Toggle search bar LATEST UPDATES CAREERS ALUMNI ABOUT US NEWS CONTACT US ONLINE PRIVACY CODE: MORE TRANSPARENCY AND MINIMUM STANDARDS FOR DIGITAL PLATFORMS IN AUSTRALIA 15 November 2021 | Insight G20 nation moves to modernised privacy code for digital platforms, including binding rules. The proposed scope - and stakes for industry players – is substantial. On 25 October 2021, the Australian Attorney-General’s department released, for public consultation, an exposure draft bill introducing amendments to the Privacy Act 1988 (Cth) (the Privacy Legislation Amendment (Enhancing Online Privacy and Other Measures) Bill 2021 (Cth) or Online Privacy Bill)1 and a discussion paper seeking submissions on broader reforms to Australian privacy legislation.2 Our overview of the Online Privacy Bill and discussion paper is available here. One of the main amendments proposed by the Online Privacy Bill is the introduction of a framework allowing the Office of the Australian Information Commissioner (OAIC) to register an OAIC- or industry-developed, enforceable online privacy code (OP code)3 that would be binding on all large online platforms, social media services and data brokerage services providers (OP organisations).4 This would supplement the current provisions under Part IIIB of the Privacy Act dealing with the development and registration of, and compliance with, APP codes that set out how one or more of the Australian Privacy Principles (APPs) will apply to a particular entity or class of entities (and may impose additional requirements).5 As detailed further below, large online platforms and social media services are broadly defined in the Online Privacy Bill. This means a wide range of organisations with online operations could be affected by the proposed OP code, going beyond the ACCC’s recommendation in its 2019 digital platform inquiry final report to create a privacy code enforceable against social media platforms, search engines and other digital content aggregation platforms.6 Along with the removal by the Bill of the condition that a foreign organisation has to collect or hold personal information in Australia to be subject to the Privacy Act, this would also include an organisation that collects personal information of Australians from a digital platform that does not have servers in Australia. In this briefing, we look at the implications under the Online Privacy Bill for a potential new OP code. KEY TAKEAWAYS Submissions on the new Online Privacy Bill close on 6 December 2021. In engaging with the consultation and preparing for the implementation of the OP code, impacted organisations should have regard to the following issues: The proposed OP code will prescribe how OP organisations must comply with certain APPs (including the description of uses and disclosures of personal information in privacy policies, as well as notice and consent requirements). It will also impose further requirements on OP organisations to stop using or disclosing information on reasonable requests, and with respect to their interaction with children or other vulnerable individuals. Many of the changes that the Online Privacy Bill proposes to introduce through the OP code in respect of OP organisations echo similar reforms contemplated in the context of the discussion paper for the broader economy (eg introducing a right to object, and amending the Privacy Act to expressly provide that consent should be voluntary, informed, current, specific, and unambiguous and privacy notices be clear, current and understandable). A breach of the OP code would be treated as an interference with the privacy of an individual, exposing OP organisations to strengthened penalties (of up to the greater of $10 million, 3 times the value of that benefit if determinable or 10% of the relevant yearly turn over) and reinforced enforcement mechanisms otherwise contemplated in the Online Privacy Bill and the discussion paper. Particular restrictions regarding the use of the personal information of children align with similar rules under overseas data protection regimes including the EU General Data Protection Regulation (GDPR) and reflect a global regulatory focus on the safety of children using social media and the internet generally.7 OP ORGANISATIONS The OP code is proposed to apply to the following types of organisations:8 PROVIDERS OF SOCIAL MEDIA SERVICES PROVIDERS OF DATA BROKERAGE SERVICES LARGE ONLINE PLATFORMS SCOPE OF REQUIREMENTS OF THE OP CODE EXISTING APP OBLIGATIONS The Online Privacy Bill provides that the proposed OP code would address how the following APPs apply to OP organisations: NEW REQUIREMENTS AND RESTRICTIONS The Online Privacy Bill provides that the proposed OP Code would also impose further requirements and restrictions in respect of: Ceasing to use or disclose personal information upon request Interaction with children and other vulnerable users Optional provisions Take reasonable steps in the circumstances to stop using or disclosing personal information upon individual requests eg in respect of direct marketing, where not impractical. Stricter rules in relation to children and other persons physically or legally incapable of giving consent. Social media services to: take all reasonable steps to verify the age of users; obtain the consent of a parent or guardian of a child under 16 (and take all reasonable steps to verify such consent); and ensure that the collection, use or disclosure