Senate Legal and Constitutional Affairs Legislation Committee, , 5:08:48 to 5:55:23
Officials provide an update on the second tranche of privacy reforms, focusing on adtech regulation, data harvesting, and consent standards for wearable technology.
Topics: Privacy, Online safety, Law reform
Speakers: Senator David Shoebridge, Catherine Fitch, Leah Blyth, Celeste Moran, Sarah Chidgey, Interjection, Katherine Jones, Rebecca Mills, Senator Don Farrell, Senator Helen Polley, Senator Jana Stewart
>> Yes. Um thank you very much chair. >> I have some um questions in relation to identity and information division and um particularly around uh the exposure draft on the second trench of privacy reforms. Can the department elaborate on how the proposed fair and reasonable test for handling personal information will strengthen protections for
Senator, the officers will take you
>> Thanks, Senator Celeste Moran, First Assistant Secretary, identity and information division. Um, sorry to ask, but would you mind repeating the question for us while we were walking
>> Yeah, I just wanted to get an update in relation to the exposure of the draft bill on the second trench of privacy reforms. Can you elaborate on how the proposed fair and reasonable test for handling personal information will strengthen protections for Australians?
>> Uh, thank you, Senator Katherine Fitch, Assistant Secretary Privacy Reform Task Force. Um just a a general update would be we have conducted recently some uh public consultation on an exposure draft bill um and accompanying consultation paper um at the end of August to the middle of September um that was a successful consultation. We had around 460 written submissions and we're working through the results of that process. Um in terms of your question
specifically about the fair and
reasonable test um essentially there's um some dissatisfaction with the current privacy framework in so in so far as um it's particularly complex and um not well understood difficult to administer um there are um three of the Australian privacy principles that provide um requirements for how personal information should be collected, used and disclosed. And these are difficult for many entities to understand and apply. So they include um technical distinctions um such as between primary and secondary uses of information and solicited and unsolicited information. Um and the proposed new fair and reasonable test um which I should say um was generally supported in the recent consultation um would provide a new clear baseline standard for all personal information handling. Um it would require entities to ensure that all information handling is fair and reasonable in the circumstances um unless it's required or authorized by another law or a small number of exceptions apply. Um so to reduce duplication and simplify compliance obligations um it would replace some of these existing technical um privacy principles and so um the test would um need to be considered by entities and they would um need to consider a non-exhaustive list of legislated factors um to help them determine whether particular information handling was fair and reasonable. So they would include and these were set out in the exposure draft we consulted on um what a reasonable person would expect in the circumstances whether the purpose for the personal information handling could be achieved with less or no personal information. Um whether the handling is related to the entity's functions or activities. um whether the purpose for which the information was sought was transparent to the individual and whether any privacy impact is proportionate to the benefit. Um so no one single factor would determine the outcome but all relevant factors would be considered and in particular this um uplifted protection would reduce reliance on consent um which is being used as the primary privacy safeguard currently. Um but many individuals uh are telling us that that's not always um meaningful because of long detailed privacy policies that sometimes aren't clear in terms of what an individual is agreeing
to. So given concerns about smart glasses capturing images and recording video conver uh covertly and AI processing data, how do the measures in this exposure draft address evolving privacy risks?
government has and the attorney spoken about this. Um the government's aware of community concerns around smart glasses and other um wearable information processing devices. Um it's largely because these devices can record and share images and other personal information in a range of situations sometimes without people actually being aware that they're being recorded. Um the government's also spoken about the fact that these technologies can have beneficial uses including as accessibility aids. um uh and we understand the attorney has met with vision Australia on this issue. Um in that would go to addressing um some of the concerns with these technologies I would say that um the first point is the privacy act does not apply to individuals wearing the devices but it does apply to entities um when they're collecting using and disclosing personal information collected via the devices. Um so some of the the things that would apply in the um updated exposure draft are um updated definitions to what personal information is and about the collection of information. So what constitutes collection? Um the fair and reasonable test I think um is important in terms of when the information is collected. Um you know how that can be used. um well when it can be collected and how it would would be able to be used and disclosed and then in particular a new right to erasia that would apply to large digital platforms um and their collection uh of personal information and that would allow individuals in certain circumstances to seek deletion and destruction of their information once it's held by a
>> There's been um debate and you you actually touched on it in your response. Uh I was wondering if you could then talk a little bit further about smart glasses and them being available for people with vision impairment um and having access to more affordable um glasses of this nature rather than you know there's a big cost disparity between what people with a um sight impairment would now currently pay for visual aids compared to some of those and most of those that are on the market. So, can you talk us through um further on the meeting um perhaps that happen, but also how useful these devices can be used for people with disabilities?
