Newsletter of 4 May 2024

APF Board members continue their efforts to influence policy in privacy-sensitive ways.

The load continues to be high, and we need more contributors. That way we can deepen, but also to diversify, the insights that we bring to environmental scanning, evidence-gathering, analysis and the presentation of arguments.

This Newsletter features an invitation to participate in a privacy-relevant focus group, and APF media media activity in the health area and in relation to cars and privacy.

The Board is currently considering a draft Policy Statement by a contributor on 'Privacy and Promiscuous Motor Vehicles'.

Two recent articles quote APF Board Chair David and another active member, Katharine:

• Toyota and Driver Data Privacy Concerns
• Cars Are A Privacy Nightmare on Wheels

Another Board member and past Chair of APF's Health Committee, Bernard, was quoted at length on "The AI Healthcare Boom".

And the current Chair, Juanita, has very recently finalised a Submission on the National Health (Privacy) Rules to the (still anti-privacy) OAIC.

APF has been approached by researchers well-known to APF Board-members, requesting that we draw to APF members' attention a project that the researchers are conducting.

The project aims to understand how 'communication' is understood by diverse consumers, with the view to better inform the regulation of digital communications technologies.

The project is funded by ACCAN and conducted by researchers from Deakin University and the Victorian University of Wellington.

Participation will involve an approximately 90-minute focus group and seeks a wide range of consumer perspectives to discuss the concept of communication. Auslan interpreters are available for the focus groups where needed.

Please note participation is voluntary and there is no obligation to participate.

If you decide not to participate there will be no impact on you or your relationship with the researchers or Deakin University, Victorian University of Wellington or ACCAN. Participants will receive a $50 gift card to compensate their time and must be Australian, 18 years or older and speak English.

Details are available as follows:

• A4 recruitment flyer
• A6 recruitment flyer
• Focus Group Plain Language Statement and Consent Form

If you are interested, please scan the QR code on one of the flyers to fill out a Qualtrics survey to participate, or return the signed consent form via email to: definingcomm@deakin.edu.au

[This study has received Deakin university ethics approval (2023-293)]

Roger Clarke, as APF Secretary

Newsletter of 4 May 2024

APF Board members continue their efforts to influence policy in privacy-sensitive ways.

The load continues to be high, and we need more contributors. That way we can deepen, but also to diversify, the insights that we bring to environmental scanning, evidence-gathering, analysis and the presentation of arguments.

This Newsletter features an invitation to participate in a privacy-relevant focus group, and APF media media activity in the health area and in relation to cars and privacy.

The Board is currently considering a draft Policy Statement by a contributor on 'Privacy and Promiscuous Motor Vehicles'.

Two recent articles quote APF Board Chair David and another active member, Katharine:

• Toyota and Driver Data Privacy Concerns
• Cars Are A Privacy Nightmare on Wheels

Another Board member and past Chair of APF's Health Committee, Bernard, was quoted at length on "The AI Healthcare Boom".

And the current Chair, Juanita, has very recently finalised a Submission on the National Health (Privacy) Rules to the (still anti-privacy) OAIC.

APF has been approached by researchers well-known to APF Board-members, requesting that we draw to APF members' attention a project that the researchers are conducting.

The project aims to understand how 'communication' is understood by diverse consumers, with the view to better inform the regulation of digital communications technologies.

The project is funded by ACCAN and conducted by researchers from Deakin University and the Victorian University of Wellington.

Participation will involve an approximately 90-minute focus group and seeks a wide range of consumer perspectives to discuss the concept of communication. Auslan interpreters are available for the focus groups where needed.

Please note participation is voluntary and there is no obligation to participate.

If you decide not to participate there will be no impact on you or your relationship with the researchers or Deakin University, Victorian University of Wellington or ACCAN. Participants will receive a $50 gift card to compensate their time and must be Australian, 18 years or older and speak English.

Details are available as follows:

• A4 recruitment flyer
• A6 recruitment flyer
• Focus Group Plain Language Statement and Consent Form

If you are interested, please scan the QR code on one of the flyers to fill out a Qualtrics survey to participate, or return the signed consent form via email to: definingcomm@deakin.edu.au

[This study has received Deakin university ethics approval (2023-293)]

Roger Clarke, as APF Secretary

Alysson Watson, Associate lecturer in journalism, University of Newcastle

The family of Ash Good, one of the Bondi stabbing victims and the mother of the nine-month-baby who was also stabbed, issued a plea overnight for media to stop reproducing photos of Ash, her partner and their baby without consent.

Good, 38, was an osteopath who liked to exercise, post photographs of her young family and share thoughts on new motherhood: the endless nights and blurry days, the joy, the anxiety, the “indescribable love”.

Journalists discovered this from “mining” her (and her friends’ and family’s) social media accounts.

