Industry commentators reacting to the long-awaited release of the first tranche of Privacy Act reform have acknowledged the anti-climax they're feeling around the first in a multi-step approach to overhaul privacy in Australia. But the general consensus is this shouldn't delay the marketing and advertising industry from getting their data and personal information practices in better order to prepare for what will eventually be a transformation of the way the industry operates.

As indicated in Mi3's reporting yesterday, the first tranche of Privacy Act reform focuses on four key things: A new statutory tort to address serious invasions of privacy; development of Australia's first Children's Online Privacy Code to better protect children from online harms (with $3m extra for the OAIC to do it); greater transparency around automated decision making (ADM) practices including upfront privacy notice changes; and stronger enforcement and penalties to hinder doxing, or the practice of maliciously releasing significant personal information online.

More broadly, the Australian Information Commissioner has been given strong enforcement powers, and there's more streamlined information sharing in case of an emergency or eligible data breach across departments.

In submitting the bill to parliament, Australia's Attorney-General Mark Dreyfus said The Privacy Act had not kept pace with the adoption of digital technologies. "The vast data flows that underpin digital ecosystems have also created the conditions for significant harms, like major data breaches that have revealed the sensitive information of millions of Australians, exposing us to the risk of identity fraud and scams. Strong privacy laws and protections are critical to building public trust and confidence in the digital economy and driving the investments needed to keep people's data safe," he told Parliament.

However, the first in what's now planned as a multi-part approach to reforming the Privacy Act was missing many of the key new definitions, changes and guidelines expected to directly impact the way marketing and advertising is done in this country. Notably, the definition of targeting, direct marketing, a new 'fair and reasonable' test and tougher consent practices, and a switch from personal information not just being 'about' the individual, but 'relating to'. SME exemptions also remain in place - for now.

In submitting the first bill, Dreyfus confirmed more work needs to be done - including industry consultation - to get to the next round of privacy reforms. The Government is not expected to release these until mid-2025, after the next Federal election.

"There's certainly an element of anticlimax that there will be further consultation on privacy law reforms related to advertising," Richard Knott, SVP APAC at InfoSum said in response to the news. "However, it reflects the complex nature of the digital advertising industry. It's more important to get the right solution than a fast one. Nonetheless, the delay doesn't change the fact that companies should embrace privacy-by-design strategies regardless of legislation. This means embracing the non-movement of data, data minimisation, and controlled access - as well as ensuring you can explain your policy in a way that consumers will understand."

The IAB Australia welcomed the Government's announcement that further consultation will be undertaken on some of the more complex privacy law reforms impacting the industry, while also acknowledging the importance of the reforms introduced into Parliament thus far.

"IAB will go through the Bill and explanatory memorandum to carefully assess their impact on our industry. However, we are pleased to see that the Government looks to be moving forward on these important reforms in a considered way," Gai Le Roy, CEO of IAB Australia said. "Privacy laws are fundamental to the functioning of our digital economy. IAB will continue to work constructively with Government to ensure that our laws are fit for purpose and so that industry can continue to meet consumer expectations to deliver freely available online content and services."

In its statement on the stage one reforms, ADMA CEO Andrea Martens, also saw it as an important day for the Australian marketing industry, with the introduction of the Privacy Act amendment Bill to Parliament - even if the Bill demonstrated limited action at this point in time.

"While this is a slimmed down version of the Bill we may have been expecting after the Government Response in September 2023, this is the beginning of reform legislation which will most likely transform our industry," she commented. "ADMA welcomes the opportunity these changes bring to strengthen consumer trust within our industry and reinforce marketers' commitment to best practices in data management."

Meanwhile, ADMA urged Australian business to stay focused and on-track with its preparation for wider Privacy reform. Take stronger enforcement powers for the Australian Information Commissioner and streamlined information sharing in cases of emergency or data breaches, both of which show a continuity of the Government's intention to hold businesses accountable for their data practices as first signposted when they previously increased penalties for serious and repeated breaches, the association said. "More transparency upfront about automated decision-making (ADM) is in line with ADMA's approach to getting marketers to rethink their collection use, disclosure, and management of data earlier in their campaign strategy and thinking," ADMA Director of Regulatory and Advocacy, Sarla Fernando, continued. "The inclusions of these proposals in this first stage of privacy reform is consistent with data minimisation, which is core to best practice in data management and handling. This is ultimately what our customers are expecting."

The prioritisation of ADM amendments will require marketers to set out the types of personal information that will be used in substantially automated decisions which have significant impact on an individual.

"In order to have transparent upfront notices about ADM, marketers will need to think about what data they are collecting, the categories that data falls into, whether it is necessary for the purpose collected and how the business may use it in the future. This can't be done without also preparing for a broader definition of personal information, which we still expect to see in stage two of the reform in order for the Privacy Act to be fit for purpose," Fernando added.

Co-Founder & Director of independent, Australian advertising services agency Audience Group James McDonald also flagged ADM as a key indicator of what's to come.

"The amendments to automated decision-making are significant for online advertising, as they specifically address how companies use algorithms to make decisions, such as targeting ads based on personal data," he said. "Allowing people to opt out and suppressing targeting capabilities will become essential.

"Understanding how to use broader targeting strategies to increase your ROI is vital. I suggest if you haven't already done this, now is the time to start. Understanding which algorithms are being used in your advertising targeting and how they work will also become essential."

Chris Brinkworth, Managing Partner of Civic Data, said: "These changes are crucial for safeguarding consumers as technology evolves”. He also stressed the urgent need for businesses to understand any technologies touching the customer data lifecycle comprehensively.

“The Attorney General’s department have clearly thought strategically on how to significantly reform unethical and risky privacy practices in the digital economy, while not rushing through wholesale reform just before an election”.

In his speech to parliament, Dreyfus said the Bill is an important first step in the Government's privacy reform agenda, "but it will not be the last".

"Over the coming months, the Attorney General's department will develop the next tranche of privacy reform for targeted consultation, including draft provisions the government is approaching this important reform work carefully to ensure increased privacy protections are balanced against other impacts, and that we deliver the fairest outcome for all Australians," Dreyfus concluded. "After many years of inaction, this Labor Government is committed to genuine privacy reform. The Australian people expect no less for themselves and their children."

- With additional reporting by Nadia Cameron