IAB Australia provided detailed feedback to the Attorney-General’s Department in response to the Privacy Act Review Report on behalf of the digital advertising industry. The executive summary to the IAB submission is below and the full submission can be downloaded by members below.
Submission Executive Summary
- IAB Australia welcomes the Privacy Act Review Report 2022. Data is at the heart of IAB members’ businesses and key to the relationship they have with consumers. We support a modernised privacy framework that is fit for purpose and meets consumers’ expectations – both in terms of protecting their privacy, as well as enabling them to engage in the digital economy. Critically, we do not think these goals are mutually exclusive.
- The digital advertising ecosystem provides significant value to consumers, the economy and society more broadly. In 2021, the industry:
- contributed $94 billion to GDP (>4% of GDP) and supported 450,000 jobs (3% of jobs, 24,600 jobs directly), with SMEs receiving 61% of the sector’s benefits.
- contributed $55.5 billion in total consumer benefits, including $8.8 billion in access to ad-supported digital content and services.
- Consumers highly value this. According to PwC’s analysis, the average Australian consumer is willing to pay $544 annually to access currently free-ad-supported digital services and content. Most critically, ad-supported online content and services are most important to lower-income consumers. For consumers on annual incomes below $50,000, the value they attribute to content and services that are currently free was roughly double that of consumers with annual incomes over $80,000.
- While we support the Government’s work on privacy reform, and we think the Report strikes the right balance in a number of areas, we are concerned that this is not the case for the proposals that relate to advertising. The proposals in relation to targeting and trading in particular, are too broadly scoped and inconsistent with international approaches. In addition, the proposal on direct marketing is unclear in terms of its operation and how it relates to other proposals in the report.
- The Report’s proposals in relation to targeted advertising go beyond addressing the privacy of individuals and propose to regulate the use of data and advertising more generally. In our view, what is proposed would severely restrict digital advertising and the availability of free content and services online, and would disincentivise privacy by design processes, technologies and practices, which are important to Australia’s future as a leading digital economy.
- The proposed opt-out right of direct marketing would already capture 1:1 targeting based on a consumer being reasonably identifiable. We therefore do not support the proposals in relation to targeting, which go well beyond regulating privacy harms. To the extent that advertising practices give rise to consumer law harms or advertising law harms, they should be addressed under the appropriate regulatory frameworks that deal with those issues.
- IAB supports the Report’s proposed move away from a consent-centric approach to privacy regulation and accepts that that means that organisations must take greater responsibility for the management and handling of data. However, if a ‘fair and reasonable’ test is introduced into the Privacy Act, a legitimate interests style provision should also be introduced to ensure the reforms in Australia are consistent (rather than significantly more restrictive) with equivalent jurisdictions overseas such as the EU, UK and Singapore. Businesses require clarity that low-risk operational activities that would fall within consumers’ expectations are not unnecessarily restricted. These activities should at a minimum include data processing (including data segmentation), measurement, analytics and research.
- In addition, clarification is required in relation to the proposed amendments to the definition of consent. We strongly oppose any amendments that would require opt-in consent (if that is intended), and we also do not support any amendments that would result in increased consent fatigue.
- In line with a move away from a consent-centric approach to privacy, we do not support the proposal that the broad range of activities that fall under the proposed definition of ‘trading’ should require consent. This is not the case in the EU, UK or California.
- IAB Australia supports the proposed definition of de-identification, However, we note that proposal 4.6 suggests an equivalent level of protection should apply to de-identified information as applies to personal information. In our view, these obligations should reflect the fact that the information is de-identified.
- If the proposed right to erasure is introduced, it should be subject to exemptions for instances where it is not operationally or technically feasible to delete the personal information, conflicting legal requirements and other business purposes, and instances where requests may note be genuine or lead to an abuse of process.
- We do not think a direct right of action is the best way to achieve the Government’s goals in relation to privacy reform and in fact, there may be some risk that extending enforcement to include a private right of action will have unintended consequences. However, if a direct right of action is introduced, it should be subject to a seriousness threshold.