Jenny McAllister (NSW, Australian Labor Party, Minister for Emergency Management) | Hansard source

I table a supplementary explanatory memorandum relating to government amendments to be moved to the bill. I seek leave to move government amendments (1) to (8) on sheet SY115 together:

Leave granted.

I move:

(1) Schedule 1, item 7, page 6 (after line 29), after section 63D, insert:

63DA Information that must not be collected

(1) A provider of an age-restricted social media platform must not collect information:

(a) for the purpose of complying with section 63D; or

(b) for purposes that include the purpose of complying with section 63D;

if the information is of a kind specified in the legislative rules.

Civil penalty: 30,000 penalty units.

(2) Before making legislative rules specifying a kind of information for the purposes of subsection (1), the Minister:

(a) must seek advice from the Commissioner, and must have regard to that advice; and

(b) must seek advice from the Information Commissioner, and must have regard to that advice.

(3) Section 63D does not apply to the provider of an age-restricted social media platform if, because of legislative rules made for the purposes of subsection (1) of this section, there are no reasonable steps that the provider could take in order to comply with section 63D.

Note: In proceedings for a civil penalty order against a person for a contravention of section 63D, the person bears an evidential burden in relation to the matter in this subsection (see section 96 of the Regulatory Powers (Standard Provisions) Act 2014).

63DB Use of certain identification material and services

(1) A provider of an age-restricted social media platform must not:

(a) collect government-issued identification material; or

(b) use an accredited service (within the meaning of the Digital ID Act 2024);

for the purpose of complying with section 63D, or for purposes that include the purpose of complying with section 63D.

Civil penalty: 30,000 penalty units.

(2) Subsection (1) does not apply if:

(a) the provider provides alternative means (not involving the material and services mentioned in paragraphs (1)(a) and (b)) for an individual to assure the provider that the individual is not an age-restricted user; and

(b) those means are reasonable in the circumstances.

Note: In proceedings for a civil penalty order against a person for a contravention of subsection (1), the person bears an evidential burden in relation to the matter in this subsection (see section 96 of the Regulatory Powers (Standard Provisions) Act 2014).

(3) This section does not limit section 63DA.

(4) In this section:

government-issued identification material includes:

(a) identification documents issued by the Commonwealth, a State or a Territory, or by an authority or agency of the Commonwealth, a State or a Territory (including copies of such documents); and

(b) a digital ID (within the meaning of the Digital ID Act 2024) issued by the Commonwealth, a State or a Territory, or by an authority or agency of the Commonwealth, a State or a Territory.

(2) Schedule 1, item 7, page 7 (line 1), omit the heading to section 63E, substitute:

63E Delayed effect of requirement to take reasonable steps to prevent age-restricted users having accounts

(3) Schedule 1, item 7, page 7 (line 6), omit "earlier", substitute "later".

(4) Schedule 1, item 7, page 9 (line 9), after "section 63D", insert "or subsection 63DA(1) or 63DB(1)".

(5) Schedule 1, item 7, page 9 (line 27) to page 10 (line 12), omit section 63J, substitute:

63J Platform provider notifications — failure to take reasonable steps

If the Commissioner is satisfied that the provider of an age-restricted social media platform has contravened:

(a) section 63D (failing to take reasonable steps to prevent age-restricted users having accounts); or

(b) subsection 63DA(1) (collecting information); or

(c) subsection 63DB(1) (identification material and services);

the Commissioner may:

(d) prepare a statement to that effect; and

(e) give a copy of the statement to the provider of the platform; and

(f) if the Commissioner considers that it is appropriate to publish the statement—publish the statement on the Commissioner's website.

63K Platform provider notifications — privacy

If the Information Commissioner is satisfied that the provider of an age-restricted social media platform has used, disclosed or failed to destroy information in a way that is taken to be an interference with privacy under subsection 63F(1) or (3) (privacy), the Information Commissioner may:

(a) prepare a statement to that effect; and

(b) give a copy of the statement to the provider of the platform; and

(c) if the Information Commissioner considers that it is appropriate to publish the statement—publish the statement on the Information Commissioner's website.

(6) Schedule 1, item 13, page 11 (after line 3), after paragraph (da), insert:

(daa) section 63DA;

(dab) section 63DB;

(7) Schedule 1, page 11 (after line 4), after item 13, insert:

13A After section 222

222A Liability for damages — Information Commissioner

The Information Commissioner is not liable to an action or other proceeding for damages for, or in relation to, an act or matter in good faith done or omitted to be done:

(a) in the performance or purported performance of any function; or

(b) in the exercise or purported exercise of any power;

conferred on the Information Commissioner by or under this Act.

(8) Schedule 1, item 16, page 11 (lines 13 to 21), omit section 239B, substitute:

239B Review of social media minimum age framework

(1) Within 2 years after the day section 63D takes effect in accordance with section 63E, the Minister must cause to be conducted an independent review of the operation of Part 4A.

(2) Without limiting subsection (1), the review must include consideration of:

(a) the adequacy of privacy protections in, and in relation to, Part 4A; and

(b) any other matters relating to the operation of Part 4A determined by the Minister.

(3) The Minister must cause to be prepared a written report of the review.

(4) The Minister must cause copies of the report to be tabled in each House of the Parliament within 15 sitting days of that House after the day on which the report is given to the Minister.

Keeping Australians safe online is a top priority for the Albanese government. We are focused on positive solutions to issues of national concern, and the issue of harms to children and young people from social media is right up at the top of that list.

These amendments provide additional privacy-enhancing measures to part 4A of the Online Safety Act 2021. In practical terms, these amendments mean that no Australian will be forced to use government identification, including digital ID, for age-assurance on social media. This will give Australians confidence regarding the impact of the social media minimum-age obligation on their personal information. It does this through supplementary amendments. The first is a new section 63DA. This provides for the Minister for Communications to make legislative rules to exclude certain types of information being collected and used by platforms for the purposes of a minimum-age obligation. A breach of this provision gives rise to significant penalties.

The rule-making power enhances the privacy of users and their information. It gives the minister the discretion to prohibit the collection of specified kinds of information, subject to advice from both the eSafety Commissioner and Information Commissioner. This is an important change and will ensure the legislation continues to meet community expectations as technology evolves.

This is complemented by a new section 63DB. This new section provides that platforms must not collect identification issued by government or require the use of an accredited service, within the meaning of section 9 of the Digital ID Act 2024, as the only means of age-assurance to comply with the minimum-age obligation. To promote user choice and an inclusive set of assurance options, age restricted social media platforms will only be able to use government issued identification or accredited services under the Digital ID Act 2024 information or material if other alternative age assurance methods have been provided to users. Additionally, the bill expands on Australia's privacy framework by giving the information commissioner oversight over the privacy related aspects of the minimum age obligation. The Office of the Australian Information Commissioner is best placed to ensure that privacy provisions are administered consistently and robustly.

Finally, any breaches of these proposed amendments give rise to significant penalties—a maximum of 30,000 civil penalty units, currently equivalent to $9.9 million, or 150,000 penalty units, currently equivalent to $49.5 million, if the provider is a body corporate. The penalty amounts are intentionally large. This reflects the important privacy implications of the provisions. It also sends a strong signal to social media platforms: treat Australians' privacy seriously. Australia has consistently paved the way in global online safety. These supplementary amendments will strengthen the already robust and strong privacy arrangements included in the original bill.