As well as Good’s family, federal politician Allegra Spender, whose electorate of Wentworth covers Westfield Bondi Junction, posted on social media a plea for “the media and everyone” to respect the wishes of those affected by the “tragedy at Bondi Junction”.

She wrote: “I have been contacted by Ash’s family. They have asked the media not to publish personal images from social media. I ask the media and everyone to respect their wishes.”

But will the victims’ privacy be respected? My research indicates that is unlikely.

What can, and can’t, journalists do?

The practice of journalists taking photos from social media, both with and without consent, is now commonplace, and is sanctioned in Australia by law and by professional codes, with some caveats.

Journalists are exempted from the Privacy Act “in the course of journalism”, and while advice from professional bodies such as the Australian Press Council and the Australian Communications and Media Authority (ACMA) is to tread with caution when reproducing images from social media, they do permit publication “in the public interest”. So do the guidelines of media companies, including the ABC.

The ethical code that binds member journalists in Australia, the MEAA Code of Ethics, also advises journalists to respect privacy and grief. It gives them the right not to intrude, but tempers this advice with a “guidance clause” about their capacity to override standards if publication is in the public interest.

The “public interest” is a nebulous concept that increasingly extends to “what the public is interested in”.

The modern-day ‘death knock’

As citizens and news consumers, we want information about everyone who is impacted, and it is the job of news reporters to feed the hungry beast that is digital news. How can they resist the intensely personal content that is shared on “public” social media accounts which gives such a human face to tragedy? Is it reasonable to expect them to?

These are questions I am exploring though my PhD research into the practice journalists informally (and perhaps unpalatably) call the “death knock”.

On hearing of a newsworthy death (or crime or major incident), journalists will do whatever they can to get information about the people impacted – the perpetrators, victims, and witnesses.

The job of gathering news is to find the most credible sources, and, in addition to expert voices (such as police, ambulance, health authorities and politicians), those who know something about the event or the people impacted.

Should journalists ask for permission?

Increasingly, in the digital age, newsgathering starts (and sometimes ends) with journalists mining social media.

Journalists use social media as a tool to find people they want to interview, but also as a source of information, images and tributes.

If people’s accounts are set to “public”, there is nothing to stop journalists using the photos and comments they find there in their stories.

Some journalists will pause and ask for permission, but not all will, and most do not feel compelled to.

However, my research indicates that journalists, by and large, are not thoughtless when it comes to what some view as stealing images from social media. They face enormous pressure to do so, from colleagues, editors and competitors.

Many argue that if images are in the public domain, they are fair game. And if everyone else is doing it, why wouldn’t they? They may ask themselves “how can I tell my boss I’m not going to do it when our competitors have already done it? If I pause to ask for permission, will I be scooped? What if I don’t hear back? What if permission is refused?”

In the UK, where protections from media harassment are arguably stronger, people impacted by tragedy are advised to check their social media privacy settings or delete material altogether.

This though assumes users are social media-literate, but journalists are “very adept at finding ways around privacy settings, and won’t hesitate to do so in pursuit of a story or photo”.

A better path forward?

Reporting on tragedy is routine work for many journalists, but it can take its toll, sometimes in the form of moral injury, when they feel compelled to break their own moral code.

My research indicates journalists want better preparation, guidance, and support from their employers in reporting tragedy, and they want to be listened to about the impacts of this work on them.

However, in the realm of the “digital death knock” – the use of social media to report on tragedy – some argue that an ethical approach alone cannot stem what some believe is egregious behaviour, and that legislative (citizen privacy protections) and normative (stronger advice from professional bodies) approaches may be needed to protect journalists from themselves – and better protect people who fall victim to tragedy.

This article is republished from The Conversation under a Creative Commons license. Read the original article.

Margarita Vladimirova, PhD in Privacy Law and Facial Recognition Technology, Deakin University

The morning started with a message from a friend: “I used your photos to train my local version of Midjourney. I hope you don’t mind”, followed up with generated pictures of me wearing a flirty steampunk costume.

I did in fact mind. I felt violated. Wouldn’t you? I bet Taylor Swift did when deepfakes of her hit the internet. But is the legal status of my face different from the face of a celebrity?

Your facial information is a unique form of personal sensitive information. It can identify you. Intense profiling and mass government surveillance receives much attention. But businesses and individuals are also using tools that collect, store and modify facial information, and we’re facing an unexpected wave of photos and videos generated with artificial intelligence (AI) tools.

The development of legal regulation for these uses is lagging. At what levels and in what ways should our facial information be protected?

Is implied consent enough?

The Australian Privacy Act considers biometric information (which would include your face) to be a part of our personal sensitive information. However, the act doesn’t define biometric information.

Despite its drawbacks, the act is currently the main legislation in Australia aimed at facial information protection. It states biometric information cannot be collected without a person’s consent.

