and online activity long after we've forgotten what we shared. The reforms would also establish stronger and more meaningful standards for consent. Consent should be voluntary, informed, specific and unambiguous, not buried in pages of terms and conditions or extracted through a take-it-or-leave-it approach. Australians should understand what they are agreeing to and have a genuine option to say no.

Importantly, the reforms would stop businesses trading in personal information without clear permission. Shopping habits, online interests and location data should not be bought and sold behind Australians' backs. The proposed fair and reasonable test would also require organisations to justify why they collect and use information, rather than gathering more data simply because technology allows them to do so.

At a time when many Australians feel that surveillance is all around them and that private information can be reduced to a dollar figure, these reforms are both practical and very much principled. They respond to immediate threats from scams, identity crime, data breaches and emerging technologies, while affirming a basic standard that personal information belongs first and foremost to the person it describes. Australians should not have to surrender their privacy to participate in modern life. They should be able to use digital services, walk down the street, shop online and communicate with their family without really wondering who is collecting their information, how it would be used or who might actually profit from it.

Our government will continue to put the digital safety of individuals ahead of unchecked profits, opaque data harvesting and the interests of those who record or track people without meaningful consent. I commend the motion.

It is a pleasure to be here on a Monday night to discuss this important issue. I reflect on the member for McPherson's contribution on the importance of privacy to his constituents, and so it is with mine. Australians rightly expect that their personal information will be treated with care and properly protected. I think that is even more so in times where the unfortunate reports of data hacks and digital disruption are more and more frequent and, indeed, more and more damaging because of the sensitive information that is held en masse by so many different actors across the digital economy.

At the outset, I do need to affirm that we do support strengthening privacy protections and changing the law to ensure that it keeps pace with rapid technological change. On that, the government has released this exposure draft of further Privacy Act reforms, and what we've come to realise with the Albanese government is that the devil is usually—in fact, it is always—in the detail. So where those concerns are raised by businesses, industry bodies, privacy experts and consumers, we will want to see those concerns reflected and ameliorated in the legislation that ultimately goes through this place. We will not be giving a blank cheque to the Labor Party simply because it claims to have extensively consulted on these reforms.

Let's not forget that the exposure draft was released on 31 August and submissions closed on 18 September, giving stakeholders less than three weeks to work through what is a substantial and technically complex package. It's a very short consultation period when you consider the very significant new legal, regulatory and compliance obligations that the legislation might well impose on Australian businesses. The context is that small businesses in Australia are going to the wall at a record rate. They are drowning in red tape, regulation and economic headwinds from high inflation, higher interest rates and the loss of discretionary spending through the economy. So, whilst the Labor government is congratulating itself on this extensive consultation, we are talking to small business and family business owners across the economy who are doing it very, very tough indeed. It must be a consideration every time the bells ring in this place that another business doesn't die.

We expect the government to be upfront about the cost of these reforms for small and family businesses, because those compliance costs, the additional administrative burden and indeed the potential legal uncertainty are really, really important when you consider that those small businesses are already dealing with rising costs and increasing regulatory complexity, in no small part due to the 400 new laws this government has passed and the introduction of things like scope 3 climate reporting. At the end of the day, these businesses are being asked to endure ever-increasing compliance burdens, and, at this stage, the legislation before us for privacy law reform doesn't indicate a clear understanding of the impact on those businesses. So before parliament is asked to pass these laws or, indeed, any other, the government should be providing a clear assessment of the likely costs and the implementation requirements for all stakeholders.

Small businesses, family businesses and medium-sized businesses shouldn't be dragged into a more complex and more expensive privacy regime because of the data practices controlled by large third-party platforms or technology providers. We've got to target these sorts of reforms at the cause of these sorts of issues: those data leaks and the loss of confidence that Australian consumers have in the protection of their privacy and their personal information. The responsibility, therefore, should sit with the businesses that actually collect, control, analyse and very often commercialise that personal information, rather than the poor souls who are just trying to keep their heads above water in so many sectors of our economy.

The coalition is also concerned that the exposure draft doesn't establish specific protections governing the sorts of technologies like smart glasses or other wearable technologies. Australians need—and, I think, expect—clear rules about their use, particularly in places where people ought to expect privacy. And, of course, it is unfortunate that time and time again we see the exploitation of our society's most vulnerable where they lack those protections.

In a world where our personal data is increasingly being harvested, commercialised and sold for profit, Australians very much value their privacy. The 2026 Australian Community Attitudes to Privacy survey found that 93 per cent of Australians say protecting personal privacy is important. However, 78 per cent also reported that they feel they have little or no control over how their information is collected or used, and 73 per cent reported at least one privacy related concern in the last year.

Our data is harvested and used in so many ways. Frequent flyer schemes record what we buy, how often and where we shop. Data brokers sell lists of contact details for cold calling. Biometric data such as fingerprints, facial recognition and iris patterns are harvested to assist in access to online services such as banking, and doxxing is used to threaten, intimidate or punish. Every online shop wants your personal details, a credit card, a username and password to set up an account, and every time I log on I have another red flag telling me that data for one or more of these accounts has been caught up in a data breach.

The changes to privacy legislation currently being consulted on by the Attorney-General are really important for keeping us safe, but I want to talk in particular about e-glasses. Now, we've all seen the media about the negatives of e-glasses—creeps, pervs and people being filmed without their knowledge or consent—but there is another side of e-glasses, a positive side. I happened to be sitting next to Damian Papps, the CEO of the Royal Society for the Blind's See Differently in South Australia, at a recent guide dog graduation ceremony. He said to me, 'A guide dog can help you get to the supermarket, but it can't tell you that that's a tin of tomatoes in front of you on the shelf or what it costs.' So I asked him to write to me as part of this consultation, and I'm going to read out some of what he said.

