Gai Brodtmann (Canberra, Australian Labor Party) Share this | Link to this | Hansard source

The reforms in the Privacy Amendment (Enhancing Privacy Protection) Bill 2012 will improve responsible lending and reduce levels of indebtedness and defaults. In another significant amendment, the bill will provide new powers for the Australian Privacy Commissioner to handle complaints and to provide a wider range of enforceable remedies to consumers and direct government agencies to perform privacy impact assessments.

The bill implements key aspects of the Gillard government's first stage response to the report by the Australian Law Reform Commission. Let me briefly run through the main components of this bill. First, it will improve and update Australia's privacy law framework. Through these measures, it will create a single set of privacy principles that will be technology neutral for both the private sector and Australian government agencies. It will introduce a new, more comprehensive consumer-credit-reporting system. It will clarify and enhance the powers of the Privacy Commissioner, to advance the commissioner's ability to resolve complaints and to undertake investigations. It will also promote privacy compliance.

In terms of what this bill will mean for consumers, it will uphold transparency in the handling of personal information by requiring organisations to develop and publish more comprehensive privacy policies. It will make it easier for people to access and correct their credit-reporting information, which is particularly important. The Privacy Commissioner's powers to enforce compliance with the act will also be enhanced. Most importantly, this bill will protect victims of identity theft and fraud by providing them with the ability to prohibit for a specified period the disclosure of credit-reporting information about them without their consent. It will protect minors by prohibiting the collection of credit-reporting information about individuals under the age of 18.

Something I am sure will be very welcome is that this bill will clearly and tightly regulate the use of personal information for direct marketing by introducing a specific privacy principle directed at direct-marketing activity. It will prohibit the use of credit information for direct marketing. I know that this will be widely welcomed. I know that I get many complaints in my electorate from people who are being harassed through direct-marketing phone calls. Just on the weekend, I was clearing a whole lot of messages that had been left on my machine and noticed that there were a whole lot of overseas calls. I just wondered how many direct-marketing messages or calls have been made while I have been at work or out at night in the electorate. I was quite alarmed by the number and thought to myself, 'I must get on that list.' The bill will the strengthen the protection for an individual's information where it is disclosed outside Australia.

What this bill means for business is this—because it has an impact on business as well as on consumers. It makes certain that new privacy principles are technology neutral. It makes certain that the privacy principles are relevant to a technology driven environment, and it makes certain that they have the flexibility to adapt to new technology as it develops. It updates the credit-reporting provisions to take in hand the major changes that have taken place since they were first enacted in 1990. Furthermore, it makes the credit-reporting regime more flexible and less prescriptive by emphasising industry led complaint resolution. It also introduces a much more comprehensive credit-reporting system.

The specifics of this comprehensive reporting system will now include correct and timely information to enable improved risk assessment, increased competition and efficiency in credit markets, decreased levels of over indebtedness in default, and more responsible lending.

Let me briefly touch on the credit reporting aspects contained in this bill because they will permit some extra information about individuals to be included in the credit reporting system, including some repayment history information. The more inclusive credit reporting will ensure that the credit assessment process operates more effectively by providing sufficient information to credit providers so as to allow them to more accurately assess the risk of lending. Importantly, the bill includes safeguards to protect against the misuse of credit information, which is incredibly important. The example that has been used is that credit providers will now be obliged to help consumers correct their credit information if there is an error on their credit report. As I have noted, this bill will prohibit the collection of credit reporting information about individuals reasonably known to be under 18. This bill is the result of an extensive consultation process that began several years ago and the credit reporting industries in particular want to see this bill introduced. I commend this bill to the House.

Julie Owens (Parramatta, Australian Labor Party) Share this | Link to this | Hansard source

I am also pleased to rise to speak to this Privacy Amendment (Enhancing Privacy Protection) Bill 2012. This bill, in many ways, has been a long time coming. It deals with a number of issues which I know my constituents care about greatly. It is amazing how much the world has changed. Back maybe 15 or 20 years ago, I 'accidentally'—I did it on purpose—went into one of those competitions where you could win a two-week holiday somewhere just by filling in the form. For the next three years, I was inundated with every time share proposal and holiday you could imagine because I had accidentally, as it turns out, got myself on a mailing list which was clearly for sale quite broadly.

Now, of course, the world is very much connected. Nowadays, we provide our details online all the time. I think that for the young, they probably do it several times a day, and we all know how quickly and easily that information can be shared. A lot of us suspect that it is shared much more than we would like and in ways that we would not expect.