But the law doesn’t specify whether it should be express or implied consent. Express consent is given explicitly, either orally or in writing. Implied consent means consent may reasonably be inferred from the individual’s actions in a given context. For example, if you walk into a store that has a sign “facial recognition camera on the premises”, your consent is implied.

But using implied consent opens our facial data up to potential exploitation. Bunnings, Kmart and Woolworths have all used easy-to-miss signage that facial recognition or camera technology is used in their stores.

Valuable and unprotected

Our facial information has become so valuable, data companies such as Clearview AI and PimEye are mercilessly hunting it down on the internet without our consent.

These companies put together databases for sale, used not only by the police in various countries, including Australia, but also by private companies.

Even if you deleted all your facial data from the internet, you could easily be captured in public and appear in some database anyway. Being in someone’s TikTok video without your consent is a prime example – in Australia this is legal.

Furthermore, we’re also now contending with generative AI programs such as Midjourney, DALL-E 3, Stable Diffusion and others. Not only the collection, but the modification of our facial information can be easily performed by anyone.

Our faces are unique to us, they’re part of what we perceive as ourselves. But they don’t have special legal status or special legal protection.

The only action you can take to protect your facial information from aggressive collection by a store or private entity is to complain to the office of the Australian Information Commissioner, which may or may not result in an investigation.

The same applies to deepfakes. The Australian Competition and Consumer Commission will consider only activity that applies to trade and commerce, for example if a deepfake is used for false advertising.

And the Privacy Act doesn’t protect us from other people’s actions. I didn’t consent to have someone train an AI with my facial information and produce made-up images. But there is no oversight on such use of generative AI tools, either.

There are currently no laws that prevent other people from collecting or modifying your facial information.

Catching up the law

We need a range of regulations on the collection and modification of facial information. We also need a stricter status of facial information itself. Thankfully, some developments in this area are looking promising.

Experts at the University of Technology Sydney have proposed a comprehensive legal framework for regulating the use of facial recognition technology under Australian law.

It contains proposals for regulating the first stage of non-consensual activity: the collection of personal information. That may help in the development of new laws.

Regarding photo modification using AI, we’ll have to wait for announcements from the newly established government AI expert group working to develop “safe and responsible AI practices”.

There are no specific discussions about a higher level of protection for our facial information in general. However, the government’s recent response to the Attorney-General’s Privacy Act review has some promising provisions.

The government has agreed further consideration should be given to enhanced risk assessment requirements in the context of facial recognition technology and other uses of biometric information. This work should be coordinated with the government’s ongoing work on Digital ID and the National Strategy for Identity Resilience.

As for consent, the government has agreed in principle that the definition of consent required for biometric information collection should be amended to specify it must be voluntary, informed, current, specific and unambiguous.

As facial information is increasingly exploited, we’re all waiting to see whether these discussions do become law – hopefully sooner rather than later.

Correction: we have amended a sentence to clarify Woolworths use camera technology but not necessarily facial recognition technology.

This article is republished from The Conversation under a Creative Commons license. Read the original article.

Katharine Kemp, Senior Lecturer, Faculty of Law & Justice, UNSW Sydney

New research reveals serious privacy flaws in fertility apps used by Australian consumers – emphasising the need for urgent reform of the Privacy Act.

Fertility apps provide a number of features. For instance, they may help users track their periods, identify a “fertile window” if they’re trying to conceive, track different stages and symptoms of pregnancy, and prepare for parenthood up until the baby’s birth.

These apps collect deeply sensitive data about consumers’ sex lives, health, emotional states and menstrual cycles. And many of them are intended for use by children as young as 13.

My report published today analysed the privacy policies, messages and settings of 12 of the most popular fertility apps used by Australian consumers (excluding apps that require a connection with a wearable device).

This analysis uncovered a number of concerning practices by these apps including:

• confusing and misleading privacy messages
• a lack of choice in how data are used
• inadequate de-identification measures when data are shared with other organisations
• retention of data for years even after a consumer stops using the app, exposing them to unnecessary risk from potential data breaches.

The data collected

The apps in this study collect intimate data from consumers, such as:

• their pregnancy test results
• when they have sex and whether they had an orgasm
• whether they used a condom or “withdrawal” method
• when they have their period
• how their moods change (including anxiety, panic and depression)
• and if they have health conditions such as polycystic ovary syndrome, endometriosis or uterine fibroids.

Some ask for unnecessary details, such as when a user smokes and drinks alcohol, their education level, whether they struggle to pay their bills, if they feel safe at home, and whether they have stable housing.

They also track which support groups you join, what you add to your “to-do list” or “questions for doctor”, and which articles you read. All of this creates a more detailed picture of your health, family situation and intentions.

Confusing or misleading privacy messages

Consumers should expect the clearest information about how such data are collected, used and disclosed. Yet we found some of the messaging is highly confusing or misleading.

Some apps say “we will never sell your data”. But the fine print of the privacy policy contains a term that allows them to sell all your data as part of the sale of the app or database to another company.

