Skip to main content
Skip to secondary navigation
Australian Government - Office of the Australian Information Commissioner - Home

Privacy: It's all about you

Presentation by Timothy Pilgrim, Privacy Commissioner to Association for Data-driven Marketing & Advertising, Privacy Awareness Week event, 4 May 2011


Good evening.

I would like to begin by acknowledging the Gadigal peoples of the Eora Nation, the traditional owners of the land on which we meet today, and to pay my respects to their elders, both past and present.

It's a pleasure to be here this evening during Privacy Awareness Week, the annual campaign promoted by the Asia Pacific Privacy Authorities-a group of 12 privacy regulators from the Asia Pacific region.

Privacy Awareness Week began last Sunday (1 May) and it will be no surprise to you that our focus this year is online privacy.

There is no doubt that the web presents a huge number of opportunities for individuals to learn, conduct business and play.

All these activities will often require the collection or sharing of personal information.

This kind of personal data has been identified by the World Economic Forum in a report released in January this year as a new asset class, and the ‘new oil'.

But at the same time, all this sharing of information can create very real and serious privacy risks.

Just last week we learned that it is alleged that hackers have stolen passwords, birth dates and other data (possibly including credit card details) from approximately 77 million users of the Sony PlayStation Network.

And yesterday we heard that the personal details of a further 25 million Sony Play Station users have been stolen from an allegedly ‘old' database.

I have opened an own motion investigation into these matters and will report on my findings in due course.

However, as you know, the Privacy Commissioner's functions not only involve investigations. We are also committed to educating the community about privacy issues, including online privacy issues.

This year our tagline for Privacy Awareness Week is Privacy: It's All About You.

This message highlights that individuals, business and government all have some responsibility for the protection of personal information, including in the online environment.

One of our key messages is about the protection of personal information in the context of social media.

To help raise awareness around these issues the OAIC has led the development of a YouTube clip and online survey about social media and privacy that is being promoted across the 12 APPA jurisdictions.

I should note we are not the only ones creating animations around these issues. I don't know if any of you caught Futarama last week, but it was all about social networking and online behavioural advertising.

I must say that from a personal as well as a professional perspective, the type of information some people share on social networking sites is astounding!

You may assume that for people posting comments like Zoggel the alien, privacy is not an issue. However, I would argue that people who share this kind of information with the entire universe are often sharing it unintentionally.

Perhaps they haven't worked out how to turn off the ‘Share Everything With Every Person On Earth' default setting on their status updates, or maybe they don't know that it can be turned off.

Perhaps they do not understand the online privacy risks and why it is important for them to limit the information they share.

The point I'd like to make is that in the online world, the consumer is often vulnerable to all kinds of privacy risks of which they are often unaware.

Despite the dazzling array of privacy settings offered by popular social networking sites, people are not ‘always in control' of their information, as even Mark Zuckerberg has suggested.

These issues concern me as a privacy regulator and I am sure they concern you too.

Privacy Awareness Week messages

During Privacy Awareness Week 2011 we are therefore asking people to:

  • Read privacy policies to know how an organisation protects their information
  • Ask a few questions next time someone asks for their personal information
  • Check their online privacy settings including on social networking profiles and internet browsers, and
  • Think about how much personal information they reveal.

However, promoting the value of online privacy is by no means straightforward. 

Anecdotally, online service providers report low take up of the privacy controls they offer, and permissive default settings add to the problem.  It is little wonder then that people are sharing personal information accidently or unintentionally.

So what does this mean for advertisers and direct marketers in the online environment?

Online Behavioural Advertising

Understanding customer preferences is fundamental for any successful business. In recent years however, the internet has taken customer profiling and how this feeds into sales and marketing to a whole new level - for better or for worse.

The more access a business has to personal information about its target market, the better it can create a unique selling point that accurately matches various customer characteristics.

Unlike the focus groups and omnibus surveys of old, data gleaned from online searches and purchases records our interests, movements and preferences with uncanny accuracy.

As more transactions occur online, our digital footprints trace the most intimate details of our communication with others.

Depending on which online platforms we use, online behavioural advertising (or OBA) can align us with products relevant to the very detailed profiles we create through our online behaviour.

While consumers no doubt benefit from the myriad of free online experiences available to them such as internet searches, e-commerce and social networking, the extent to which they understand the price they are paying for "free" is questionable.

And this is where education comes into it-not just from our Office, but from business as well!

