Need to know
- Australians support reforms to the Privacy Act that would stop businesses from collecting too much data
- The proposed reforms would also give more powers to regulators to investigate and act on data breaches
- CHOICE is calling on the federal government to institute these reforms urgently
New data reveals a majority of Australians support changes to privacy regulations being championed by CHOICE, with approximately 80% backing several key reforms.
It comes as authorities reveal almost 13 million people may have had their health information and other personal details accessed by hackers following a cyber attack on former prescription delivery service provider MediSecure in April.
This follows years of data breaches affecting major companies, including Optus, Medibank and Latitude Financial, putting the sensitive information of millions of Australians at risk.
To help protect our data, CHOICE is calling on the federal government to urgently implement four key improvements as part of its reform of the Privacy Act, which governs how our data can be collected and used.
Millions of Australians have had their data exposed to hackers following recent data breaches.
Australians back better privacy protections
In our latest CHOICE Consumer Pulse survey*, a nationally representative survey of over 1000 households conducted in June 2024, consumers told us they back many of the reforms we're presenting to the government.
CHOICE senior campaigns and policy adviser Rafi Alam says that after years of data leaks, people are fed up and want change.
"Privacy reform has never been more urgent," he says. "Consumers want and deserve strong protections for their personal information. They tell us daily that they are worried about their data and they expect the government to act to protect them."
These are the four key reforms we're pushing for.
1. Stop the over-collection of data
Of those surveyed, 77% said they believed businesses should only be allowed to use your personal data in ways that are fair to you.
We're calling on authorities to institute a "fair and reasonable use" test or, as Alam refers to it, "the privacy pub test" – something that would be considered reasonable and fair to most everyday Australians.
A privacy pub test would seek to ensure businesses can only collect and use your data in ways that are fair, regardless of consent or tricky terms and conditions.
Alam says a requirement for this in the Privacy Act will discourage organisations from collecting more data than they need and prevent them from using data in ways that hurts consumers.
"For too long, businesses in Australia have had a culture of rampant over-collection of data that has led not only to massive data breaches, but also unfair practices like price discrimination and manipulative data-driven marketing," he says.
Australians believe much of the information captured by our devices could identify us.
2. Bring 'personal information' into the digital age
CHOICE also believes more of our sensitive details ought to be brought under the protections of the Act.
"Unfortunately our privacy laws were written in the 1980s, long before cybersecurity and artificial intelligence were everyday concerns," says Alam. "We need fit-for-purpose privacy laws that offer consumers the protection they deserve in the digital age."
Currently, 'personal information' is protected in the Privacy Act, but is defined only as information about a person, such as names, addresses and phone numbers.
We want the definition changed to information relating to a person, safeguarding more of the data collected on us by our devices, such as IP addresses and our exact location.
Consumers are already well aware of the power this information has. Over 70% of survey respondents believe it could lead to them being identified.
3. More protections from businesses of every size
Consumers also believe more businesses should be required to abide by privacy laws.
According to Australia's privacy commissioner Carly Kind, 95% of Australian businesses aren't complying with any privacy legislation.
Most small businesses, with a turnover less than $3 million per year, are currently exempt from the Privacy Act, but 81% of survey respondents told us that they think these firms should be required to follow the same rules as big businesses when dealing with personal data.
"Australians expect the same protections, regardless of the size of the business," Alam says.
"Whether it's a real estate agent, supermarket or social media site, consumers want assurance that their personal information will be used fairly."
4. Help authorities keep data collectors in line
Consumers back CHOICE's call for more powers for the data regulator.
Finally, CHOICE also wants the national privacy regulator, the Office of the Australian Information Commissioner (OAIC), to be given similar authorities to other regulators, like the ACCC and ASIC, to mitigate wrongdoing.
This would include giving OAIC stronger investigative powers and the ability to issue infringement notices for smaller breaches of the Act.
"Stronger powers for the regulator will uplift compliance across the economy and restore trust in the market," says Alam.
In our survey, 88% of respondents agreed that the regulator should be able to fine businesses that misuse our personal data.
Stock images: Getty, unless otherwise stated.
