Paul Fletcher (Bradfield, Liberal Party, Shadow Minister for Government Services and the Digital Economy) Share this | Hansard source

I rise to speak on the Privacy and Other Legislation Amendment Bill 2024. This is a bill that's been in the pipeline for some time, yet it is a very curious creation. It seems to have been cobbled together from a range of different parts. Each of these parts does something different. They have different objectives, and they respond to different stakeholders. They are all somehow related to privacy, but they each have their own merits and drawbacks. It just does not sit together well as a whole. All the indications are that this bill was hastily stitched together at the last minute.

When, on this side of the House, we first heard that the Attorney-General wished to introduce measures along the lines of those we're considering today, the coalition anticipated that the bill would address the matters previously intended to be addressed in the Privacy Amendment and Other Measures Bill 2024 and the Privacy (Statutory Cause of Action for Serious Invasions) Bill 2024. We had not seen the first of those bills, but we assumed it was intended to make changes to the Privacy Act and introduce various other measures. We had also not seen the second of those bills, but we again assumed that this was a bill which was intended to introduce a new statutory cause of action for serious invasions of privacy. When the Attorney-General stood at the dispatch box on 12 September to introduce the bill being debated, he didn't introduce either of those two bills which had been foreshadowed earlier. Instead, we got this strange and confused mishmash of legislation.

On analysis, there are three substantive parts to this bill. Schedule 1 is essentially a suite of what might be described as the less controversial changes to the regulatory regime in the Privacy Act. For more than a year, the government has been promising a major overhaul of the Privacy Act's regulatory regime. Some of the proposed changes were highly contentious. They included things like stripping away protections for small businesses and changing the definition of 'personal information', which is, of course, the very core of the matter that is regulated by the Privacy Act. The changes would have reached into every part of our economy and may, in turn, have required changes to the way that every Australian business handles information. Other changes that were foreshadowed went to foundational issues on which many of our modern digital businesses are built, such as data segmentation and value adding. In extreme scenarios, those changes would have had the potential to destroy existing markets and potentially to create new ones. We can only guess at the potential regulatory costs.

Those changes, at least for the time being, seem to have been left on the cutting room floor, and that is not necessarily a bad thing. Instead, we've been provided with a slimmed down suite of changes, set out in schedule 1 to this bill. When I say 'slimmed down', that is only in comparison to what had originally been foreshadowed, not to what might be considered the community standard of what is slim and what is not. There are still 15 different parts in schedule 1, and each part deals with a different topic. On the whole, schedule 1 avoids some of the more contentious changes to Australia's privacy regime that had been foreshadowed by this government. Instead, it focuses on issues such as the regulatory and enforcement powers of the Information Commissioner. These changes are important, but they're not foundational.

Why has there been this late change in approach? That is not clear. The government has not adequately explained it. The official line, as best can be discerned, is that the government has decided to consult further on these matters before pressing ahead. It may be that the looming election has sharpened the government's focus. I can only speculate—it is up to the Attorney-General to explain why this has happened. In the meantime, some of the more radical reforms are presumably sitting in a bottom drawer in the Attorney-General's Department, no doubt in the hope that they can be dusted off in the next term of parliament.

Let me turn to schedule 2 of this bill. Schedule 2 does not concern the existing regulatory regime that deals with privacy in Australia. It's not about regulation at all. It is about private disputes commenced by parties to civil litigation who seek compensation through the courts. How, then, did these unrelated reforms make their way into this bill? Again, on this side of the House, we don't know the answer to that question, but we have a theory. Our theory is that the Attorney-General must have felt somewhat embarrassed about having promised major privacy reforms for more than a year before shelving them at the last minute. There's every appearance that the Attorney was looking for something to pad out his bill and decided to jam schedules 2 and 3 into the package. That is certainly the theory that we on this side of the House have developed as to why schedule 2 contains a suite of measures to introduce a new statutory tort for serious invasions of privacy.

The tort would allow an individual to sue, where that individual believed a person had invaded their privacy by 'intruding upon their seclusion' or 'misusing their personal information'. It has to be said that both the merits and the drafting of this statutory tort are highly contestable. The invasion of privacy must be serious, but, equally, it's actionable without proof of damage. There are exemptions in relation to journalists, law enforcement bodies, intelligence agencies and children, but there's no clarity about how well these would work in practice. Some of the definitions are extraordinarily broad. The explanatory memorandum suggests that, in some cases, merely storing data might constitute a misuse of information. Crucially, the tort is completely separate and additional to the general regulatory regime in the Privacy Act, and it appears that an individual can sue any 'person' for such a breach.