This possibility is not just theoretical. Of the 12 apps included in the study, one was previously taken over by a drug development company, and another two by a digital media company.

Other apps explain privacy settings using language that makes it almost impossible for a consumer to understand what they are choosing, or obscure the privacy settings by placing them numerous clicks and scrolls away from the home screen.

Keeping sensitive data for too long

The major data breaches of the past six months highlight the risks of companies holding onto personal data longer than necessary.

Breaches of highly sensitive information about health and sexual activities could lead to discrimination, exploitation, humiliation or blackmail.

Most of the apps we analysed keep user data for at least three years after the user quits the app – or seven years in the case of one brand. Some apps give no indication of when user data will be deleted.

Can’t count on ‘de-identification’

Some apps also give consumers no choice regarding whether their “de-identified” health data will be sold or transferred to other companies for research or business. Or, they have consumers opted-in to these extra uses by default, putting the onus on users to opt out.

Moreover, some of these data are not truly de-identified. For example, removing your name and email address and replacing it with a unique number is not de-identification for legal purposes. Someone would only need to work out the link between your name and that number in order to link your whole record with you.

When supposedly de-identified Medicare records were published in 2016, University of Melbourne researchers showed how just a few data points can connect a de-identified record to a unique individual.

Need for reform

This research highlights the unfair and unsafe data practices consumers are subjected to when they use fertility apps. And these findings reinforce the need for Australia’s privacy laws to be updated.

We need improvements in what data are covered by the Privacy Act, what choices consumers can make about their data, what data uses are prohibited, and what security systems companies must have in place.

The government is seeking submissions on potential privacy law reforms until March 31.

In the meantime, if you’re using a fertility app, there are some steps you can take to help reduce some of the privacy risks:

1. when launching the app for the first time, don’t agree to tracking of your data, or you can limit ad tracking via iPhone device settings
2. don’t log in via a social media account
3. don’t answer questions or add data you don’t need to for your own purposes
4. don’t share your Apple Health or FitBit data
5. if the app provides privacy choices, opt out of tracking and having your data sold or used for research, and delete your data when you stop using the app
6. bear in mind that every article you read, and how long you spend on it, and every group you join and comment you make there may be added to a profile about you.

This article is republished from The Conversation under a Creative Commons license. Read the original article.

In the recently released Privacy Act Review Report, the Attorney-General’s Department makes numerous important proposals that could see the legislation, enacted in 1988, begin to catch up to leading privacy laws globally.

Among the positive proposed changes are: more realistic definitions of personal information and consent, tighter limits on data retention, a right to erasure, and a requirement for data practices to be fair and reasonable.

However, the report’s proposals on targeted advertising don’t properly address the power imbalance between companies and consumers. Instead, they largely accept a status quo that sacrifices consumer privacy to the demands of online targeted ad businesses.

Capturing personal information used to track and profile

Obligations under the existing Privacy Act only apply to “personal information”, but there has been legal uncertainty about what exactly constitutes “personal information”.

Currently, companies can track an individual’s online behaviour across different websites and connect it with their offline movements by matching their data with data collected from third parties, such as retailers or data brokers.

Some of these companies claim they’re not dealing in “personal information” since they don’t use the individual’s name or email address. Instead, the matching is done based on a unique identifier allocated to that person – such as a hashed email, for example.

The report proposes an expanded definition of “personal information” that clearly includes the various technical and online identifiers being used to track and profile consumers. Under this definition, companies could no longer claim such data collection and sharing are outside the scope of the Privacy Act.

Improved consent (when required)

The report also proposes higher standards for how consent is sought, in cases where the act requires it. This would require voluntary, informed, current, specific and unambiguous consent.

This would work against organisations claiming consumers have consented to unexpected data uses just because they used a website or an app with a link to a broadly worded privacy policy with take-it-or-leave-it terms.

For example, companies would need to demonstrate the higher standard of consent to collect sensitive information about someone’s mental health or sexual orientation. The report also proposes that some further data practices, such as precise geolocation tracking, should require consent.

However, it specifically states consent should not be required for some targeted ad practices. Yet surveys show most consumers regard these as misuses of their personal information.

‘Fair and reasonable’ data practices

The report proposes a “fair and reasonable” test for dealings with personal information in general.

This recognises that consumers are saddled with too much of the responsibility for managing how their personal information is collected and used, while they lack the information, resources, expertise and control to do this effectively.

Instead, organisations covered by the Privacy Act should ensure their data handling practices are “fair and reasonable”, regardless of whether they have consumer consent. This would include considering whether a reasonable person would expect the data to be collected, used or disclosed in that way, and whether any dealing with children’s information is in the best interests of the child.

Prohibiting targeted ads based on sensitive information

The report proposes the prohibition of targeting based on sensitive information and traits. However, it’s not always easy to draw the line between “sensitive” information or traits, and other personal information.

