What you need to know:

• Most responses to the proposed changes to the Privacy Act hew closely to the polite norms of the business sector's regulatory and compliance club – all coded signals and deferential language. Then there's Oracle Corp, the giant American software firm with over $US50bn in revenues and a $320bn market cap, with an axe to grind, and a rhetorical baseball bat with five big notches on it.
• Oracle's submission is a brutal attack on its rivals, describing their data collection approaches as intrusive and excessive, and in Google's case a business model that is antithetical to privacy-by-design, and the source of its market power and anti-competitive misconduct.
• Go hard or go home Oracle tells the Attorney General's department, or consumers and the wider Australian economy will continue to suffer harm.
• Per Oracle: "Without urgent reform, the egregious behaviour of Google and other digital platforms which Australians cannot avoid in their daily lives and online interactions will continue.”

Enterprise technology giant Oracle has savaged digital platform providers Alphabet, Amazon, Apple, Meta, and Microsoft in its response to the Attorney General’s proposed privacy legislation. It describes their data collection approaches as intrusive, excessive and harmful to Australia's consumers and economy.

It claims the data collection practices of the global digital platforms are undeniably linked to their anti-competitive business practices, and fingers Google’s behaviour in adtech as the posterchild.

Amid a broad spray, Google — which Oracle competes with in the enterprise cloud market (as it does Microsoft and Amazon) — comes in for special treatment.

“Google’s dominant position across a range of consumer facing digital services means that Google can impose unfair terms on individuals in relation to Google’s personal information collection, use and monetisation practices through its privacy policy and terms of service. Consumers have little choice but to agree to these terms.”

These terms, per Oracle, result in Google collecting vast quantities of personal information through Android OS as well as its consumer facing services.

“Google also collects consumer data through its ad tech services as, through these services, Google obtains data about how consumers interact with ads, which is data about a consumer’s interests and preferences. Personal information plays a crucial role in the provision of ad tech services.”

“The more robust Google’s consumer data pool is, the better Google's ad targeting becomes, and the more advertisers are driven to Google's ad tech services. Google’s dominant position in the ad tech services markets has, in turn, allowed it to engage in many of the different types of anti-competitive conduct that the ACCC identified in the final report from its Ad Tech Inquiry.”

It’s rare to find a huge IT vendor arguing for greater regulatory intervention, but here it is: “There is an urgent need to reform the Privacy Act to provide protections to Australians in the face of the ever more intrusive data collection practices engaged in by digital platform behemoths such as Google.”

“Without urgent reform, the egregious behaviour of Google and other digital platforms which Australians cannot avoid in their daily lives and online interactions will continue.”

The submission argues that Google’s very business model is the antithesis of the “privacy by design” philosophy underlying the proposed changes to the Privacy Act.

“Google’s business model is built on unfair, unrepentant and unrestrained data collection that no reasonable consumer can avoid.”

Addressing the wider platform ecosystem, Oracle argues: “The ways the platforms collect, use, and monetise personal information erodes Australians’ trust in the digital economy and is inconsistent with the objectives of the Privacy Act.”

Think of the children

Oracle also guns more broadly for the digital platforms' various privacy policies, which it claims are really data collection policies. It describes them as confusing and hard to understand. “Not only do the platforms collect unnecessary amounts of data from consumers, but that consumers do not and cannot know the true extent of the personal information collection they are agreeing to", rendering informed consent to use that data impossible.

Worse still, according to the submission, the digital platform providers are even less transparent about how consumers’ personal information will be monetised and used. “Personal information is made available through the monetisation practices of these platforms, not only to third-party advertisers but also to others, harming both adults and children”.

Oracle adds that an overhaul to the Privacy Act to protect teens and children from deceptive online ads and digital manipulation are long overdue, all of which, it should be noted, would add considerably to the cost of doing business for the digital platforms competing with Oracle’s own cloud computing operation.