>> Um thanks, Senator. I mean, one thing I would say is that not all smart glasses um operate the same. I mean they they are generally collection devices for information but they can be combined with a range of um AI or photo recognition technology other um types of information processing um uh and I think it's it's really a question not of the device but how it's used. So um my understanding is that um information can be collected for a range of uses um and these can be beneficial and and legitimately um used by persons with
disabilities to assist them to use
information um uh for example to describe their surroundings etc. or alternatively they can be used um by nefarious actors to unwittingly and I I think this is the research shows that this has been um uh a particular problem in terms of harassment of women in certain situations. I mean they can be used just to um uh target particular individuals and um upload their
Senator, sorry could could I just add I think Miss Fitch said it uh in relation to an earlier question that um the attorney general herself had met with Vision Australia in relation to these issues. Um we also received a submission from Vision Australia and other um disability organizations in relation to the consultation paper that we put out. I mean I think the thing um that I've struck is um have been told is about that they can be quite life-changing for people with a disability. Um and that's something that um we've we've heard loud and clear through this consultation process. So just thought worth adding
that as well. So the consultation that you took place, you've got the submissions. When are you going to be able to provide information as to the outcome of that consultation period?
>> So um uh Senator, we we received about 460 written submissions through that process. We also held um I think seven um targeted consultation roundtables. We we are working our way through that volume of um feedback that we received on the consultation process. So um that's what we're doing currently Senator.
>> So how do the measures provide and my last question chair how do the measures provide for stronger more meaningful standards for consent?
>> Um thanks Senator. So um currently the privacy act um doesn't define or include standards for consent. It just says consent um can be express or implied. Um currently the practice um seems to have been in some instances that um individuals are being asked to read lengthy privacy policies and um consent or otherwise based on quite vague terms and um uh and information uh currently and the um exposure draft bill suggests a new definition of consent which makes clear that it should be um I'm going to forget the exact term for voluntary, informed, current, specific, and unam unambiguous. So, um that is intended to make it more meaningful so that individuals know what they're actually um consenting to when
>> Thank you, Senator. Senator Shoebridge,
>> um thanks J. You were giving that answer in relation to questions from Senator Polley about smart glasses. Is that >> That's correct. And if if somebody had just heard your answer, you might they might have had the mistaken belief that that's the kind of consent that would need to be given before people are recorded by somebody using smart glasses as they walk around the street. But that's not your proposal at all, is it? That's not the proposal at all. because what you're proposing doesn't apply to consent in those circumstances when individuals are wearing the glasses and recording people as they walk about the
>> Um, Senator, that's it's correct in so far as that um the current proposal or the the exposure draft that we consulted on does not propose to extend the privacy act to individuals in Australia.
So, can you can you can you read to me the um the elements of consent that you are proposing um in relation to corporations when they're taking data? I think you just read them before, Miss Moran. Could you read those those those
>> Senator, you're asking the definition of consent.
>> Yes.
>> Yeah. So what what Miss Fitch um outlined is that um and the exposure draft bill and the proposed amendments in relation to the definition of consent provide that it must be voluntary, informed, current, specific and unambiguous. >> And the the purpose of the um amendment to the definition of consent is to ensure individuals have genuine choice and control over handling of their personal information in the context of
the privacy act. And and you're intending if the bill goes to the next stage to say, well, if corporations are gathering data um or gathering material, um they need to get that consent before they handle um material. Is that right?
>> That's not quite right, Senator. Um uh the exposure draft bills doesn't suggest that consent should be required for all personal information handling only uh for sensitive information for trading and in certain other circumstances.