For instance, is having an interest in “cosmetic procedures” or “rapid weight loss” a sensitive trait, or a general reading interest? Companies may exploit such grey areas. So while prohibiting targeting based on sensitive information is appropriate, it’s not enough in itself.

Another loophole arises in the report’s proposal that consumer consent should be necessary before an organisation trades in their personal information. The report leaves open an exception to this consent requirement where the “trading” is reasonably necessary for an organisation’s functions or activities.

This may be a substantial exception: data brokers, for example, might argue their trade in personal information (without consumers’ knowledge or consent) is necessary.

Opt out only, not opt in

Both the ACCC and the UK Competition & Markets Authority have recommended consumers should opt in to the use of their personal information for targeted advertising if they wish to see this content.

But the report proposes individuals should only be allowed to opt out of “seeing” targeted ads. This still wouldn’t stop companies from collecting, using and disclosing a user’s personal information for broader targeting purposes.

Even if a consumer opts out of seeing targeted ads, a business may continue to collect their personal information to create “lookalike audiences” and target other people with similar attributes.

Although having the option to opt out of seeing targeted ads gives consumers some limited control, companies still control the “choice architecture” of such settings. They can use their control to make opting out confusing and difficult for users, by forcing them to navigate through multiple pages or websites with obscurely labelled settings.

Are targeted ads necessary to support online services?

This limitation of consumers’ choices was partly explained by the view of the Attorney-General’s Department that targeted ads are necessary to fund “free” services. This refers to services where consumers “pay” with their attention and data (which companies use to make revenue from targeted advertising).

However, many companies using customers’ personal information for targeted ad businesses aren’t providing free services. Consider online marketplaces such as Amazon or eBay, or subscription-based products of media companies such as NewsCorp and Nine.

Meta (Facebook) and the Interactive Advertising Bureau Australia argued that if consumers opt out of targeted ads, a company should be able to stop offering them the service in question. This proposal was rejected on the basis that a platform can still show non-targeted ads to such consumers.

Inconsistently, the report failed to question broader claims that targeted advertising – as opposed to less intrusive forms of advertising – must be protected for online services to be viable.

Real change is needed

The reform of our privacy laws is long overdue. The government should avoid watering down potential improvements by attempting to preserve the status quo dictated by large businesses.

The government is seeking feedback on the report until March 31. It will then decide on the final form of the reforms it proposes, before these are debated in Parliament.

This article is republished from The Conversation under a Creative Commons license. Read the original article.

Ausma Bernot, PhD Candidate, School of Criminology and Criminal Justice, Griffith University

A group of researchers studied 15 months of human mobility movement data taken from 1.5 million people and concluded that just four points in space and time were sufficient to identify 95% of them, even when the data weren’t of excellent quality.

That was back in 2013.

Nearly ten years on, surveillance technologies permeate all aspects of our lives. They collect swathes of data from us in various forms, and often without us knowing.

I’m a surveillance researcher with a focus on technology governance. Here’s my round-up of widespread surveillance systems I think everyone should know about.

CCTV and open-access cameras

Although China has more than 50% of all surveillance cameras installed in the world (about 34 cameras per 1,000 people), Australian cities are catching up. In 2021, Sydney had 4.67 cameras per 1,000 people and Melbourne had 2.13.

While CCTV cameras can be used for legitimate purposes, such as promoting safety in cities and assisting police with criminal investigations, their use also poses serious concerns.

In 2021, New South Wales police were suspected of having used CCTV footage paired with facial recognition to find people attending anti-lockdown protests. When questioned, they didn’t confirm or deny if they had (or if they would in the future).

In August 2022, the United Nations confirmed CCTV is being used to carry out “serious human rights violations” against Uyghur and other predominantly Muslim ethnic minorities in the Xinjiang region of Northwest China.

The CCTV cameras in China don’t just record real-time footage. Many are equipped with facial recognition to keep tabs on the movements of minorities. And some have reportedly been trialled to detect emotions.

The US also has a long history of using CCTV cameras to support racist policing practices. In 2021, Amnesty International reported areas with a higher proportion of non-white residents had more CCTV cameras.

Another issue with CCTV is security. Many of these cameras are open-access, which means they don’t have password protection and can often be easily accessed online. So I could spend all day watching a livestream of someone’s porch, as long as there was an open camera nearby.

Surveillance artist Dries Depoorter’s recent project The Follower aptly showcases the vulnerabilities of open cameras. By coupling open camera footage with AI and Instagram photos, Depoorter was able to match people’s photos with the footage of where and when they were taken.

There was pushback, with one of the identified people saying:

It’s a crime to use the image of a person without permission.

Whether or not it is illegal will depend on the specific circumstances and where you live. Either way, the issue here is that Depoorter was able to do this in the first place.

