Media Briefing – Technology-neutral privacy principles should govern rapidly developing ICT

The impact on privacy of rapidly developing information and communications technology is a central consideration for the Australian Law Reform Commission (ALRC) in its report For Your Information: Australian Privacy Law and Practice, released publicly today. The ALRC addresses privacy concerns by recommending the implementation of technology-neutral privacy principles, which should be supported by a technology-aware regulatory framework.

“Recent advances in information, communication and surveillance technologies have created and intensified a range of privacy issues. The internet, biometrics, digital phones and cameras, powerful computers and radio-frequency identification have all contributed to making it easier, cheaper and faster for government agencies and business organisations to collect, store and aggregate large amounts of personal and sensitive information” said ALRC President, Professor David Weisbrot.

“Because these and other technologies are developing so rapidly, trying to regulate their use or development through specifically targeted provisions in the Privacy Act would make the Act outdated fairly quickly. We need privacy principles that are flexible enough to be adapted over time as the technology continues to evolve. That’s why we keep saying the system needs to be technology neutral, but technology aware.

“Establishing broad outcomes for the handling of personal information, rather than setting out detailed rules for each particular technology, is also consistent with the ‘light-touch’ approach to privacy regulation that has characterised the Australian system.”

Professor Les McCrimmon, the Commissioner in charge of the Inquiry, said that the Office of the Privacy Commissioner (OPC) has a key role in a technology-aware privacy regulatory framework.

“OPC education and guidance is essential for government agencies and private sector organisations to understand their obligations under the Privacy Act when using emerging technology to collect and handle personal information.

“Another important task for the OPC is to inform individuals how privacy-enhancing technologies can be used to protect their own privacy, and advise agencies and organisations how to design and deploy new and developing technologies in a privacy-enhancing way.”

Other key ALRC recommendations include:

  • federal legislative instruments establishing public registers should set out clearly any restrictions on the electronic publication of personal information;
  • the OPC should provide guidance that sets out the factors that agencies and organisations should consider before publishing personal information on the internet; and
  • the OPC should provide guidance for organisations on the privacy implications of data-matching.

For more information on developing technology and privacy, see Part B (Chapters 9–12) of For Your Information: Australian Privacy Law and Practice (ALRC 108, 2008).