Privacy Commission wants new rights for personal data control

Anonymity

Anonymity is a glaring omission in the report, for example. The report notes that the Australian Government's public data policy is for data to be “appropriately anonymised”, but no definition of what that means. There's no discussion of how strongly data needs to be anonymised to protect citizens from its misuse.

When researchers alerted the Federal Government that its published medical data was poorly-protected, its response was to have the hapless Attorney-General George Brandis introduce a law making such research illegal.

The private sector

While the media release nods to more transparency and consumer control over how companies handle citizen data, in the report, the commission repeatedly argues against government intervention in specific market segments.

While “there may be a role for government action to ensure broader access to data in the public interest”, the report says, “The benefits and costs of any such action should be assessed beforehand to ensure the least negative effect on incentives to continue to collect, curate and deliver consumer benefits and shareholder gains from data holdings”.

The commission wants the government to set up a data advisory council to “ensure cross-sectoral representation in data issues and have the ability to respond flexibly to data issues as they arise and the capacity to swiftly recommend solutions to emerging problems”.

This is a nice idea, but successive Australian governments have shown scant regard for the role of civil society input to such bodies.

As just one example, in its Senate inquiry into the Census, the Australian Privacy Foundation was listed last on the agenda. Inevitably, because the hearing ran late, the FOundation's input was limited to ten minutes.

It seems likely to The Register that “cross-sectoral representation” will end up weighted towards business and bureaucracy, with the risk that the advisory council will be skewed in favour of more use of data, not less.

Too much for the individual?

The PC acknowledges that “it is desirable always for consumers to be fully informed themselves, it is often not a practical option”.

Fine: but for anyone to exercise their “Comprehensive Right” to control their data, they'll be assuming a considerable burden of knowledge.

It's not patronising to say it's beyond most people: they're already time-poor and privacy policies are long, complex and seldom written in plain English.

The emphasis on the individual is in line with the Productivity Commission's philosophies, but we'd argue that a right that's difficult or impossible to exercise doesn't really exist. ®