IoT devices

An IoT (“Internet of Things”) device is any device that connects to a wireless network to function – so think smart home devices such as Amazon Echo or Google Dot, a baby monitor, or even smart traffic lights.

It’s estimated global spending on IoT devices will have reached US$1.2 trillion by some point this year. Around 18 billion connected devices form the IoT network. Like unsecured CCTV cameras, IoT devices are easy to hack into if they use default passwords or passwords that have been leaked.

In some examples, hackers have hijacked baby monitor cameras to stalk breastfeeding mums, threaten parents that their baby was being kidnapped, and say creepy things like “I love you” to children.

Beyond hacking, businesses can also use data collected through IoT devices to further target customers with products and services.

Privacy experts raised the alarm in September over Amazon’s merger agreement with robot vacuum company iRobot. A letter to the US Federal Trade Commission signed by 26 civil rights and privacy advocacy groups said:

Linking iRobot devices to the already intrusive Amazon home system incentivizes more data collection from more connected home devices, potentially including private details about our habits and our health that would endanger human rights and safety.

IoT-collected data can also change hands with third parties through data partnerships (which are very common), and this too without customers’ explicit consent.

Big tech and big data

In 2017, the value of big data exceeded that of oil. Private companies have driven the majority of that growth.

For tech platforms, the expansive collection of users’ personal information is business as usual, literally, because more data mean more precise analytics, more effective targeted ads and more revenue.

This logic of profit-making through targeted advertising has been dubbed “surveillance capitalism”. As the old saying goes, if you’re not paying for it, then you’re the product.

Meta (which owns both Facebook and Instagram) generated almost US$23 billion in advertising revenue in the third quarter of this year.

The vast machinery behind this is illustrated well in the 2021 documentary The Social Dilemma, even if in a dramatised way. It showed us how social media platforms rely on our psychological weaknesses to keep us online for as long as possible, measuring our actions down to the seconds we spend hovering over an ad.

Loyalty programs

Although many people don’t realise it, loyalty programs are one of the biggest personal data collection gimmicks out there.

In a particularly intrusive example, in 2012 one US retailer sent a teenage girl a catalogue dotted with pictures of smiling infants and nursery furniture. The girl’s angered father went to confront managers at the local store, and learned that predictive analytics knew more about his daughter than he did.

It’s estimated 88% of Australian consumers over age 16 are members of a loyalty program. These schemes build your consumer profile to sell you more stuff. Some might even charge you sneaky fees and lure you in with future perks to sell you at steep prices.

As technology journalist Ros Page notes:

[T]he data you hand over at the checkout can be shared and sold to businesses you’ve never dealt with.

As a cheeky sidestep, you could find a buddy to swap your loyalty cards with. Predictive analytics is only strong when it can recognise behavioural patterns. When the patterns are disrupted, the data turn into noise.

This article is republished from The Conversation under a Creative Commons license. Read the original article.

Among the many questions raised by the Optus data leak – cybersecurity experts are confident it wasn’t a hack, but that may have to be decided by a court – is why the company was storing so much personal information for so long.

Optus had a legitimate need to collect that data – to verify customers were real people and potentially to recover any debts later. This is known as a “know your customer” (or “KYC”) requirement.

But the reason about 4 million former customers along with 5.8 million current customers are now worrying about their driver’s licences, passport numbers and Medicare numbers ending up in the hands of criminals is due to Optus hanging on to it for six years.

Optus has said it is legally required to do so.

It is required by the Telecommunications Consumer Protections Code, the industry code of practice overseen by the Australian Communications and Media Authority, to provide customers (or former customers) billing information for “up to six years prior to the date the information is requested”.

But your name, address and account reference number should be all it needs for this, not your passport, driver’s licence or Medicare details. If it needs to confirm your identity it could simply ask for documents again.

The only clear legal requirement for it to keep “information for identification purposes” comes from the Telecommunications (Interception and Access) Act 1979, which requires that identification information and metadata be kept for two years (to assist law enforcement and intelligence agencies).

Is there any limit?

The big problem with Australia’s data retention laws is that there’s really no limit on how long a company can keep personal data.

The federal Privacy Act says only that information must be destroyed “where the entity no longer needs the information for any purpose for which the information may be used or disclosed by the entity”.

That’s a loose requirement. A company could theoretically argue it “needs” to keep customer information for anything – such as defending against a civil claim in court, as part of its corporate records, or for marketing. This is especially the case when we have consented to those uses when we sign up for the services, another practice the Privacy Act allows.

This is a serious weakness with our privacy laws. Consumer data is big business. Companies are collecting – and keeping – much more personal information than they need without a truly legitimate commercial or legal purpose.

I call this trend “hyper-collection”. It’s turning companies into goldfields for hackers. Once personal information is stolen there is often little authorities can do.

It’s time to get serious about data privacy

Australia needs to get more serious about unnecessary data collection and retention. As technology gets more interwoven into our daily lives, protecting personal data presents massive challenges.