In this online world, there is a need for privacy laws to be updated, and these amendments do just that. They will bring immense benefits to working families, and that is why we are tightening the rules around how companies and organisations can collect, use and disclose personal information. We are introducing a new privacy principle for direct marketing and stronger protections for consumers when companies disclose personal information overseas. Again, this is an issue that all of us hear about from our constituents: this concern that large databases that contain their personal information, their financial information, important identifying information, are moved overseas for business purposes—there is a lot of concern about that. The new direct marketing privacy principle also will more tightly regulate the use of personal information for direct marketing.

The privacy principles will also require a higher standard of protection to be afforded for sensitive information, which includes health related information, such as DNA and biometric data; again, some of the newer kinds of information that we see now. There is also an incredibly important area which is in the national consumer credit area: we are making it easier for consumers to access and correct their personal credit information. Again, we all hear stories of people who have, for one reason or another, ended up with some bad credit information—sometimes it is not even accurate, sometimes it is not even theirs—and the difficulty that they have in correcting that information. This is the first major reform since Labor introduced credit reporting way back in 1990. This bill well and truly modernises the provisions that will make the credit reporting regime more flexible and less proscriptive by emphasising industry-led complaint resolution, which the industry has been asking for.

It will also see the introduction of positive credit information for the first time so that not only will a credit report show when a payment was late but when payments were made on time line. Again, this is something that people in my community and in the community generally have been asking for for some time, as have banks and financial institutions.

There are three key reforms in the bill. The new unified Australian Privacy Principles will apply equally to both the private and the public sectors for the first time. The principles will deal with the handling of personal information, including the collection, storage, security, use, disclosure and accuracy of information. A new principle will be introduced to specifically deal with direct marketing. There will also be more comprehensive credit reporting which will for the first time include the positive information that I referred to before in consumers' credit reports, supported by strong privacy protections for the information. There will be new powers for the Australian Privacy Commissioner to handle complaints and give remedies to consumers. The new powers will include the ability to accept enforceable undertakings and the ability to pursue civil penalties for serious breaches of privacy.

The key elements of the reform include a new privacy principle which more tightly regulates the use of personal information for direct marketing. It is more power to consumers to opt out of receiving those incredibly annoying direct marketing materials. The companies will have to provide a clear and simple way of opting out. The statement from the company must be prominent. We are all inundated with direct marketing materials and I, like many others, would welcome the opportunity to be able to opt out of that. It will also extend the privacy protections to unsolicited information and provide stronger and clearer rules around data quality and data correction. It will make it easier for consumers to access and correct credit information held about them. It will tighten the rules on sending personal information outside of Australia. Before an agency or private sector organisation discloses personal information to an overseas recipient, it will have to take reasonable steps to make sure the overseas recipient does not breach the Australian Privacy Principles. The agency or organisation will still remain responsible for the personal information even when it is in the hands of the overseas recipient. It is only possible for responsibility to be passed on to the overseas recipient on extremely limited circumstances. That is incredibly important for those of us who give our information to an Australian company to understand that that company remains responsible for the information and has to conform to really quite strict rules if they pass that information to an overseas company.

The bill will also reform the consumer credit reporting system. Along with responsible lending reforms in the National Consumer Credit Protection Act 2009, these changes will mean that banks see more accurate information about the types of accounts families have and when they were opened and closed, current credit limits of accounts—but not the day-to-day balance, to protect privacy—and positive information about repayment history, for example when a credit card was paid off in time and not just information about overdue payments.

For consumers, the bill will promote transparency in the handling of personal information by requiring organisations to develop and publish more comprehensive privacy policies. It will make it easier for individuals to access and correct their credit reporting information and it will bolster the Privacy Commissioner's powers to enforce compliance with the act. It will protect victims of identity theft and fraud by providing them with the ability to prohibit for a specific period the disclosure of credit reporting information about them without their consent. It will protect minors by prohibiting the collection of credit reporting information about individuals under the age of 18. It will more clearly and tightly regulate the use of personal information for direct marketing by introducing a specific privacy principle directed at direct marketing activity. It will prohibit the use of credit information for direct marketing and strengthen the protection for an individual's information where it is disclosed outside of Australia. These are is a comprehensive reforms and with this bill the Gillard government has implemented more than half of the Australian Law Reform Commission's recommendations in the 2008 For your information report.

It is also good for business. It will ensure that the new privacy principles are technology neutral, relevant to a technology driven environment and have the flexibility to adapt to new technology as it develops. It will modernise the credit reporting provisions to address the significant changes which have taken place since they were first enacted in 1990 and it will make the credit reporting regime more flexible and less prescriptive by emphasising industry led complaint resolution.