While the ACCC is forming a pincer movement with the Attorney General in moving to regulate data brokers, software vendor which generates over $US50bn annually suggests that its own Oracle Advertising (OA) business is little more than a rounding error – and its data broking operation clean.

“OA’s data brokerage business is subject to regulations that the largest digital platforms have skirted, despite their much more pervasive and damaging personal information collection practices. This is particularly true of Google and its parent company Alphabet, but also other global platforms, such as Meta and Amazon."

That's not a knife...

While many of the industry submissions seem tactfully intent on shepherding the regulators away from strengthening the definition of personal information, Oracle takes a thoroughly contrarian stance, aiming to puncture the firewall many in the business community are trying to build around that definition to ensure it remains contained. Go harder, it urges.

“The definition of personal information in the Privacy Act should be updated to reflect the various ways new products and services create, collect, and process data that is intimately tied to a consumer,” Oracle argues.

It maintains the definition of personal information in the Privacy Act should be expanded to "include data that is uniquely and intimately tied to an individual consumer – for example their precise geolocation data, is an essential privacy protection for modern life. Additionally, unique electronic identifiers such as a smartphone’s IMEI or an account identifier should be recognised as equally as sensitive as email addresses, because they can identify an individual and/or their devices.”

It further notes that even “coarse” location data revealing that an individual is within a certain city "could be used to infer sensitive personal information."

“The Privacy Act should therefore also include an acknowledgement that inferred information may be sensitive information, even if the source or sources used to make the inference are not.”

Broker me this

When it comes to the topics of targeting, trading and disclosure, the submissions whacks Google and Facebook specifically.

“Google and Meta – companies that generate nearly all their revenue from advertising – proudly claim they do not sell consumer data, but how then do they make money? Advertising dependent companies like Google and Meta are built on business models that depend on the collection of personal information across their products and services to sell targeted ads, though, at least in the case of Google, it does not actually disclose that personal information to third parties.”

Oracle argues that both companies maintain their market dominance by acting as brokers to consumers’ personal information, matching buyers of advertisements with consumers that meet advertisers’ specific requirements.

“While consumers’ personal information is not directly disclosed to an advertiser, within the meaning given to that term by the OAIC, it is shared and monetised – to the tune of $100s of billions of dollars each year.”

As such, Oracle says this method of personal information sharing and monetisation should be included in a new definition of disclose under the Privacy Act "to ensure consumers are protected from abuses related to the unfettered and uncontrolled use of their personal information. Failure to do so will neuter the Privacy Act’s impact."

Damascene conversion?

Oracle was hit with a class action in the US last year alleging it built its own worldwide surveillance machine that violated the privacy of the most people on the planet. "Oracle is an important part of the tracking and data industry. It has claimed to have amassed detailed dossiers on 5 billion people, and generates $42.4 billion in annual revenue," per Dr. Johnny Ryan, one of the lead plaintiffs. Some of the initial allegations against Oracle were trimmed back, but the case remains in play in the US District Court for the Northern District of California.

Oracle’s data stores include name, home address, email, purchases online and in the real world, physical movements in the real world, income, interests and political views, and a detailed account of online activity, the plaintiffs claim.

Consent is a key part of the case. Those included the the ID Graph compiled by Oracle “lack a direct relationship with Oracle and have no reasonable or practical basis upon which they could legally consent to Oracle’s surveillance,” per the complaint.

Yet Oracle, which got its name from a secret project run by its first ever customer - the CIA - appears keen to see a reshaped data-privacy regime and competitive landscape in Australia. The firm concludes its submission by suggesting unless the ACCC and Attorney General show their teeth and take the high ground, the whole thing risks ending up a white elephant.

"Without the adoption of a consistent approach to the regulation of the largest digital platforms, neither the new digital platforms regulation nor the Privacy Act reforms will have the intended positive outcomes of providing more control to individuals over their personal information and promoting competition and innovation in online markets.”