>> But that that should be corporations should get that for that sensitive information is the intent. Corporations should be getting that for that if they're if they're acquiring sensitive information. And it sensitive information would be vision of somebody at the gym or vision of someone's family at the beach. That would meet sensitive
biometric information it would be um not all images um would necessarily meet that standard but generally speaking
>> but to be clear the concern that Australians have about smart glasses isn't some corporate doing it although you know maybe you could see circumstances in which corporates put smart glasses on employees and send them out into the society the concern that most Australians have is that people can just buy these things at Kmart for 30 bucks Whack them on their whack them on and go out into into places where people have some expectation >> that they won't be. Let me finish, Mr. G. And um and and and simply record people record women at gyms, record families, you know, going about their business in the supermarket, record people at beaches. And none of your proposals are even going to touch on that. They're not even going to touch on it. Senator,
there is the statutory tor in the privacy act as well that does apply to serious invasions of privacy by individuals. Um,
>> but you won't you just interrupted Miss Well, sorry, you just pulled Mr. Chiji up for interrupting.
>> Fair point. Fair point.
>> Uh, you are now doing the same thing to
her, Miss Chigi. And uh I would just add as well we uh as you would have seen there are a range of uh local governments who are also banning use of smart glasses in particularly sensitive settings as well which uh is
appropriate. uh the idea that in the face of a nationwide privacy issue like this that the Commonwealth count the Commonwealth government's answer is well we're going to let Glennin Shire work it out or we're going to let you know the Murray Darling Council work it out or we're going to let you know um uh the Penro Council sort it out on an ad hoc basis is it's it's remarkable if that's the answer you're going to let you know the the North Sydney Council sort it out.
>> Well, Senator, I think that goes to some of what we were talking about in terms of smart glasses having some significant beneficial uses as well as uh um inappropriate um uses and these measures uh work to uh distinguish those issues.
>> Have you had a look at what those councils have done? Those councils have banned the use of smart glasses in a whole variety of public facilities. And they've done it because of deep and real concern about privacy, but because they haven't got the resources, because they haven't got heaven knows how many bureaucrats able to go and actually churn their way through this stuff, they haven't had the opportunity to have the discussion with the disability community, to have the discussion with vision impaired. do, but but you're not doing it to help the councils make the decisions. You're not doing it to have some kind of coherent national policy. You're letting Glenninis Council do this, North Sydney Council do that, Brisbane Council do this, and showing no leadership. Like, it's it's this is this department all over. You're always looking for someone else to actually take the do the hard yards and find responsibility. Always it's someone
>> I don't accept that. I struggled to hear a question in that. Uh so
>> are you serious that the the the way forward is letting local council sort it out? Are you serious about that? Uh
Senator, we have described the way in which the enhancements that would be made by the trench 2 privacy reforms would deal with um any businesses uh uh corporations um captured by the privacy act dealing with uh that information. The other measure that exists in the privacy act is the statutory tor for IND
statutory tor maji, right? In order for you to take action on the statutory tor you need to first of all know your privacy has been breached and and if you're recorded without your knowledge with covert devices and then it's just shared off in a part of the internet you never have access to, how would you ever know that your privacy breach? How could you ever exercise a right under a statutory tor? People are asking to be protected in the first place, not to be given a very potentially unusable remedy once the breach has happened. Do do you understand that people want protection, not a technical right that they probably Do do you understand that? Have people told you this in their submissions?
>> I mean, I think that goes to the range of measures that local governments implementing as well as the improvements through the privacy act um that will have an effect. Have you >> in misuse?
>> Have you have you pulled any of these councilors together, councils together and and taken them through the issues that have been raised when you've engaged with the disability community? Have you have you begun that leadership in the to bring the the mayors and counselors together to to help them navigate this? Have you done that?
>> We have not met with local government.
>> So you're working away over here in a silo. you you you're saying, well, councils need to sort it out with their very minimal resources. I think they get less than 2% of um government revenues. Um how are you not your your answer is councils and you're not even talking to them? >> How are you not talking to councils?
>> Uh well, councils as uh you're aware have been taking action. Senator,
>> sorry. I ask you why how it is you're not talking to councils and your answer is councils have been taking action. >> Is that is that really the answer?
>> Well, I'm saying we haven't need we haven't met with them. They have their they've been obviously making their own decisions about uh action they need to take in the context.
>> Miss Chigi, this is the point. They are making a series of important decisions with a fraction of the resources you have. None of the bureaucrats that this department has. They haven't got the resources to engage with the disability community like you have. Um I'm sure they're doing their best, but you're letting them go out there and make decisions to respond to the very real concerns that residents are putting forward. You're not helping them. You're not giving them resources. You're not connecting them with the disability community. You're not driving any kind of coherent national reform. You're just letting them go. >> Can I ask you why you haven't met with them? And your answer is well because they're doing stuff. That is not an answer.