The changes to comprehensive credit reporting are very good for business. They will ensure that the credit reporting system includes accurate and up-to-date information to enable improved risk assessment, increased competition and efficiency in credit markets, decreased levels of overindebtedness and default, and more responsible lending.

These are very good reforms. They are reforms which reflect the changing use of technology and the changing way we provide and share information, particularly in the online environment. They recognise the speed of change—that whatever technology is around now will probably be quite different in a very short period of time—and they recognise concerns consumers have had about the way their information moves through the business world and around the world. They are very good reforms and I commend the bill to the House.

Amanda Rishworth (Kingston, Australian Labor Party) Share this | Link to this | Hansard source

I am very pleased to speak on the Privacy Amendment (Enhancing Privacy Protection) Bill 2012. From the outset, it is important to note that our information is out there in a lot of places, reflecting the way the world has changed. People do not think twice about putting their details online when signing up to loyalty cards or to gym memberships. There are a whole range of different places you hand over your information these days.

While I think the convenience of being able to do these sorts of thing on the internet is great, we need to ensure that our privacy legislation keeps up with it. We need to ensure that people can be confident about handing over their information through these new media. That is important both for the private sector and the public sector. People in my electorate often express concern to me not only about how their information might be used by private organisations—giving it to third parties, for example—but also about how government departments might use it.

One of the key reforms in this bill is to provide for new, unified Australian privacy principles which will apply equally to the private sector and the public sector. These principles will deal with the handling of personal information, including the collection, storage, security, use, disclosure and accuracy of information. Importantly, a new principle will be introduced specifically to deal with direct marketing.

I am very pleased that the bill also provides and extends stronger protections for consumers in regard to disclosure of their information to overseas companies and organisations. While many members of the Australian public probably do not mind being exposed to direct marketing from time to time, this sharing of information is of concern to a lot of people that I speak with. I think it is very important the privacy principles keep in step with those concerns.

A division having been called in the House of Representatives

Sitting suspended from 16:19 to 16:32

As I was saying before the division, it is very important that we keep in step with the expectations of the public. I think one of the other important parts of the bill, as I was saying before about direct marketing materials, is that the bill also provides for a new privacy principle which will more tightly regulate the use of personal information for direct marketing. It will give more powers to consumers to opt out of receiving direct marketing materials, companies will have to have clear and simple ways of opting out and the statement from the company must be prominent. I think that is something a lot of consumers in my electorate will welcome. I also think extending privacy protections to unsolicited information is important, as are clearer rules around data quality and data correction.

I am not going to speak on every part of this legislation, but one of the important parts of it is that it provides for more comprehensive credit reporting which will for the first time include positive information in consumers' credit reports and be supported by strong privacy protections for this information. We know that people do use credit reports—companies use credit reports, as do banks, to look at whether or not there is a risk to providing a loan or product to a consumer—but often I have had constituents frustrated by the fact that this information has a black mark against their name and is not up to date, is not correct, is not transparent, leaves them unable to get a look at it and does not have positive information. They may have had a difficulty some time ago but have paid all their bills on time for, say, the last five years, and that information is not provided. So making sure the accurate information is provided in people's credit histories is really important for companies to ensure that they make accurate decisions but is also important for individuals. It is important that these individual consumers who may get rejected for loans because of their credit rating actually be allowed to get that information, and I think this is a win-win situation that allows for responsible lending but also allows for individuals to get that information. I think that is a very important part.

The third key reform is new powers for the Australian Privacy Commissioner to handle complaints and give remedies to consumers. These new powers will include the ability to accept enforceable undertakings as well as the ability to pursue civil penalties for serious breaches of privacy. This gives the commissioner some teeth in order to pursue issues where there have been serious breaches of privacy. We know that from time to time that does happen. Now there will be an ability to use these new powers to ensure that there are ramifications when privacy is breached.

This builds on what the government has been doing in the area of privacy. I think the News of the World scandal really shone a light on how people's privacy can be breached. Of course, that was for prominent people. We need to ensure that it is not just famous people or people who are high profile who have their privacy protected but ordinary citizens as well. I think that is very, very important, and it is a very important reform. It builds on a whole range of things that we have been doing in this area. I certainly believe that we must continue to be vigilant to ensure that our privacy laws are in step with the community's views—as well as, of course, respecting the right of freedom of speech. That is obviously a very important right, but we need to ensure that privacy is maintained, especially as new technologies, new environments and new ways of marketing come to light, and that our laws and the ramifications for breaching those keep in step. I commend the bill to the House.