of personal information of a child is fair and reasonable in the circumstances. The Online Privacy Bill provides that the proposed OP code may also: specify how any other APPs not set out above are to be complied with by OP organisations (eg the ACCC digital platform inquiry final report recommended this may include provisions regarding information security and retention period requirements under APP 11)12; deal with the internal handling of privacy complaints and provide for reporting of complaints to the OAIC; require large online platforms to report to the OAIC about the number of end-users they have in Australia; and be expressed to apply differently to classes of OP organisations, classes of personal information or classes of activities of OP organisations. DESIGN PROCESS & ENFORCEMENT ENFORCEMENT A breach of the OP code would be treated as an interference with the privacy of an individual,13 exposing covered entities to strengthened penalties (of up to the greater of $10 million, 3 times the value of the benefit derived from the breach if determinable or 10% of the relevant yearly turnover if the benefit is not determinable) and reinforced enforcement mechanisms otherwise contemplated in the Online Privacy Bill and the discussion paper. We will publish a further briefing on those changes shortly. CODE MAKING PROCESS AND POWERS The explanatory paper suggests that that industry will lead the initial drafting of the OP Code over 120 days after the Online Privacy Bill receives Royal Assent, with at least 28 days of public consultation. However, the Online Privacy Bill also allows for the OAIC to develop the initial draft in certain circumstances, with a consultation period of at least 40 days. In deciding whether to register the OP code, the OAIC must consult with at least the Australian Competition and Consumer Commission and eSafety Commissioner.14 This will allow for each of these regulators to unify their approach in current reform and enforcement action relating to online platforms, having regard to the intersection of privacy, competition and online safety matters in the digital environment. Online privacy bill exposure draft here Privacy act review discussion paper here As per the proposed new s 26KG in the Online Privacy Bill: Online Privacy Bill sch 1 cl 20. As per the proposed new ss 6W and 26KC(2)(a) in the Online Privacy Bill: Online Privacy Bill sch 1 cl 9, 20. Currently there are two registered APP codes: one developed by the OAIC for Australian government agencies, and one developed by the Association of Market and Social Research Organisations (now the Australian Data and Insights Association) for its members. Digital platforms inquiry final report here, p 481. For example, the recently passed Online Safety Act 2021 (Cth) contains specific protections for children against cyber-bullying both inside and outside the social media context. Overseas, the UK’s Age Appropriate Design Code also recently came into force, obliging all online apps or services that are likely to be used by children (including social media platforms) to ensure, among other things, that the data of children is not used in a way that detriments their wellbeing and that the data of children is not disclosed unless there is a compelling reason to do so. The UK is also currently debating its own draft Online Safety Bill 2021 which also seeks to impose duties of care on providers of internet services in relation to content that is deemed harmful for children. As per the proposed new ss 6W and 6X in the Online Privacy Bill: Online Privacy Bill sch 1 cl 9. Online Safety Act 2021 (Cth) subclause 13(2) as clarified by note. EU Digital Markets Act, art 3(2). Australian privacy principles guidelines here Digital platforms inquiry final report here, p 484. As per the proposed new s 13(1A) in the Online Privacy Bill: Online Privacy Bill sch 1 cl 10. As per the proposed new s 26KH in the Online Privacy Bill: Online Privacy Bill sch 1 cl 20. Share to Facebook Share to Twitter Share to LinkedIn Email Print PDF Download RELATED TOPICS Data and privacy FEATURED INSIGHTS TECH, DIGITAL & DATA GEOPOLITICS AND BUSINESS NEW BUSINESS LANDSCAPE RELATED ARTICLES Lloyd v Google: Supreme Court rejects high-profile bid to bring class action data claim against tech giant EV BATTERIES: POWERING THE AUTOMOTIVE REVOLUTION Charging forward – Ofgem’s drive to electrify transport KEY CONTACTS If you have any questions, or would like to know how this might affect your business, phone, or email these key contacts. KAMAN TSOI SPECIAL COUNSEL, MELBOURNE +61 3 9288 1336 Email Read more JULIAN LINCOLN PARTNER, HEAD OF TMT & DIGITAL AUSTRALIA, MELBOURNE +61 3 9288 1694 Email Read more KWOK TANG PARTNER, SYDNEY +61 2 9225 5569 Email Read more PETER JONES PARTNER, SYDNEY +61 2 9225 5588 Email Read more KATHERINE GREGOR PARTNER, MELBOURNE +61 3 9288 1663 Email Read more MICHELLE AGGROMITO SENIOR ASSOCIATE, MELBOURNE +61 3 9288 1079 Email Read more MARINE GIRAL SOLICITOR, MELBOURNE +61 3 9288 1496 Email Read more ABOUT US NEWS CAREERS SUBSCRIBE TO LATEST THINKING BLOGS COVID-19 – MEETINGS AND EVENTS DIVERSITY AND INCLUSION PRO BONO AND RESPONSIBLE BUSINESS ALUMNI ALUMNI NETWORK TERMS DATA ROOMS CONTACT US STAY CONNECTED Twitter LinkedIn YouTube © HERBERT SMITH FREEHILLS LLP 2021 Modern Slavery and Human Trafficking Statement Site Map Accessibility Legal and Regulatory Privacy Policy Report Fraud Whistleblowing Cookie Control