>> Yeah. We've been made aware that the attorney general has met with the local council association. So the department has not the attorney general has.
>> When did the attorney general meet with the local and
>> we don't have the exact date um uh senator but we could take that on notice.
>> Which local council association?
>> The Australian local government association.
>> ALGA are there. Could I ask you to provide full details of what what if any the discussions were, what the proposal was put forward by the um by the attorney and can you provide minutes please?
>> Well, Senator, we weren't part of the meeting. So, we'll we can take that on notice and see if there's anything that the department
>> minister to provide if if minister could I ask you to provide that material in relation to the attorneys.
>> You say in the next five minutes?
>> No, I didn't. I'm sorry. No, I just if you can I'm very happy for it to be in the next 5 minutes. Don't get me wrong.
>> I was just looking at the clock there and I think the attorney might be in question time. Um might be >> difficult for her to come out and
>> if you if you can in the next five minutes that would be wonderful but I just ask you to take it on notice.
>> Thank you. >> Thank you. No, I'm certain.
>> Thank you, Minister. Thank you, Senator Shoebridge. I'll now hand the call to Senator Ble.
>> Thank you very much, Chair. And and I am going to go back to the officials that we had um earlier because I will just keep going um on the giggle v tickle Thank you. Um so I'll just sort of follow on and and just some clarifying questions. Um so if I can ask has the department undertaken a review of the relevant sections of the sex discrimination act following the >> No you haven't. Um, and is it my understanding then that um you didn't feel that such a review was necessary?
>> Well, Senator um uh the department wouldn't generally just do a review of its own um we would engage with ministers.
>> So, and so nothing was requested from the minister or from the government? No, >> no, no. Sorry, that was a no. No, Senator. >> Thank you. has the department prepared um options to clarify the legal meaning of woman, man, and sex in the Sex Discrimination Act? >> No. Um, have you prepared any options to explicitly protect biological female only spaces? No. >> Um, has the department been asked to draft any legislation to address the implications of the judgment? >> No. Um, was the department asked to provide any advice uh to the attorney general in relation to Senator Cash's sex discrimination amendment, which was restoring common sense and recognizing biological sex bill 2026.
We provided a summary of the uh proposed legislation. Yes,
>> you proposed to the attorney general
>> to her office.
>> Are you able to provide to table that for the committee?
>> We would have to take that notice.
>> Um do you recall in general what was in that summary?
>> I have to take that on notice. Thank
you. >> You have to take that on notice. Okay. So if we can then have on notice either um that summary that you provided or what is possible where the legal advice
>> Just sorry to intervene but >> um I don't think it's common practice to uh release uh advice that the department gives to the uh government in these circumstances but um I'll >> but I don't think um that is uh is standard practice.
Thank you. Um, no, appreciate that and appreciate that that the legal advice is is not something that the committee would normally see, but I think in this instance, it's helpful for the committee to see um where the department um and the advice that they gave in relation to that bill, particularly given that it didn't get past um its first reading stage. Um can I ask um whether any um women's organizations were consulted by the department um since the the full federal court's decision and have any of them requested legislative change? >> No, we haven't. >> Um has the department ever spoken to or consulted with the lesbian action group?
Sorry, Senator, I missed that last
question. >> So, whether the department has consulted with the lesbian action group.
>> Uh, I'd need to check.
>> That's the group that's been in court for the last three. No. Okay. >> can I ask given the judgment and the concerns that have been raised about female only spaces, what further work their department is undertaking to give women and women's organizations certainty about their rights in Australia? any
>> we're we're not undertaking any
>> not under any work at this time. so can you confirm that as of today that um and and this is probably better for the minister um given that the department isn't working on anything. So minister can you confirm that the government is not planning to do anything to protect the rights of biological
Look, I I don't think that's a a fair assessment of um the government's uh position. I think we um we do uh protect the uh the the rights of both men and women in this country. We have legislation which we um uh you know enforce in this area. So I don't think that's an accurate description. But in terms of uh something specifically in the area that you're asking about, I shall inquire of the attorney general and come back to
you. Thank you. That that would be most helpful because I think it it's fair to say yes, there is a lot of legislation, but where the the biological rights of women collide with those of men, it seems that the men's rights are still coming first. Um and so it would be very interesting to see what the attorney general has to say. Um in terms of I've been contacted like Senator Cash by constituents and and one particular instance is that um schools are able to apply for exemptions where they can be um single sex. So you can have girl schools and boy schools. Um and that's that's something where an exemption is allowed to apply. Um I've been contacted by constituents where there are um at a girl school girls are enrolled um and there is there are now girls enrolled who identify as boys. Would that be a breach of the sex discrimination act?
