The Privacy Act has arrived, with the first iteration of the long-awaited legislation addressing such areas as children's safety, information sharing in the case of an emergency and criminal offences to outlaw doxxing.
The opening tranche of the Privacy and Other Legislation Amendment Bill 2024 doesn't include anything around first-party and third-party data collection, definitions of personal information or how a 'fair and reasonable test' would apply to the use of such information, however.
For those in the advertising and marketing industry, the delay on such components being included in the first stage means they're still waiting to see how proposed regulations will affect both their companies and clients.
IAB Australia CEO Gai Le Roy said the industry body welcomed the government’s announcement that further consultation will be undertaken on some of the more complex privacy law reforms that will impact the industry, while also acknowledging the importance of the reforms that were introduced into the Parliament .
"IAB will go through the Bill and explanatory memorandum to carefully assess their impact on our industry, however, we are pleased to see that the Government looks to be moving forward on these important reforms in a considered way," she said.
"Privacy laws are fundamental to the functioning of our digital economy. IAB will continue to work constructively with Government to ensure that our laws are fit for purpose and so that industry can continue to meet consumer expectations to deliver freely available online content and services."
InfoSum's SVP of APAC, Richard Knott, said there’s certainly an element of anticlimax that there will be further consultation on privacy law reforms related to advertising, but such a move reflects the complex nature of the digital advertising industry.
"It’s more important to get the right solution than a fast one," he said.
"Nonetheless, the delay doesn’t change the fact that companies should embrace privacy-by-design strategies regardless of legislation. This means embracing the non-movement of data, data minimisation, and controlled access - as well as ensuring you can explain your policy in a way that consumers will understand."
Civic Data's managing partner Chris Brinkworth said the changes are crucial for safeguarding consumers as technology evolves.
“The Attorney General’s department have clearly thought strategically on how to significantly reform unethical and risky privacy practices in the digital economy, while not rushing through wholesale reform just before an election”.
Brinkworth said that the statutory tort introduced as part of the Bill is significant because it establishes legal liability for serious privacy breaches, imposes specific standards for automated systems and decisions and addresses both legal and technical aspects of data usage in digital customer experiences.
"Businesses need to understand any technologies touching the customer data lifecycle comprehensively," he said.
"Risks range from 'basic, but risky tracking pixels' to the complexities of untrained staff ‘uploading vast spreadsheets of names and behaviours into social media advertising platforms’ – common practices already discussed in depth by the Australian Privacy Commissioner and highlighted within recent regulatory reports from the ACCC related to data use and digital platforms."
ADMA's director of regulatory and advocacy, Sarla Fernando, said more transparency upfront about automated decision-making (ADM) is in line with ADMA’s approach to getting marketers to rethink their collection use, disclosure, and management of data earlier in their campaign strategy and thinking.
"The inclusions of these proposals in this first stage of privacy reform is consistent with data minimisation, which is core to best practice in data management and handling. This is ultimately what our customers are expecting," she said.
The prioritisation of ADM amendments will require marketers to set out the types of personal information that will be used in substantially automated decisions which have significant impact on an individual.
Fernando said in order to have transparent upfront notices about ADM, marketers will need to think about what data they are collecting, the categories that data falls into, whether it is necessary for the purpose collected and how the business may use it in the future.
"This can’t be done without also preparing for a broader definition of personal information, which we still expect to see in stage two of the reform in order for the Privacy Act to be fit for purpose," she said.
Audience Group's co-founder and director, James McDonald, said there were three key parts of the legislation that jumped out at him.
"The use of global analytics platforms that process data in multiple regions could be limited if data transfer conditions are not met; the amendments to automated decision-making are significant for online advertising, as they specifically address how companies use algorithms to make decisions, such as targeting ads based on personal data; and allowing people to opt out and suppressing targeting capabilities will become essential," he said.
"Understanding how to use broader targeting strategies to increase your ROI is vital. I suggest if you haven't already done this, now is the time to start.
"Understanding which algorithms are being used in your advertising targeting and how they work will also become essential and building your own custom bidding algorithms will become increasingly important.”
Have something to say on this? Share your views in the comments section below. Or if you have a news story or tip-off, drop us a line at adnews@yaffa.com.au
Sign up to the AdNews newsletter, like us on Facebook or follow us on Twitter for breaking stories and campaigns throughout the day.