The need for vigilance should have been made clear to the federal government in 2020, when its own myGov website was hacked.

The usernames and passwords of thousands of accounts were made available for sale on the dark web. Anyone buying those details would have had access to Medicare, Centrelink, National Disability Insurance Scheme and tax office records.

Privacy laws are too weak both in obligations and penalties. The fines for “serious interference with privacy” are $444,000 for individuals and $2.2 million for companies – hardly enough for a corporation the size of Optus to sit up and take notice. Nor do they offer comfort to those affected.

Legislative action is needed to clarify what information companies can collect, how they can collect it, and what they can do with it.

Opportunities for action

There are two obvious opportunities for the federal government to act.

The first is in its response to recommendations arising from the Attorney-General’s Department’s long-running review of the Privacy Act (which has yet to deliver its final report). Ironically Optus made a submission to the review that actually suggested weakening privacy protections.

The second is what it does with the National Data Security Action Plan being developed by the Department of Home Affairs.

The intention of this plan appears to be to treat data as a national asset. If so, it should strengthen policy and legislation around security, ensure Australians know their rights and responsibilities, and ensure consistent responses to cybercrime.

We need to scrutinise every company – not just Optus, and not just after the fact – and ask questions about their data collection. Why do they need to know things? What information are they keeping, how long for and why?

Without action, the next breach at this kind is a matter of when, not if.

We asked Optus to clarify the reasons it needs to keep identification data for six years but received no response.

This article is republished from The Conversation under a Creative Commons license. Read the original article.

A little-known provision of the Privacy Act makes it illegal for many companies in Australia to buy or exchange consumers’ personal data for profiling or targeting purposes. It’s almost never enforced. In a research paper published today, I argue that needs to change.

“Data enrichment” is the intrusive practice of companies going behind our backs to “fill in the gaps” of the information we provide.

When you purchase a product or service from a company, fill out an online form, or sign up for a newsletter, you might provide only the necessary data such as your name, email, delivery address and/or payment information.

That company may then turn to other retailers or data brokers to purchase or exchange extra data about you. This could include your age, family, health, habits and more.

This allows them to build a more detailed individual profile on you, which helps them predict your behaviour and more precisely target you with ads.

For almost ten years, there has been a law in Australia that makes this kind of data enrichment illegal if a company can “reasonably and practicably” request that information directly from the consumer. And at least one major data broker has asked the government to “remove” this law.

The burning question is: why is there not a single published case of this law being enforced against companies “enriching” customer data for profiling and targeting purposes?

Data collection ‘only from the individual’

The relevant law is Australian Privacy Principle 3.6 and is part of the federal Privacy Act. It applies to most organisations that operate businesses with annual revenues higher than A$3 million, and smaller data businesses.

The law says such organisations:

must collect personal information about an individual only from the individual […] unless it is unreasonable or impracticable to do so.

This “direct collection rule” protects individuals’ privacy by allowing them some control over information collected about them, and avoiding a combination of data sources that could reveal sensitive information about their vulnerabilities.

But this rule has received almost no attention. There’s only one published determination of the federal privacy regulator on it, and that was against the Australian Defence Force in a different context.

According to Australian Privacy Principle 3.6, it’s only legal for an organisation to collect personal information from a third party if it would be “unreasonable or impracticable” to collect that information from the individual alone.

This exception was intended to apply to limited situations, such as when:

• the individual is being investigated for some wrongdoing
• the individual’s address needs to be updated for delivery of legal or official documents.

The exception shouldn’t apply simply because a company wants to collect extra information for profiling and targeting, but realises the customer would probably refuse to provide it.

Who’s bypassing customers for third-party data?

Aside from data brokers, companies also exchange information with each other about their respective customers to get extra information on customers’ lives. This is often referred to as “data matching” or “data partnerships”.

Companies tend to be very vague about who they share information with, and who they get information from. So we don’t know for certain who’s buying data-enrichment services from data brokers, or “matching” customer data.

Major companies such as Amazon Australia, eBay Australia, Meta (Facebook), 10Play Viacom and Twitter include terms in the fine print of their privacy policies that state they collect personal information from third parties, including demographic details and/or interests.

Google, News Corp, Seven, Nine and others also say they collect personal information from third parties, but are more vague about the nature of that information.

These privacy policies don’t explain why it would be unreasonable or impracticable to collect that information directly from customers.

Consumer ‘consent’ is not an exception

Some companies may try to justify going behind customers’ backs to collect data because there’s an obscure term in their privacy policy that mentions they collect personal information from third parties. Or because the company disclosing the data has a privacy policy term about sharing data with “trusted data partners”.

But even if this amounts to consumer “consent” under the relatively weak standards for consent in our current privacy law, this is not an exception to the direct collection rule.

The law allows a “consent” exception for government agencies under a separate part of the direct collection rule, but not for private organisations.