>> I think that's asking us for legal
>> it's not. It's it's how the legislation would apply in that instance. So, not legal advice, but I guess it's like saying if someone goes out and shoots someone, as Senator Cash is saying, is that murder? But in terms of that, so that exemption applies and because we now don't have um biological definitions within the Sex Discrimination Act, I guess what are the implications of that in that case? is it
>> So, uh I think we've been clear that these judgments about discrimination are made on a case-byase basis and that there are uh things like exemptions in the act that apply in certain circumstances. So, we can't provide uh just a a broad piece of advice in in response to your question.
>> Can you understand now how this piece of legislation is very difficult for people to understand? um what is right and wrong under the act. Is that is that something you can appreciate?
>> Um Senator, I acknowledge you've received and Senator Cash has received uh queries.
>> Yeah. Um, are you aware of the backlog of cases that may now because even even yourselves in in evidence today is that this seems like only the courts are going to be able to decide this um and that everything seems to be well get a lawyer or or um go through a court process. Are you aware or has your department put anything in place to allow for an influx in cases um that will be in relation to this?
>> Well, Senator, it's the Australian Human Rights Commission that deals with complaints in the first instance, not
complaints, >> cases. So, and the Human Rights Commission falls under,
>> but the cases usually come through. So I think that question would be best directed to the commission but it would be speculating as to whether this would this case will have the effect that that you're indicating.
>> Um am I right to assume that the attorney general's department is ultimately responsible for the funding that goes to the human rights commission >> that they sit under
>> um they have an appropriation uh made through um uh the budget process. It
comes through the department but it's allocated through the budget process and
>> but it's coming through the department. So so ultimately if they run over budget
>> no that they they have a have a specific budget that is allocated them to them through budget processes. There's just a administrative mechanism that goes
>> But what I'm saying is that's fine. They can have that but money still has to sit somewhere. So it's not sitting with the department.
>> It sits with the commission. with the
commission >> sits with the commission. So if they run over budget on something through the commission, what mechanism do they use to seek more funds?
>> So senator, they work through the budget process. So they're they're an independent entity. They have an accountable authority in the same way that I I'm the accountable authority for the attorney general's department. Okay. >> Uh if there are funding pressures, you uh apply through a budget process.
>> Do you ever provide legal advice or support to the human rights commission?
not not legal advice >> but we do provide support uh you know they are a part of the portfolio um
>> this is what I'm trying to establish is how independent they are from the portfolio so they're a part of the portfolio y >> so can I
>> in the same way that the courts are
>> what what kind of support do you offer to the >> Australian Human Rights Commission
>> and I might just indicate I'm going to
it takes a a range of things we um obviously as the the um department at the head of the portfolio. We coordinate budget processes. Uh we uh engage with them on financial, IT, human human resources but in a support capacity because they are independent entities.
>> Okay. So in terms of that budget process, >> how do you support them in that? Are you helping them to decide how much they will need? How does that
>> No, they're they're independent. So every entity in the portfolio, it's up to them to um manage their their budget and to um uh if they're under budget pressure, they have to make a a case to government through the budget process.
>> Okay.
>> Um but that is uh it's for them to determine.
>> Okay. So I'm just trying to figure out where that support then comes in from
>> Well, we we would we would coordinate, but ultimately it's a matter for them to make the case to government.
>> What does that mean by coordinate?
>> Well, because it happens for every department that has a portfolio. You coordinate the budget process uh uh with all the entities in your portfolio. Um uh and that's what goes through the the broader budget process.
>> Thank you. Sorry. I'm gonna share the call. Senator, Senator Shoebridge. Uh and I can come back to you if you still have further questions. Senator Shub.
