Graham Perrett (Moreton, Australian Labor Party) Share this | Hansard source

Deputy Speaker, this speech might be strangely familiar to you. The Albanese Labor government takes the job of protecting Australians very seriously when it comes to the economy, to health, to the borders and to international security. Nowadays, in 2024, this includes safeguarding individuals' privacy in this increasingly digital world. There are many reasons why it's vital to keep our personal information safe. They include the prevention of identity theft and subsequent fraud and the protection of our financial information.

The growth of the digital economy and the change in the way we live have both created new ways for our privacy to be exploited. You only have to think back to the devastating data breaches of a couple of years ago, which affected up to 10 million Australians. These breaches saw Australians' names, birthdates, home addresses, phone numbers, email contacts, and passport and drivers licence numbers stolen and made available on the web for sale. Apart from the administrative burden then placed on all of those affected, this also created significant anxiety about further breaches, identity fraud and scams. Sadly, the consequences of personal information being accessed without permission can even be violent or life-threatening. Women fleeing family violence can be targeted, their personal information can be shared with their abuser, and they can be tracked.

The National Cabinet held in May focused on our national crisis of gendered violence, and at that time the Albanese Labor government committed to criminalising the practice of doxxing. Doxxing is the act of releasing personal information online without permission and with malicious intent. This includes circulating personal data such as the names, addresses, emails and phone numbers of private citizens. The popularity of social media, online platforms and messaging apps has made it easy to publish private information online, especially in an age where many people, including teenagers, are intent on publicising themselves to the world. Victims of doxxing are at risk of physical threats, public humiliation and shaming, discrimination, identify theft and financial fraud, and this can be an enduring risk, with the information floating around cyberspace indefinitely and able to be purchased. A devastating example of this was the release of the personal details of a WhatsApp group of hundreds of Jewish Australians earlier this year.

The practice of doxxing is unacceptable, and this bill, the Privacy and Other Legislation Amendment Bill 2024, provides for substantial criminal and civil justice pathways. You can see that it's critical to amend the Privacy Act 1988 and the related sections of the Commonwealth Criminal Code. We need to make this outdated legislation, from a time before the internet, fit for purpose for the modern age so that we can ensure that the increased privacy risks of the digital age are contained and that all Australians are protected. This is a reasonable expectation for Australians to have, and it is one that the Albanese Labor government is determined to uphold. It is also important to bolster our privacy legislation to protect Australian businesses and keep them competitive. We need to keep in line with international privacy standards.

To the detriment of Australians, the former coalition government did nothing to bolster privacy in a period of change. They did nothing to strengthen privacy laws, and they even scrapped the position of the standalone Privacy Commissioner. They were full of plans but lacked any follow-through, and they didn't guarantee funding for the privacy watchdog, the Office of the Australian Information Commissioner. This was left for the Albanese Labor government to do when we came in. We allocated $66 million to this office and ensured that much of its funding is ongoing.

Now we are implementing measures via the Privacy and other Legislation Amendment Bill 2024. These responsible reforms are the product of a considerable approach stemming from the Australian Competition and Consumer Commission's 2019 Digital Platforms Inquiry. This inquiry recommended a review of the Privacy Act. The consultation process was extensive, with feedback from the business sector, the media, cybersecurity experts and, most importantly, everyday Australians. The Privacy Act review report was released in February last year, and the Albanese government responded in September 2023. This bill now seeks to implement the first tranche of agreed recommendations from the Privacy Act review.

Under this legislation, doxxing will become a criminal offence. This legislation also amends the Criminal Code so that the maximum policy for the malicious use of personal data will be six years imprisonment. This is applicable when someone uses a carriage service to make available, publish or distribute personal data in a way that is regarded as being menacing or malicious towards the individual. The maximum penalty will be seven years imprisonment where the personal details of members of a group are released due to their race, religion, sex, sexual orientation, gender identity, intersex status, disability, nationality, or national or ethnic origin.

The legislation details 'personal data' as information that enables the individual or members of a group to be identified, contacted or located. This includes, obviously, someone's name, their photograph or other image, their telephone number, their email address, online account details, their residential or work address, their place of education or their place of worship.

The bill takes into account that doxxing can occur in different ways. For example, it can be publishing someone's details for a third party to harass them without even knowing their identity. A key part of this legislation is recognising that it's not always malicious when personal information is shared, such as ordinary social media posts or reports in the media. To attract a criminal charge a 'reasonable person' needs to view the conduct as menacing.

This bill also puts forward a new statutory tort that will enable victims of a serious privacy breach, including doxxing, to seek redress in the courts. This can be in the form of damages or other remedies. This new tort will balance privacy rights with legitimate public interests such as something crucial for a healthy democracy, the freedom of the media, public health and safety, freedom of expression and the proper administration of government. These measures work for the individual, and also ensure that our privacy legislation is keeping pace with technological changes. Importantly, they meet the expectations of Australians.

It was first recommended by the Australian Law Reform Commission in its report a decade ago, titled Serious invasions of privacy in the digital era. The wide-ranging reforms in the bill before the chamber include clarifying the purpose of the Privacy Act—that is, that entities are responsible for protecting people's personal information rather than just treating it as a commercial asset. It also gives the Information Commissioner the provision to develop codes to address certain technologies or industry practices. This provides flexibility to deal with emerging technologies.

The bill also focusses on boosting privacy protection for children, who are particularly vulnerable online. A Children's Online Privacy Code will be developed, applying to internet services which are likely to be accessed by children. This code will outline how entities must comply with privacy requirements for children. We've directed $3 million over three years to the Office of the Australian Information Commissioner to develop this. It will be closely aligned to similar codes in countries such as the United Kingdom. Other measures include the reinstatement of the privacy commissioner and gives the Australian Information Commissioner enhanced powers to share information in a timely way about data breaches.

The bill introduces notifiable data breach declarations. These enable entities such as banks to act quickly and decisively to prevent compromised personal information being misused. Under these amendments, the Information Commissioner will have strengthened powers to enforce the act, including new civil penalties for a range of privacy breaches and an infringement notice system. The Information Commissioner will also be able to require a respondent to undertake any reasonable act to rectify or reduce the foreseeable loss.

One amendment I'm particularly pleased to see included is increased transparency regarding automated decisions that require the use of personal information. We all know the devastating effect that automated systems can have. You just need to think about the ramifications of the former government's appalling robodebt scheme. This bill gives individuals transparency about the use of their personal information in automated decisions which affect them. Privacy policies will have to outline the personal information to be used and individuals will be able to request information about the decision.

Another benefit of the amendments include targeted responses in disasters or emergencies. The bill builds on previous reforms delivered by the Albanese Labor government. After those big data breaches in 2022, we implemented the Privacy Legislation Amendment (Enforcement and Other Measures) Act, and that increased the maximum penalties for serious or repeated privacy breaches from $2.2 million to whatever is the greater of $50 million or three times the value of the benefit obtained through the misuse of the information.

This bill addresses the views expressed by Australians. The Office of the Australian Information Commissioner's Australian Community Attitudes to Privacy Survey found that 89 per cent of Australians want stronger legislation to protect their privacy online. The overarching benefit of enhanced privacy regulation is the bolstering of confidence in a digital economy, which supports innovation and its growth. This bill represents the first phase of Labor's intention to give Australians enhanced control over their personal information. It answers the need that the Attorney-General outlined and I quote, since he's in the chamber:

It is essential that Australians are protected by a legal framework that is flexible and agile enough to adapt to changes in the world around them.

I commend the legislation to the House.

See this speech in context