The word 'person' is a defined term at Commonwealth law. It includes bodies corporate and politic, as well as natural persons. So, even though the government granted a temporary reprieve to small businesses in schedule 1, it puts those businesses straight back in the firing line in schedule 2. They will continue to be exempt from regulatory action but will instead be exposed to legal action. This raises some immediate questions. For example, what is the impact of this tort on small businesses? Are we likely to see insurance premiums go up because the government has now opened them up to a new type of legal exposure? It's not hard to imagine how this might play out. After all, your beauty salon and your mechanic deal with your personal information, just as your bank and your insurance company do. If your beauty salon's booking system were compromised, would they now be exposed to a lawsuit? Will your beauty salon now need higher levels of cover to deal with the legal risk? Do small businesses now need to change their operational procedures, or indeed the services they offer, in order to deal with this new legal risk? It is not hard to see how the impacts of this new statutory tort would flow through to higher prices for Australian consumers.

Where are the stakeholders on this? Well, it turns out that the strong supporters of this proposed new statutory tort include class action law firms and litigation funders. That is not particularly surprising. They stand to make quite a lot of money out of this. We need only look at the number of Labor politicians who are former class action lawyers to know where their heart is on this matter.

Of course, we'll hear some standard lines about access to justice. It's amazing how often these pious public statements dovetail with private financial gain. On the other hand, we know that in the past media organisations have been highly critical of the statutory tort—for example, Australia's Right to Know Coalition, which represents media organisations across a very diverse spectrum, from the ABC and the Guardian at one end to News Corp at the other. The Right to Know Coalition has previously warned that the proposal to have a statutory tort would be 'contrary to the public interest and result in a significant curtailing of press freedom in Australia'. They've argued that the proposal will primarily benefit wealthy and high-profile individuals and that it fails to provide any clear public benefit.

The Council of Small Business Organisations Australia have said that they are highly concerned by the unexplored and unintended consequences from the broad proposed drafting of the tort. In COSBOA's words: 'Whilst the wrecking ball of the removal of the small business exemption has been narrowly avoided, the clumsy and poor approach being pursued by government in respect to schedule 2 creates high degrees of anxiety for small business.' For other groups, the changes in schedule 2 have caught them off guard. Many simply did not know they were coming. Again, that is not very surprising. Stakeholders have been asking for an exposure draft for months. The government refused and instead dropped these changes for the first time just a few weeks ago. It is very clear that this proposed statutory tort warrants careful scrutiny.

That brings me, finally, to the third schedule of this bill, which creates new offences for doxxing. The term 'doxxing' refers to the practice of publishing private or identifying information on the internet about a particular individual, typically with malicious intent. We know that doxxing can expose victims to physical threats, public humiliation, discrimination, identity theft, financial fraud and other serious harms. These risks have become all too apparent since the malicious doxxing of more than 600 Jewish writers, academics, artists and small-business owners by pro-Palestinian activists and Hamas sympathisers in February this year.

Like other parts of this bill, this schedule raises immediate questions. The first question to ask the government is: what on earth took you so long? Jewish groups have been calling for our criminal laws to be tightened up in this space since February. We have known for months that the current criminal laws do not cut it, and the coalition has been on the record as saying that we would work with the government to devise a legal framework that is fit for purpose.

In the past eight months, as just one example of how problematic this practice of doxxing can be, we have seen reports of anti-Jewish activists distributing pictures of Jewish family trees online. This is a form of intimidation that we have not seen since the days of the Nazis. But, for whatever reason, addressing doxxing has not until now, it would seem, been a priority for the Albanese government. Now that these provisions have finally been introduced into this parliament, these doxxing laws have, however, been shoehorned into a bill which makes peripheral changes to the privacy regime and introduces a highly contestable measure to throw a bone to Labor's class action lawyer mates. If any further proof were required that the Albanese government has its priorities all wrong, this bill provides ample such proof.

The coalition will treat each of the three parts of this hurriedly cobbled together bill on their merits. Firstly, in relation to doxxing, these are reforms which should have been brought forward months ago. They're criminal law reforms that make changes to the Criminal Code. They deal with an urgent and unprecedented surge in criminal behaviour. Yet, to Labor's discredit, they appear to have chosen to hold these laws hostage to unrelated reforms that change a regulatory regime and give a boost to class action lawyers, who are, of course, well-known big donors to the Labor Party. It seems that the needs of Jewish Australians have come second to Labor's sectional interests.

Secondly, in relation to the reforms to the regulatory regime concerning privacy, we welcome the decision not to progress with the more contentious reforms at a time when Australians can least afford it. The remaining changes warrant scrutiny, but we are cautiously receptive. We will test them through the committee process before arriving at a final position.

Thirdly, in relation to the statutory tort, there are clear and immediate issues that have been identified by several groups and stakeholders, including media organisations and small business organisations. These groups have only had the opportunity to see the drafting for a matter of weeks. They should be given the opportunity to air their concerns through the Senate committee process. To date, the process leaves everything to be desired, but the coalition are open to being convinced that the statutory tort is in Australia's best interests. We will watch carefully as the arguments play out over coming weeks and we will finalise our position in the light of the Senate inquiry.

Debate adjourned.

See this speech in context