>> Um thanks very much, Chair. I was going to ask about adtech regulation in the context of privacy law reform. Who's
We get Miss Moran, Miss Fitch to come
nice to see you again, Miss Mar. the um last week the ABC reported that a foreign company, I think this company was an Israeli tech company, used online ads to track and target devices, including at Ansto and a series of other Australian government and critical infrastructure sites. Um, have you reviewed how privacy laws operate to permit and to facilitate this kind of access through um, online ads? Have you reviewed the um this this privacy attack that happened very recently and was reported by the ABC last week?
Uh, Senator, we've um been conducting work on privacy reform for some time as you know and um uh are always interested in developments um but have not specifically done any very close analysis of that
my understanding is and this is reports that have come through a um through a citizens group who have been tracking these attacks. There was a series of attacks on Australia's infrastructure and stow the ABC and a number of other agencies that happened when an ad was loaded on a um and then without clicking just simply scrolling past the ad um provided the um avenue for attack um onto that device and through that device um in in one case onto Ansto in another case onto the ABC. Um, are you saying that that series of attacks has not been reviewed by the department?
>> Um, Senator, there are a range of um reforms that we're looking at and that we're in in the exposure draft that go to um direct marketing and um looking at how um uh different forms of marketing like adtech would operate. Um uh essentially um uh again the existing rules in the privacy act which um are outdated and unclear how they operate in the digital age would be replaced by um uh organizations needing to take reasonable steps to action. Um uh opt- out requests. There would be greater transparency measures that would be required. um uh you know, Australians would be able to be clearer about what um they're entitled to expect in terms of um these websites using their personal information in in um a range of circumstances, I think, including the sort of instance that you're referring to.
>> And and Senator, I might just add that I think the example you gave would be subject to criminal laws for um cyber
crime. Well, of course that that the the intrusions would be subject to criminal laws, but the difficulty is that these third these entities are using the information they're getting from the um providers of the ads, information about where the person's device is, what the nature of the person's device is, what what they look at online um uh uh how long they're online. They assess their age. They may find out where their what their employer is. They're picking up all of that data from the ad provider um and sometimes from other platforms because there's no privacy laws prohibiting that harvesting of data against people. And then when they when they start developing a full picture of people, they're saying, "Well, hang on. You know, Miss Finch works at the attorney general's department. and I'd like to know what's going on at the attorney's general's department. I'll whack an ad on her device and use that to get in and breach the attorney general's department. I mean, that's what's happening because there are no privacy laws protecting this.
>> I mean, Senator, one thing I would say is that one of the reasons we are updating um working to update the privacy act is to make much clearer that these sorts of um uh behavioral uh information is covered within the definition of personal information. So, the privacy act would clearly apply.
Will you is it the intent to prevent these platforms from harvesting that data? Is that the intent unless there is prior express consent given?
>> Senator, I think Miss Switch said at the beginning, we we don't know the specifics of this matter. So I suppose we just want to be a bit cautious about giving you
>> whatic to assist the way going forward. Why don't we just talk about online ads and data tracking? Well, and I think
Miss Fitch has given you an an just an overview of the the particular measures in the bill that would go to these types of issues around direct marketing and trading in personal information. Uh obviously also Miss Fitch has mentioned the definition of personal information. So I think you you know that we we're amending the definitions uh in the act to bring them much more into line with you know how information is actually collected and used >> um in modern day standards. We've talked to you already about um consent and what that would look like uh and the new definition of consent and obviously we've also got the fair and reasonable test which is a new uh baseline standard. So there are a range of measures in the trench 2 bill that would in broad terms address the issues that you have raised in relation to this
matter. Well, why don't I ask a simple question then? Um, under the proposed reforms, the drafts, would website need, websites need people's active consent before sending that kind of information out to a third party? And here I've, you know, I'll repeat it again. Um, what the person's device is, what their location is, what their browsing history is. Would would the proposed reforms require active prior consent before that information can be gathered and then transmitted?
>> If those organizations are trading in personal data, then yeah, the answer to your question is yes.
>> Well, what if they're just an advertising company?
Well, I think the definition of trading would probably cover the sort of instance you talk about if they're um exchanging personal information for um for money or other consideration.
well, they may have other arrangements. They may have other reasons why they want to provide that information. They may want to provide that information simply because they want to target the attorney general's department. They may want to gather it not for a financial reason, but because they don't like the attorney general's department, or they may want to gather it because they want to target another entity. It may not be a financial reason.
