Dear Chair
I welcome the opportunity to make a submission to the Committee’s inquiry into the Treasury Laws Amendment (News Media and Digital Platforms Mandatory Bargaining Code) Bill 2020 (the Bill). The Bill will amend the Competition and Consumer Act 2010 (Cth) to establish a mandatory code of conduct to address bargaining power imbalances between digital platforms and Australian news media businesses (the Code).
The Office of the Australian Information Commissioner (OAIC) is an independent Commonwealth regulator, established to bring together three functions: privacy functions (protecting the privacy of individuals under the Privacy Act 1988 (Cth) (Privacy Act) and other legislation), freedom of information functions (access to information held by the Commonwealth Government in accordance with the Freedom of Information Act 1982 (Cth)), and information management functions (as set out in the Information Commissioner Act 2010 (Cth)).
Digital platforms collect large amounts of user data about individuals through their interactions on the platform, including through their interactions with news content published or distributed on their services. User data is likely to include personal information[1] as well as anonymised, pseudonymised or aggregated data. Privacy protections in the Privacy Act apply to the handling of personal information.
The OAIC has engaged with the Treasury and the Australian Competition and Consumer Commission (ACCC) throughout the development of the Code to ensure that it achieves its objective of supporting the sustainability of the Australian news media sector by addressing the bargaining power imbalances that exist with digital platforms in a way that protects personal information and minimises privacy impacts for individuals.[2] The OAIC is supportive of the current approach in the Bill outlined further below, which will ensure the protections in the Privacy Act will continue to apply to any data sharing between the relevant parties.
Minimum standards – Giving explanations of information
The Code contains a series of ‘minimum standards’ that digital platforms must comply with in their dealings with news media businesses. These minimum standards include, amongst other things, a requirement for digital platforms to provide news media businesses with an explanation of the data they currently collect through news content.
The Bill and the explanatory memorandum state that the obligations imposed by this minimum standard are not intended to implement new data sharing measures or authorise the disclosure of identifiable user data. Rather, the purpose of this requirement is to provide a minimum level of transparency so that all news businesses are aware of the types of information that are being provided to other news businesses.[3] Consequently, any disclosure of personal information between the bargaining parties will continue to be subject to the requirements of the Privacy Act.
The OAIC is supportive of this approach. As noted in the OAIC’s submission on the ACCC’s Mandatory news media bargaining code – Concepts paper, it is important to recognise that there are privacy risks inherent in sharing any user data, whether in identified, anonymised, pseudonymised or aggregated form. Even where anonymised or aggregated information is shared, the risks of re-identification may remain.
Accordingly, it is critical that the protections in the Privacy Act should continue to apply without derogation to ensure that individuals’ privacy is not directly impacted as a result of the Code. Throughout the development of the Code, my Office has also been concerned to ensure that the Code does not require or authorise additional personal information handling practices by digital platforms and news media businesses.
To this end, I note the inclusion of cl 52ZB of the Bill addresses these concerns, which states that ‘Nothing in this Division requires or authorises the giving of information that is personal information (within the meaning of the Privacy Act 1988).’ A similar provision has also been included at cl 52ZT(13) in relation to information requests by bargaining parties. I also note that cl 52R(5) makes clear that digital platforms are not required to provide the actual data on user interactions with news content, the platforms will only need to provide a list or explanation of the types of data collected.
I understand that news media businesses may elect to negotiate with digital platforms for access to more user data but the protections in the Privacy Act will continue to apply and any personal information sharing must be in compliance with the Privacy Act. Any negotiations between parties to share user data warrant careful consideration to ensure the handling of user data is consistent with the Privacy Act and community expectations. The OAIC generally expects digital platforms and news media businesses would undertake a privacy impact assessment, either independently or jointly, of any proposed arrangements to share user data, particularly those that pose a high privacy risk.[4]
Should you require further information about any aspect of this submission please contact Sarah Croxall, Director, Regulation and Strategy Branch [contact details removed].
Yours sincerely
Angelene Falk
Australian Information Commissioner
Privacy Commissioner
13 January 2021
Footnotes
[1] ‘Personal information’ means ‘information or an opinion about an identified individual, or an individual who is reasonably identifiable.’ See Privacy Act 1988 (Cth), s 6(1).
[2] See the OAIC’s submissions on the Mandatory news media bargaining code – Concepts paper – submission to Australian Competition and Consumer Commission and Exposure Draft: Treasury Laws Amendment (News Media & Digital Platforms Mandatory Bargaining Code) Bill 2020.
[3] Explanatory Memorandum, Treasury Laws Amendment (News Media and Digital Platforms Mandatory Bargaining Code) Bill 2020, pg 29.
[4] A privacy impact assessment is a systematic assessment of a project that identifies the impact that the project might have on the privacy of individuals, and sets out recommendations for managing, minimising or eliminating those impacts.
