Australia proposes sweeping privacy law changes to curb data harvesting via fine print

Under the proposed overhaul, entities covered by the Privacy Act - including Australian government bodies and firms earning more than $3 million a year - must meet a “fair and reasonable” standard when collecting, using or disclosing personal information, limiting reliance on lengthy terms and conditions. The reforms also tighten consent rules, require organisations to inform the Australian Information Commissioner within 72 hours of a suspected breach, and keep existing exemptions for small businesses, employee records and political parties.

A right to erasure would be introduced, but only for large digital platforms with revenue of $500 million or more or 2.5 million monthly Australian users, excluding media organisations. Critics such as Electronic Frontiers Australia and the Australian Privacy Foundation warn that exemptions and the limited erasure right could create loopholes, while legal practitioners anticipate that broad consent will no longer suffice for excessive data collection.