You may or may not be aware that the Privacy Act is currently under reform. Holding together the fabric of your data rights as a consumer and the responsibilities of businesses that use them since 1988, the Australian Government is inching ever so closer to drafting legislation off the back of its official review of the act completed in March.

Read more including our 7 tips to prepare yourself here.

You may or may not be aware that the Privacy Act is currently under reform. Holding together the fabric of your data rights as a consumer and the responsibilities of businesses that use them since 1988, the Australian Government is inching ever so closer to drafting legislation off the back of its official review of the act completed in March.

Recent years have seen several high profile data breaches of Aussies (Cheers Telcos) which has thrust user privacy high in the queue of reforms. It is a reform that the government must handle delicately as one of the biggest users (and spenders) of digital advertising each year.

We want to give you the headlines of the 320 page report containing 116 proposals of amendment and what it means for you. Feel free to read it yourself though…

Whilst nothing is set in stone, we always want our clients to be in the know and on the front foot.

The TL;DR:

1. The whole aim of the process was, and is to protect Australians personal data and give them control.
2. The Government recognises the importance of the public’s trust in new applications of technology, however the question of what constitutes trust and how this is regulated is the core of this document
3. The existing act has a small business (turnover of less than $3m) exemption – the amendments are proposed to include these businesses under the operation of the Act.
4. The current act presently applies to “personal information” which is defined as information “about” an individual who can be identified from it. The proposal will change the definition of ‘personal information’ to mean ‘information that relates to an individual’, which is proposed to include;
5. Contact details
6. Identification numbers
7. Online identifiers
8. Pseudonyms
9. Location data
10. Technical or behavioural data in relation to an individual’s activities, preferences and identity.
11. Inferred information and profiles generated from aggregated information.
12. Section 20 is where digital marketers will want to do their own self interpretation. If section 20’s proposals get through with no adjustments then you will need to understand the new Aussie government definition for “Direct Marketing”, “Targeting” and “Trading” and proposal 20.2 through 20.9.
13. Essentially you’ll have to
14. Easily allow people to opt out of their data being used (identifiable or not)
15. Gain a user’s consent to trade their data (think with Meta to build a LAL)
16. You’re going to have to conduct a Privacy Impact Assessment any time you are looking at conducting an activity with a high privacy risk. Among other things a high privacy risk includes “​​online tracking, profiling and targeting of individuals and geo-location tracking”.

Link to government full report

Link to government one pager

OUR TOP 7 TIPS TO GET READY*

*We don’t know exactly what will and won’t be pushed through and the timeframe of any impact, however if you do these they can only help you.

1. Update your website privacy policy. Honestly the best person to do this is a lawyer. Shopify has a free privacy policy template that you can grab here as a base. You’ll also be required to have a minimum and maximum data retention period.
2. Start a centralised “Advertising Exclusion” list to connect to each of your targeted channels to. Control what you can and exclude these people from everything. If a user opts out of email marketing and then see’s an Instagram ad seconds later, your excuse of “They only opted out of email your honor” probably won’t cut it in the new Act. If you can house this inside your CRM and securely hash the connection – that would be ideal. This is going to become a necessity.
3. Implement and assign ongoing responsibility of a routine data cleanse, update and re-opt in of your channels and systems. Because someone opted in to marcomms 8 years ago, does not mean you should assume consent today.
4. Understand if you’re an Owner, CEO, COO or any title that doesn’t start with “Digital” in fact, that this new Act is likely going to create more work if anything for your marketing team. Marketers are also not lawyers and nor should you expect them to be. Get and give your team support to succeed in what is going to be an uncertain and shifting landscape for years to come. You’ll also want to make sure someones job description inside your organisation includes compliance with this Act. It’s best practice to have one person responsible for data cleaning and maintaining moving forward.
5. Run a risk assessment on your current marketing activity. What if *touches wood* in typical Australian government fashion they just blow things up past the point of necessity and you can no longer use a LAL or custom audience or retarget at all? What’s your plan B to continue new and returning customer growth?
6. The bigger your business, the bigger the cost of compliance is likely to be. Not a bad idea to start banking a few pennies in the balance sheet each month to prepare for any costs associated with becoming compliant. With millions of businesses now not harboring in the safe haven of a $3m turnover exemption, the Government is going to have to provide tools & resources along the way to expect any level of commitment from Australian small and medium businesses.
7. Keep an eye on the big dogs of Meta, Google, Shopify and so on. They will take their time, but they will always find a way to make the most money possible, legally.

‍