Monique Ryan (Kooyong, Independent) Share this | Hansard source

The Privacy and Other Legislation Amendment Bill 2024 represents a significant legislative effort to modernise Australia's privacy framework and to address emerging challenges in the digital age. The bill proposes substantial changes to the Privacy Act 1988, reflecting the fact that it has not kept pace with Australians' widespread adoption of and reliance upon digital technologies and the concomitant risks associated with these technologies—specifically, that personal data could be subject to misuse or mishandling. Digital technologies can also be used as platforms for doxxing, in which personal information is maliciously disclosed with the intent to cause harm. Doxxing exposes victims to physical threats, to public embarrassment, to humiliation and shaming, to discrimination, to identity theft, to financial fraud and to other serious harms.

While the objectives of this bill are laudable, I'm quite concerned that this bill lacks clarity and specificity and that its broad scope and its somewhat vague language could engender potential for overreach and unintended consequences. One of the most significant concerns raised by this bill, concerns which have been raised by many of my constituents, is its potential to stifle freedom of expression. The bill introduces a new statutory tort for serious invasions of privacy. The model of the statutory tort set out in the bill was informed by the Australian Law Reform Commission. It's intended to provide individuals with legal recourse against those who wrongfully intrude upon their private lives, and that's a worthy intent. However, the bill's broad language and its lack of clear definitions could create ambiguity that could chill legitimate forms of expression, particularly those that engage in investigative journalism or political satire.

The bill attempts to address this concern by arguing that the tort will only capture actions that reasonable persons would regard as being menacing or harassing. However, the bill fails to provide a clear definition of what it constitutes as menacing or harassing behaviour. Its reliance on the concept of 'reasonable persons' in its justification for limiting freedom of expression is also somewhat problematic. This ambiguity could lead to uncertainty. It could potentially disadvantage individuals who hold minority views or people who express themselves in unconventional ways. The bill also fails to provide sufficient guidance on what constitutes serious interference with privacy.

There is no doubt that doxxing is loathsome behaviour, and victims may have to take significant steps to mitigate the harm which, unfortunately, can result from this process. However, I'm concerned that this legislation's establishment of criminal offences for doxxing doesn't adequately define the intent required for the act to be considered an offence. This bill could potentially criminalise the sharing of information that is publicly available or information which is shared for legitimate purposes, such as whistleblowing or public interest reporting. Information is sometimes shared to reveal criminal behaviour. The bill relies heavily on a court based enforcement mechanism for both the statutory tort for serious invasions of privacy and the criminal offences for doxxing. That gives us the prospect of airing additional sensitive, potentially private information, which could be a disincentive to seeking redress under the legislation. Conversely, the threat of expensive and lengthy legal action could be a disincentive to freedom of expression.

The bill introduces a new framework for eligible data breaches, empowering the minister to expand the collection, use and disclosure of personal information following significant data breaches. But the broad scope of those powers raises concerns about their potential to exacerbate privacy breaches. Moreover, I'm told by experts with whom I've consulted that the bill lacks robust oversight mechanisms to ensure that decisions are proportionate and necessary. An independent body or tribunal to review the minister's decisions and to provide greater transparency and accountability might be desirable.

This bill could represent a missed opportunity to create a truly comprehensive and balanced framework for privacy considerations. Engagement and further consultation with stakeholders could ensure that the bill strikes a better balance between privacy and other rights. The bill should be strengthened to effectively protect Australians' privacy while upholding fundamental freedoms. A more nuanced and balanced approach is needed to ensure that the law effectively protects privacy rights without unduly infringing upon other essential freedoms.

See this speech in context