Privacy law reform on the agenda, again

Attorney General Roxon's Media Release yesterday about privacy law reform received a good run in the media but the detail will only be apparent when the legislation foreshadowed for the winter sittings is introduced. The Senate Finance and Public Administration Committee made 59 recommendations in its reports last year on the  Exposure Draft of the Australian Privacy Principles. and the Exposure Draft on Credit Reporting and there were plenty of other suggestions raised in consultations. The Attorney's release doesn't go into explanation of what has been accepted or rejected, simply listing these benefits to consumers:

• clearer and tighter regulation of the use of personal information for direct marketing
• extending privacy protections to unsolicited information
• making it easier for consumers to access and correct information held about them
• tightening the rules on sending personal information outside Australia
• enhancing the powers of the Privacy Commissioner to improve the Commissioner’s ability to resolve complaints, conduct investigations and promote privacy compliance

The Government will also modernise credit reporting arrangements. Benefits for consumers include:

• making a clear obligation on organisations to substantiate, or show their evidence to justify, disputed credit listings
• making it easier for individuals to access and correct their credit reporting information
• prohibiting the collection of credit reporting information about children
• simplifying the complaints process by removing requirement to complain to the organisation first, complaints can be made directly to the Privacy Commissioner, and by introducing alternative dispute resolution to more efficiently deal with complaints."

In a separate release Australian Privacy Commissioner Timothy Pilgrim elaborated on what the proposed extension of his powers will allow:

• Accept a written undertaking from an organisation that they will take or refrain from a specified action. This will be enforceable in the Federal Court or Federal Magistrates Court.
• Make a determination following an investigation conducted on the Commissioner’s own initiative. Currently, the Act only allows a determination to be made when investigating a complaint from an individual about an act of practice.
• Seek civil penalties in the case of serious or repeated interferences with privacy.
• Conduct performance assessments of private sector organisations handling personal information. Currently the Commissioner can only conduct audits of government agencies and credit reporting agencies.

I'm sure the Attorney General didn't mean to make it sound as if this is game set and match on privacy law reform:

These changes.... will implement the Government’s response to the Australian Law Reform Commission’s report – For your information: Australian Privacy Law and Practice."

The first stage response more like it.

As the government said way back in 2009 a whole raft of other ALRC recommendations were to be considered in stage two including exemptions generally and in particular removal of exemptions for small business and political parties and tightening up the media exemption; mandatory data-breach notification; a statutory cause of action for serious invasions of privacy (on which there has been a consultation of sorts); telecommunications privacy; decision making issues (such as authorised representatives and children’s privacy); and further national harmonisation. We aren't anywhere near done with a process that kicked off in 2006 with the reference to the ALRC.