00:00It's very targeted, it's very directed towards what citizens, consumers are facing in terms
00:07of privacy and preservation of their rights.
00:12It's an initiative that recognises that information asymmetry can give rise to power imbalances
00:19and those power imbalances can actually sometimes curtail rights.
00:23In this instance it's the right to privacy.
00:26And we're really conscious that in transactions that people undertake every day, transactions
00:31like renting a property, inspecting a property for rental, hiring a car, obtaining a script
00:38over a counter, pawnbrokers and entering a licensed venue can all give rise to handing
00:44over information in circumstances that require immediacy in the transaction.
00:50And so in those circumstances there can be a degree of vulnerability.
00:54So what we want to do is ensure that businesses are aware of their privacy requirements.
01:01That they have privacy policies that are clear and up to date, that they're transparent and
01:06that they tell consumers everything that's happening with their business as required.
01:11So that that information can be handed over with a degree of certainty, confidence and
01:16trust in that transaction.
01:18These all sound like pretty perennial problems.
01:21Why the decision to do this now?
01:24We were provided with new powers in 2024.
01:28And we're also conscious that this is a building block.
01:31It's a foundation for privacy and for privacy policies.
01:35If we are able to undertake regulatory initiatives that are proactive like this one, it will ensure
01:41that businesses know how to comply.
01:44And it will also ensure that the community is aware of their right and that they can enter
01:49into these transactions with a degree of confidence and trust.
01:54So we're building from the ground up to ensure that people can hand over personal information
01:59knowing how it's used, for what purpose, who it's disclosed to and how it might be destroyed.
02:06All of the requirements under the Australian Privacy Act.
02:09And you are looking across six sectors in particular, property, chemists and pharmacies, licensed
02:15venues, car companies, second hand dealers.
02:19Why have you picked these six?
02:21Those sectors are sectors in which individuals generally will hand over their information in
02:26person.
02:27And there's a certain element of timeliness in that transaction.
02:32People are interested in obtaining the service that they're wanting.
02:35They want to rent the property.
02:36So they'll hand over their personal information.
02:39Sometimes they don't stop, have a moment to think about how handing over that information
02:44might impact them later on.
02:47So where that information, how the information is stored, who holds the information.
02:51Does that information go overseas?
02:54And if it goes overseas, to what countries?
02:57All of these are fundamental privacy protecting measures that are enshrined under the Privacy Act
03:03and that are required to be set out in a clear, open and transparent privacy policy.
03:09So if we have those measures in place, we have better compliance and better confidence
03:13in the economy.
03:15And so how do you go about this sweep?
03:17Practically speaking, I know you're picking about 60 businesses.
03:21What happens?
03:22Do you literally walk through the front door and announce that you're doing a compliance
03:24check?
03:25That's a really interesting aspect of this proactive initiative.
03:29We announced in December so that all businesses would be aware that in January we would be
03:34conducting this sweep.
03:36So they've had all of December to ensure that their privacy policies are up to date and available.
03:41From there, we'll conduct a desktop review.
03:44We'll look through the web on their websites and see if they have their privacy policies available,
03:50if they are up to date and if they deal with all of the requirements they should set out.
03:56If those policies are not available online, we will actually attend the premises and obtain
04:01a copy of the privacy policy.
04:03What kinds of problems are you anticipating unearthing during the sweep?
04:08What kinds of privacy laws or regulations are businesses commonly not adhering to?
04:13Well, people are really interested in whether their information will go overseas.
04:17So we'll be looking to see if that information is shared.
04:21We'll be looking to see if it's destroyed.
04:23Because sometimes businesses hold on to information, particularly personal information, for much
04:28longer than is needed for that transaction or a series of transactions.
04:32And when that happens, it creates additional privacy risks.
04:36For example, cyber security risks where personal information can be harvested.
04:40So if we set this platform up, it's a foundation for successful management of people's personal
04:46information going forward.
04:48And if you discover breaches, what are the consequences for those businesses?
04:51We have some new powers that we can deploy.
04:55So we can look at education and guidance at first instance, particularly if it's a new market
04:59entrant and a good compliance history by the entity.
05:03We can also look at compliance notices where we'll set out what businesses need to do and
05:09within what time frame.
05:10But we also have escalation steps.
05:13And one of those escalation steps is the issuance of an infringement notice.
05:16If the entity doesn't comply and there is clear harm that arises, we can issue an infringement
05:23notice which can warrant the paying of up to $66,000 in a fine to a listed entity.
05:32And for a non-listed entity, it's $19,800.
05:37From there, if there's still non-compliance, we can take action for a civil penalty.
05:42Obviously, 60 businesses is a real drop in the ocean in Australia, but I suppose this
05:47is also about sending a message, right?
05:49And making sure that people are cleaning up their act.
05:51This is a message to business, to elevate your privacy standards and to ensure that you're
05:58compliant.
05:59Also, a message to the community, be aware of your legal rights and know what questions
06:06to ask.
06:07Be informed, and when you do so, you can enter these transactions with confidence.
06:11We'll have to leave it there, but Elizabeth Tidd, thank you so much.
06:15It was great to hear your thoughts.
06:16Thank you, Ruby.
06:18Thank you, Ruby.
