15 February 2022
Prepared opening statement of Australian Information Commissioner and Privacy Commissioner Angelene Falk
Thank you, Senators.
I would like to make some brief introductory remarks before taking questions, if I may.
The regulatory approach of the Office of the Australian Information Commissioner is focused on enhancing access to government-held information including through proactive publication, and strong privacy protections in areas of higher risk.
Since I last appeared at Estimates there have been a number of regulatory matters that I would briefly like to bring to your attention.
We took regulatory action to protect Australians from online privacy harms, including our joint international investigation with the UK Information Commissioner’s Office into Clearview AI. This followed determinations into 7-Eleven and Uber.
Following our joint investigation into Clearview AI, I determined that it breached Australians’ privacy by unfairly scraping their biometric information from the web without consent, for use in a facial recognition tool, and declared that Clearview AI cease collecting images from individuals in Australia and destroy such images. Clearview AI has appealed my determination.
We are also continuing civil penalty proceedings against Facebook.
The full bench of the Federal Court last week rejected Facebook Inc’s appeal to set aside an earlier ruling by Justice Thawley of the Federal Court granting me leave to serve legal documents on the US-based entity, Facebook Inc.
This relates to proceedings I filed against Facebook Inc and Facebook Ireland in the Federal Court in March 2020, alleging the social media platform committed serious and/or repeated interferences with privacy in contravention of Australian privacy law at the time of the Cambridge Analytica matter.
I welcome the decision of the Full Bench of the Federal Court. My office will continue to move forward with the case and we look forward to the hearing of substantive matters.
What these cases have in common, is that they seek to hold global businesses to account for the handling of Australian’s personal information, and accord with our regulatory focus on high privacy impact technologies and the online environment.
The cases provide clear expectations to the regulated community to ensure the handling of Australian’s personal information is privacy compliant.
It is also clear, that the community expects to have greater choice and control over how its personal information is handled.
These matters occur against the background of the review of the Privacy Act, being carried out by the Attorney-General’s Department.
In its response to the Attorney-General Department’s Discussion Paper, the OAIC has made detailed recommendations which draw on our regulatory experience about how these potential reforms could operate in practice.
We consider that central to preventing online privacy harms are requirements to take a proactive approach to build in privacy safeguards upfront, to prevent digital businesses from relying on consumer consent to long and complex notices, including in relation to vulnerable Australians. The increased penalties and powers in the draft Online Privacy Bill will further support our regulatory enforcement.
FOI
In our FOI work:
I reported to you last October, in the last financial year we received over 12-hundred applications for IC review, up 15% from the previous year and up 140% since 2015-16.
That continues to grow, with the number of IC reviews received from July to December up 38% on the corresponding period in the previous year.
We have also increased by 37% the number of IC reviews finalised in the first half of the year compared to the same period in 2020-21.
While we are on track to meet our KPI of 80% of IC reviews finalised within 12 months, we have a large case load on hand.
We are continuing to encourage proactive publication and administrative access to government-held information, without the need for an FOI request, to enhance access to government held information at the lowest reasonable cost.
Thank you.