Online Behavioural Advertising guidance

To assist people to understand how information they reveal when they transact online is used, the OAIC has today launched consumer guidance about online behavioural advertising.

Our guidance explains what OBA is and how people can use their privacy settings to control how a service provider can use their personal information - including by opting out of receiving targeted ads and deciding whether to accept ‘cookies'.

I note that digital marketing associations in Australia, Europe and the US have also recently launched awareness campaigns about OBA and online choices - for example, the Australian Best Practice Guideline for Online Behavioural Advertising developed by the Australian Digital Advertising Alliance (ADAA)

While this kind of self-regulatory guideline appears to be a positive step, it is nevertheless being introduced into an environment where users generally don't take up opportunities to adjust their browser privacy settings.

In this context, the ADAA has created a consumer education website, Your online choices, and intends to roll out an awareness campaign in the coming months.  I will be interested to know whether this initiative encourages more people to make use of their privacy controls.

I am under no illusion though that simply encouraging people to understand and engage with privacy settings will fully mitigate the risks associated with online privacy.

At this time of information overload, people are generally spending less time reading the fine print and are usually more interested in getting on with the task at hand. 

Our Privacy Awareness Week survey about social networking and privacy will help us identify some of the reasons why people don't use online privacy settings.

By increasing our knowledge about the barriers that prevent people from engaging with privacy settings, we will be in a better position do something about this issue.

We will follow this survey up with a more robust Community Attitudes to Privacy Survey later this year.

Trust and reputation

Despite online behaviour that sometimes suggests otherwise, people do care about privacy and I'm sure I don't need to remind anyone here today that good privacy is good business.

Trust is a major factor in consumers' decision-making processes. 

In fact, the Community Attitudes to Privacy research commissioned by our Office in 2007 revealed that 36 per cent of respondents had decided not to deal with an organisation because of concerns about how their personal information would be handled. 

No agency or organisation can ever afford to be complacent about trust. These days, anyone who is unsure about the privacy of their information can easily move to another online service providers or curtail their use of online services altogether.

The damage to the reputation of those companies that fall under the media spotlight will no doubt affect the trust that consumers place in them.

This has become evident in media coverage of recent high profile privacy breach cases in this country and overseas, and is leading to increasing calls for the introduction of mandatory data breach notification laws. 

Further, as alleged privacy breaches appear more frequently in the media, consumer awareness of privacy issues increases. 

This week I have been inundated with media requests for interviews flowing from the Sony matter.

This has prompted widespread discussion and debate across the country, with coverage ranging from the Roxby Downs Sun and the Dungog Chronicle to community radio, individual bloggers and even the New York Times.

Just this week alone, I have spoken to over 25 journalists.

All this leads to greater scrutiny of organisations' information-handling practices and procedures, and also calls for the Privacy Commissioner to impose harsher penalties.

Given the importance of trust and reputation to business and government, I have no doubt that those companies that take a stronger lead in increasing transparency and raising privacy awareness will inspire greater confidence in their customers.


To conclude, I'll finish up with a call to businesses to make it easier for people to understand and make use of their privacy settings. Basic interface adjustments need to be made - not only so fewer people fall victim to their own sometimes ill-advised postings on social networking sites - but also so people have the final say about how their information is used.

Too often, it is not until someone is reminded of the public audience of their information - for example when something unwanted happens like embarrassment, a virulent attack of spam or even identity theft - that they think through the consequences of online activities.

With social networking sites, I'd like to see privacy settings that clearly demonstrate what information can see be seen as a result of those settings. 

With online behavioural advertising, I'd like to see online services periodically prompting users to review their privacy settings before they start to begin the task at hand. 

In terms of businesses involved in direct marketing, I urge you to facilitate greater use of online privacy settings by making them:

  • simpler
  • intuitive; and
  • visible — through prominent links placed on the main user interface, rather than provided as discrete links that are hidden at the bottom of the page.

But most of all, I'd like to see companies ‘walk the talk' by identifying the barriers to consumer engagement with privacy settings and making it easier for people to overcome these.

As I mentioned earlier, The ADAA's new guideline on OBA is a positive step in this direction.

Education is key, and I am delighted that so many businesses and government agencies have partnered with us during Privacy Awareness Week to remind their stakeholders about the importance of privacy.

We have many partners in the room this evening and I congratulate all of you for taking up this opportunity.

If you have not done so already, please use the educational resources we have developed in your own organisations and share them with your networks.

You can access all of these as well as our animation, survey and privacy tips on the campaign website at

Thank you.