Laws introducing increased penalties for data breaches announced in response to the Facebook Cambridge Analytica scandal will not be passed before the election despite being announced by the federal government more than three years ago.
In March 2019 then-Attorney-General Christian Porter unveiled plans to significantly increase the penalty for breaches of privacy by social media firms and to give the privacy watchdog further enforcement powers.
These reforms stalled until more than two years later in late 2021, when new Attorney-General Michaelia Cash re-announced the increased penalties along with plans for a binding Online Privacy code for these social media firms.
Despite being dubbed “landmark privacy legislation” and listed for introduction to the Senate in the last sitting week before the election, the bill was not introduced at all before Parliament rose for the last time ahead of the May vote.
That means that despite first announcing the online privacy bill more than three years ago, the increased penalties and privacy code won’t be in force until well after the election.
The Coalition also failed to pass its controversial “anti-trolling” bill, which it positioned as another online safety-focused piece of legislation.
A spokesperson for the Attorney-General’s Department said the bill was set to be introduced to Parliament on 30 March, but the government opted to “prioritise key budget bills and time-critical legislation to support flood victims, protect Australia’s critical infrastructure and strengthen penalties for firearms traffickers”.
“A procedural motion moved that day to rearrange the Senate’s schedule to facilitate the passage of time-critical legislation meant that the part of the Senate program containing bill introductions was removed from the program, as a result of which the Online Privacy Bill was not introduced,” the spokesperson told InnovationAus.com.
“It is expected that the government will introduce the bill in the next term of Parliament.”
More than three years after first promising the reforms, the Coalition unveiled the “landmark privacy legislation” in October last year. The bill included a requirement for a wide range of tech firms to verify the age of users and to obtain parental consent for users aged under 16 years old.
It also laid the groundwork for a binding Online Privacy code to be developed by industry and introducing new protections for children and a requirement for tech firms to take “reasonable” steps to verify the age of their users.
The bill would have also introduced the increased penalties for data breaches for social media firms.
The maximum penalty for a data breach under the Privacy Act would have been increased from $2.1 million to $10 million, or 10 per cent of the company’s annual domestic turnover, whichever figure is larger.
The privacy watchdog would also have received new infringement notice powers with new penalties of up to $63,000 for companies and $12,600 for individuals who fail to assist to resolve a data breach.
In announcing these reforms, the government acknowledged that the existing data breach penalties regime “falls short of community expectation”.
The federal government had planned to release this draft legislation back in the second half of 2019, and then pushed this back to May 2020.
After finally doing this at the end of October last year, the Department conducted six weeks of consultation, receiving 191 submissions and holding 11 roundtable discussions.
A number of civil and digital rights organisations urged the government to drop the requirement in the legislation for tech firms to take “reasonable” steps to verify the age of their users, saying this would undermine privacy and that attempts to do this in other countries had “failed comprehensively”.
Digital Rights Watch said that this part of the bill was “deeply concerning” and “privacy-invasive”.
Legislation providing a “new novel framework” for responding to defamatory content posted on social media was also not passed before the upcoming election, despite the government promising it would be “dealt” with in February.
Do you know more? Contact James Riley via Email.