>> So, Senator,
>> would it be so unless it's being gathered for a financial reason, there's no prohibition?
>> No, Senator. So, I think what Miss Fitch has said is if they're trading in it, you have to you have to seek consent of the individual under the new definition of consent. Otherwise, the fair and reasonable test will apply across the
board. So, so but trading requires a financial exchange, does it? Or some kind of benefit, financial benefit.
>> I don't have the uh I've got the bill in somewhere here. Um but but there is a
benefit that needs to be. So, so if they're doing it for reasons unrelated to some kind of benefit, if they're just doing it because they maybe don't like this particular organization or they they
>> so the fair and reasonable test would then apply, Senator,
>> and and would that prohibit the gathering of the data and the transmission of the data?
>> Yeah. Well, I mean, if there was a if it was a disclosure and not a trade, then as Ms. Moran has said the fair and reasonable test would apply and the the range of legislative factors that I referred to earlier would be part of the assessment as to whether that was fair and reasonable and under the circumstances that you're describing um without wanting to go into hypotheticals and and with the um you know the the qualifier that I um we've already given that I don't know all of the circumstances of the incident then I would think it would be unlikely to be fair and reasonable in that instance.
>> All right. And which government agency do you understand is responsible for dealing with this most recent attack that I've described? The the click-free ad attack that has targeted the ABC and Ansto and a number of other entities. If you clearly aren't responsible for it is my reading because you >> because of what we've heard. Which agency do you understand is responsible
for it? So, I understand the Australian Signals Directorate um uh has had involvement with the matter.
>> Yeah. But I asked who's responsible for coordinating the response.
>> Well, you you'd need to ask the Australian Signals Directorate who would have the lead on a cyber attack.
Oh, the the only thing I would add to Miss Chuji's response is there's obviously the n national office of um cyber security um senator who uh generally is the coordinating agency in relation to cyber um incidents.
>> But I understand from the reporting is that inquiries are being directed to ASG.
>> All right. While we're on privacy reform, we have you at the table so you don't bounce back and forth. Um how many submissions were received on the trench 2 privacy um proposals?
>> About 460.
>> 460. Um what is the current proposal in relation to the small business
>> So the exposure draft um bill and the consultation paper that were released uh in August. Uh at the moment there's no change to the small business exemption. Senator
>> and um I my understanding is a number of submissions said that was a problem because it creates a significant potential privacy breach. Um are you in a position to respond to those submissions now?
>> Uh look I I think in in broad terms I mean we've obviously said there's 460 odd senators so there was a significant volume that we received and we are working our way through them. Um I I don't think it's incorrect to say that um a portion of those dealt with um issues relating to the small business exemption.
>> There have been pushes for a children's privacy code, a tougher, firmer children's privacy code. What's the stage of that?
>> So senator, I think the tranch one bill which passed uh the parliament in late 2024 uh had a requirement for the office of the Australian information commissioner to establish a children's online privacy code. Uh the OIC and the privacy commissioner are undertaking that work currently including they've done a a consultation on a draft code and um they're working towards having that uh registered by the 10th of December which is what was outlined in that legislation.
>> All right. Well, it's required, isn't it? By the 10th of December. Correct. >> All right. And do you understand they're on track?
>> They are, Senator.
Coohl's and Wworths are triing facial recognition. There was a legal case involving Bunnings brought by the privacy commissioner which had I think the politest description would be mixed results. Um uh is it intended to place specific provisions about to protect people's biometric data and particularly facial recognition in this trench 2
>> Um Senator, it's not proposed to change the general technology neutral nature of the act. There are facilities in the privacy act which allow for more specific um uh regulations to be made or or to clarify how the rules apply to particular technologies in the act. Um we are aware of um uh a range of organizations um considering triing facial recognition technology in a range of instances. Um uh I think that one um instance that the um uh privacy commissioner has made a determination on relating to Kmart is still before the art. So um I know that the OIC has released some guidance on how they will intend to treat facial recognition technology under the current law. Um and that's the current status of
>> All right. So just to be clear, no intent for specific reforms dealing with facial recognition
>> um other than um biometric information is considered sensitive information and there are general um uplifts to the standard on how that should be treated within the the trench 2 um proposals.
>> I note the time chair you want to
>> thank you for your assistant Senator Schub Senator Cash.