Data enrichment involves personal information

Many companies with third-party data collection terms in their privacy policies acknowledge this is personal information. But some may argue the collected data isn’t “personal information” under the Privacy Act, so the direct collection rule doesn’t apply.

Companies often exchange information about an individual without using the individual’s legal name or email. Instead they may use a unique advertising identifier for that individual, or “hash” the email address to turn it into a unique string of numbers and letters.

They essentially allocate a “code name” to the consumer. So the companies can exchange information that can be linked to the individual, yet say this information wasn’t connected to their actual name or email.

However, this information should still be treated as personal information because it can be linked back to the individual when combined with other information about them.

At least one major data broker is against it

Data broker Experian Australia has asked the government to “remove” Australian Privacy Principle 3.6 “altogether”. In its submission to the Privacy Act Review in January, Experian argued:

It is outdated and does not fit well with modern data uses.

Others who profit from data enrichment or data matching would probably agree, but prefer to let sleeping dogs lie.

Experian argued the law favours large companies with direct access to lots of customers and opportunities to pool data collected from across their own corporate group. It said companies with access to fewer consumers and less data would be disadvantaged if they can’t purchase data from brokers.

But the fact that some digital platforms impose extensive personal data collection on customers supports the case for stronger privacy laws. It doesn’t mean there should be a data free-for-all.

Our privacy regulator should take action

It has been three years since the consumer watchdog recommended major reforms to our privacy laws to reduce the disadvantages consumers suffer from invasive data practices. These reforms are probably still years away, if they eventuate at all.

The direct collection rule is a very rare thing. It is an existing Australian privacy law that favours consumers. The privacy regulator should prioritise the enforcement of this law for the benefit of consumers.

This article is republished from The Conversation under a Creative Commons license. Read the original article.

23 August 2022

We’re combining this newsletter with the Annual Renewal Notice

How to renew

1. Check how much to pay ($275 Life, $40, or $10 concession), here
   Note: If you joined within the last 6 months, it won’t be necessary for you to renew until next year’s notice
2. Pay the relevant amount into this account:
   Bendigo Bank, BSB 633000 A/c No. 126879162
   Include your name, so that we can reconcile the account
3. Email to us, saying you’ve paid

Call for Nominations

As you can see from the brief outline of activities below, the APF Board is buried in work to defend privacy interests. With a couple of recent retirements from the fray by major contributors, we’re short-handed.
Please consider assisting the Board, whether casually on a matter of concern to you, via one of the Committees, or on the Board. Details are here.
If you’re aware of talent who we should be approaching, please put us in contact with them, or vice versa!

Key Aspects of APF Activities during 2021-22

1. Continued busyness, fighting against privacy-invasive behaviours, for privacy-sensitive practices, and for privacy protections. See at the bottom for a quick summary of recent major contributions
2. A shortage of volunteer policy analysts and other active support
3. We’re announcing waiver of the annual fee for volunteers who commit to material assistance in relation to any of the following:
   • research into new technologies, business practices and government initiatives that are likely to have privacy implications
   • drafting and review of proactive Policy Positions
   • drafting and review of submissions in response to policy-influencing opportunities in parliaments, governments and industry sectors
   • frequent social media postings on APF’s behalf, in the appropriate communication-style for one or more particular social media channels
   • drafting of old-fashioned, but still-needed, media releases
   • identification of media reports of suitable quality and relevance, and extraction and posting to the privacy policy e-list of the text and the source, with optional commentary on the topic
   • monthly maintenance of the APF publications index-pages (by date, by topic, and by jurisdiction)

Some Major Areas of Recent APF Activities

The Federal Election

• Media Release of 11 April 2022
• The resulting 2022 Federal Election Scorecard, version of 19 May 22
• The election-result was highly privacy-positive. The new AG has previously supported a privacy right of action, and the large cross-bench comprises Greens and Andrew Wilkie, whose platforms are strongly pro-privacy, plus ‘Teal Liberals’ who are moderately so.

Your(?) ABC Joins the Digital Surveillance Economy
Imposition of Mandatory Registration to use ABC iView

• Open Letter – 2 Mar 22
• ABC Chair Ita Buttrose’s reply of 8 Mar 2022
• Letter to the ABC Chair on 11 May 2022
• Media Release on 15 May 2022
• See also this blog-entry by a past chair of APF

Health Privacy

• Health Legislation Amendment (Information Sharing) Bill 2021 (Vic)
• National Disability Insurance Scheme (NDIS) – a serious data breach
• The unjustifiably demanding ACT COVID ‘Case Investigation’ Form
Health Insurance Companies’ Marketing of Wearables to Consumers

Australia’s Electronic Surveillance Framework

• Submission to Dept of Home Affairs, of 8 Feb 2022, in conjunction with QCCL and Liberty Victoria
• Australian Border Force’s Warrant-less Access to Smartphone Comms