Sid Sidebottom (Braddon, Australian Labor Party, Parliamentary Secretary for Agriculture, Fisheries and Forestry) Share this | Link to this | Hansard source

Good afternoon, colleagues. It gives me great pleasure to represent the Attorney-General, the Hon. Nicola Roxon, in discussing and summing up the Privacy Amendment (Enhancing Privacy Protection) Bill 2012. The Attorney-General would like to thank honourable members for their contribution to this important debate, particularly the members for Canberra, Parramatta, Kingston, Flinders and Stirling. She would also like to thank the House Standing Committee on Social Policy and Legal Affairs for its advisory report and its detailed work in considering the bill.

The committee has recommended that the House pass this bill. It has also recommended that comprehensive educational material on the new privacy protections be made available. The House committee has asked that a number of issues, such as the Australia link issue, be reviewed 12 months after commencement. Today the government can commit to fulfilling these recommendations. The government may make further amendments in the Senate in response to the Senate Legal and Constitutional Affairs Legislation Committee's report.

It was Labor that introduced the Privacy Act in 1988, and once again Labor is reforming privacy law. This bill implements more than half of the Australian Law Reform Commission's 295 recommendations. It has been consulted on extensively, with the Senate Finance and Public Administration Legislation Committee considering exposure draft legislation in mid 2010 and inquiries occurring in the relevant committees of both the House and the Senate this year.

The bill protects consumers' privacy, particularly in this fast-changing, global, digital and internet accessible world. For example, it puts extra obligations on big companies which send personal information overseas. The bill makes it easier for consumers to opt out of receiving unwanted direct-marketing material. Companies will also have to develop detailed privacy policies which are clear and easily accessible to consumers.

Stricter rules will apply to sensitive information, including health, DNA and biometric data, and credit-reporting agencies will be banned from collecting data about children. Consumers will have a right to access and correct their credit reports, and comprehensive credit reforms will enhance responsible lending obligations, reduce the cost of credit and lower default rates.

The bill gives the Commonwealth Privacy Commissioner the power to get an enforceable outcome—for example, an apology, a retraction, a take-down notice or, indeed, compensation from a court. The commissioner will be able to direct companies to complete a privacy impact assessment, encourage parties to use conciliation to resolve disputes, and apply to the courts for a civil penalty order. New civil penalties range from $2,200 for an individual through to $1.1 million for a company. For serious and repeated breaches of privacy, companies may be liable for more than $1 million.

The Gillard Labor government—this government—has acted to protect privacy in an increasingly online and digital world, which a number of the members, including the member for Kingston, have pointed out. Once again, it is the Labor Party which is looking after families and individuals as they apply for a loan or credit card online, buy footy tickets on their iPhones and pay the weekly bills online. Labor is making sure that families and individuals can get a practical remedy if their privacy is breached.

The member for Flinders has noted that in the age of communication we must weigh and balance competing principles, particularly between privacy, national security, commercial information and social engagement. The Attorney-General would like to thank the member for Flinders for his support for stopping unwanted and pestering direct marketing, establishing new Australian Privacy Principles, and introducing comprehensive credit reporting. The member for Stirling, in his contribution, raised four concerns. They were about Australian Privacy Principle 8, de-identified data, commencement of the bill and complaints mechanisms. A number of these concerns will in fact be addressed in the review that the House committee has recommended. Also, these issues were all raised in the Senate committee process, and the government will respond to any recommendations from this committee. Both the member for Flinders and the member for Stirling were disappointed when this bill was debated on 23 August 2012 that the House committee had not reported on the bill. The House committee has now reported, and the government has accepted the three recommendations in full. The Attorney-General would like to thank the Liberals for their support of this bill.

This bill is one of the most significant reforms to privacy law since Labor introduced the act in 1988. The measures in this bill have been carefully considered and extensively consulted on. The Attorney-General particularly wishes to acknowledge Senator Trish Crossin and Mr Graham Perrett MP, member for Moreton, for their detailed analysis of this bill in their respective committees. She would also like to thank the numerous stakeholders, from the industry associations to the law reform and privacy advocates, for their detailed discussions, arguments and feedback into this parliamentary process. She is confident that the government has struck the right balance in the privacy law in this bill. I, as the member for Braddon and parliamentary secretary, commend this bill to the House.

Question agreed to.

Bill read a second time.

Ordered that this bill be reported to the House without amendment.