Key Insights on Data Privacy and Regulatory Convergence

The Law Council recently hosted an event talking with our three commissioners responsible for overseeing the management of information here in Australia. An impressive panel of individuals who have a passion for what they do and have a strong command of the challenges we are facing. The event highlighted significant changes in privacy law over the past decade, emphasizing increased penalties, the expansion of the credit reporting system, and notable data breaches that have shaped current practices.

The speakers were our three information commissioners

• Carly Kind - Australian Privacy Commissioner
• Angelene Falk - Australian Information Commissioner
• Elizabeth Tydd - Freedom of Information Commissioner

The event was hosted by Olga Ganopolsky whom I had the great pleasure of working with while we were both at Veda and someone instrumental in instilling in me the importance of data privacy and the role that effective policies and procedures play. Olga is the Chair of the privacy law committee at the Law Council.

I would strongly advise you to take the time to watch the video but in the meantime, here is a quick summary.

Privacy Law Evolution

The past ten years have seen substantial developments in privacy law and FOI practice. These include the expansion of the credit reporting system and increased penalties and regulatory powers. Major data breaches have highlighted critical areas for improvement and application of the law. The next decade is expected to bring further changes with ongoing law reform processes.

International Influence

The panel underscored the international nature of privacy and FOI, influenced heavily by GDPR-style reforms in neighbouring jurisdictions like New Zealand, China, and India. These reforms have been shaped by established practices in Europe but adapted to local contexts, affecting billions globally.

Human Rights Connection

A core theme was the connection between data privacy and human rights. Privacy is recognized as a fundamental right, crucial for personal autonomy and protection from unlawful intrusion. This principle is embedded in both access to information and privacy regimes in Australia and resonates strongly with people even in the absence of a national human rights framework. It was made very clear that individuals are increasingly concerned by how their personal information is collected and used.

Regulatory Convergence

The seminar emphasized the need for regulatory convergence to address modern privacy challenges effectively. Collaboration between various regulatory bodies, including the ACCC, E-Safety Commissioner, and ACMA, is essential for cohesive governance. This convergence aims to optimize resources and provide a unified approach to regulation. We Australians have above-average trust in our Government. However, this is based on the expectation that Governments will act on issues of concern - this supports the projections that the OAIC will expand to ensure they can act as an effective enforcement body.

Strategic Review Findings

A strategic review of the Office of the Information Commissioner (OIC) highlighted the need to focus on enforcement and education. The review recommended a risk-based approach to regulation, prioritizing the most significant risks and harms. This involves greater differentiation in handling individual complaints and a stronger enforcement posture.

Enforcement and Legal Actions

The panel also discussed current enforcement actions, including cases before the federal court involving significant data breaches. These cases are expected to set precedents and provide jurisprudence on privacy law. The OIC has invested in investigation capabilities to handle complex cases and ensure effective enforcement.

Preparing for Reforms

For practitioners and advisors, the key takeaway was the importance of preparing for upcoming law reforms. Ensuring compliance with existing principles and considering holistic data governance will be crucial. Entities not currently covered by the Privacy Act, such as small businesses, will need to pay particular attention to the changes.

The seminar concluded with reflections on the achievements of the OIC, highlighting its role on the global stage and the progress made in elevating data protection and information access. The event underscored the ongoing challenges and the need for continued collaboration and strategic action in the evolving data privacy landscape.

My Thoughts

For me, this was a very inciteful session. The continuing message is that now is the time to get on top of compliance with the current regulations as this will be the best way to prepare for the upcoming changes. Investment in data governance should be a priority.

I am encouraged by the level of knowledge, ability and appreciation for the importance of getting our privacy regulations in order from all of the panel. We are likely to see a lot of change very soon and we as privacy professionals will need to be paying close attention. The need for a data-driven economy that balances commercial needs with individual rights is a complex area. Many organisations will need to educate themselves on the current levels of compliance, implement strategies to improve where necessary and face the reality that budgets need to be assigned to governance and data privacy compliance.

Organisations can no longer push this issue aside and hope for the best. The current court cases show that there will be real consequences and the OAIC is positioning itself to enforce compliance. This, coupled with the growing awareness of these issues by the public dramatically increase the risks of non-compliance.