He says: 'I am writing to highlight the transformative potential of smart glasses for Australians who are blind or vision impaired and to encourage consideration of how emerging artificial intelligence technologies may enhance independence, participation and inclusion for people living with vision loss. While these glasses were originally developed as a consumer technology product, they are increasingly being recognised internationally as a powerful accessibility tool. Equipped with a camera, voice controls, open-ear speakers and artificial intelligence, the glasses can describe a person's surroundings, read text aloud, identify objects, provide contextual information, and connect users with remote assistance, all while remaining hands-free. For many people who are blind or have low vision, the glasses can support everyday tasks that sighted individuals take for granted, such as reading mail, menus, signs and notices; identifying household items, food products and packaging; receiving descriptions of surroundings and objects; accessing real-time assistance without needing to handle a phone; staying connected through voice messaging and calls; and supporting independent travel and navigation when used alongside traditional mobility aids. These glasses are already being trialled overseas with great success. One Vision Ireland participant Brian Manning described the impact by stating: "What I really like about the glasses is the speed at which I get the information I need. Instead of waiting for someone to read a letter or tell me what I have in the fridge, I'll just do it on impulse. Now I'm doing things for myself independently that maybe before I wouldn't have done." Meta has made Ray-Ban Meta glasses available free of charge to more than 130,000 legally blind veterans across the United States. Blind veteran Don Overton spoke about the effect of technology on his independence: "The moment I put these glasses on, I instantly realised this was revolutionary."'

Damian Papps says: 'For many Australians living with disabilities, one of the greatest barriers is not mobility but access to information. Beyond vision loss, e-glasses can also transform access to information and learning for people with low literacy, dyslexia or other barriers. Reading printed material, processing written information, recalling instructions, completing educational tasks, understanding complex documents and navigating unfamiliar environments can present significant challenges. The ability of AI-powered smart glasses to listen, interpret, describe, explain and respond in real time has the potential to fundamentally change how people access information and participate in education, employment and community. Perhaps the most powerful outcome is the increased independence these technologies can provide.'

I'd like to commend the Attorney-General for putting the proposed privacy changes out to consultation so that the disability community can ensure that a valuable accessibility tool is appropriately dealt with in any resulting legislation.

Can I start by thanking the previous member for that wonderful contribution. As the shadow assistant minister for disability, I think it's important that we get the balance right when we're dealing with this sort of new technology, because these innovative new products can, of course, create great threats for people that we represent but also can open up some significant doors. Of course, the glasses are just the first iteration. Who knows what's next around the corner? So we've got to make sure that, when we are legislating, we are taking in all factors and considering what it's going to mean for every Australian.

I want to touch on some of the conversations that I've been having with my constituents about privacy. I think I wouldn't be alone here. I think every member of this place would have had a number of constituents reach out to them in relation to the big data breaches that we've seen recently from some of Australia's biggest companies. The concern that these individuals had about what had occurred to them and their family members was significant, and it's important that we take a holistic approach to dealing with this issue. But there are also individuals that we see whose privacy has been breached not through some big hack that's occurred in corporate Australia somewhere but just through having their identity stolen through their email or a password that's been copied. It's an area of significant concern for a lot of Australians. Often it's something you don't think about until it happens to you, but it's important that we get the legislation right and ensure that we do all we can to protect Australians.

Australians rightly expect that their personal information will be treated with care and properly protected. The coalition supports strong privacy protections and laws that keep pace with rapid technological change. That's, of course, the inherent challenge for government in dealing with this issue, because as quickly as we can sometimes move in this place it's never going to be quite as quick as the technological changes that we're seeing. The government has released an exposure draft of further Privacy Act reforms, and the coalition is going to be considering those very carefully, including the concerns being raised by business, industry, privacy experts and consumers.

What we are a bit concerned about is the pace of the consultation at the moment. It's important that we're talking to all levels of Australians, all interested parties, and ensuring we get the right outcomes here. What we don't want to do is give Labor a blank cheque simply because it claims to have consulted. The exposure draft was released on 31 August, with submissions closing on 18 September. That's fewer than three weeks for stakeholders to work through a substantial and technically complex package. That's a very short consultation period for reforms that could impose significant new legal, regulatory and compliance obligations on Australian businesses.

I've noticed a concerning trend with this government, where we're seeing shorter consultation periods. Particularly when they are consulting with members of the business community or other experts, we're often seeing the advent of non-disclosure agreements being signed in the course of that consultation, which makes it very difficult for those representing big organisations to go back and consult with those within the organisation who might have the answers that the government's seeking.

The other concern that we have on this side is that the government needs to be upfront about the cost of these reforms for small and family businesses. I'm sure many of the members here have been consulting with small businesses across their electorates. They know how difficult it is at the moment. A lot of small businesses in my electorate are going to the wall. Certainly, I'm noticing a massive collapse in confidence. It seems to me that whenever I'm speaking to a small business in the Redlands they outline different growth opportunities that they might have, but the general sense is that they can't risk putting on new staff and it's all become too complex and expensive.

Small businesses have been burnt by additional Albanese government regulation in the past and have been left to foot the bill. Small businesses cannot afford to be burdened with the cost of these reforms, and any legislation must explicitly tell businesses how much it will cost them. The coalition is particularly concerned with the interaction between the proposed reforms and the existing small-business exemption. Small businesses should not be dragged into a more complex and expensive privacy regime, because of data practices controlled by large third-party platforms or technology providers. Responsibility should sit with those businesses that actually collect, control and commercialise personal information. They're the key factors that we're interested in protecting as we proceed with this legislation.

The time allotted for this debate has expired. The debate is adjourned and the resumption of the debate will be made an order of the day for the next sitting.