Bunnings facial recognition technology case earlier this year, where the Administrative Review Tribunal ruled personal information captured for just 4 seconds, processed automatically and with no human exposure, fit the definition of being \u2018collected\u2019 under Australia\u2019s privacy law<\/a>. <\/p>\nNotably, the\u00a0APP 3 update also reflects the Privacy Commissioner, Carly Kind\u2019s, other determinations on solicitation and use of personal information in practice. For example, in April, she ruled that the 2Apply rental technology platform, operated by InspectRealEstate (IRE), had collected \u201cexcessive personal information\u201d via \u201cunfair means\u201d and therefore breached Privacy Law. <\/p>\n
In that determination, IRE was found to have contravened Australia Privacy Principle 3.2 by collecting personal information that is not reasonably necessary for its functions or activities. The determination also concluded that 2Apply collected personal information by unfair means in contravention of APP 3.5, and in circumstances where individuals have a limited choice and there is a significant power imbalance between renters and real estate agents, property managers and landlords. The ruling is currently subject to appeal. <\/p>\n
Contemporary use cases and enforcing existing powers<\/p>\n
Speaking to Mi3, an OAIC spokesperson said its motivation was to keep guidelines up to date and \u201cadapting in line with technical and market developments\u201d. <\/p>\n
\u201cThe updated APP 3 guidelines include consideration of contemporary technology use cases like artificial intelligence and facial recognition, as well as expanded and clarifying guidance around data minimisation, concepts like \u2018reasonably necessary\u2019\u00a0and\u00a0\u2018fair\u00a0means\u2019,\u201d an OAIC spokesperson told Mi3.\u00a0\u201cBehaviours covered under APP 3, such as overcollection\u00a0and collection by unfair means, create serious risks to the personal privacy and security of Australians.\u201d\u00a0\u00a0<\/p>\n
For OAIC, the hope is that organisations benefit\u00a0from\u00a0new\u00a0guidance based on such contemporary use cases, \u201cmany of which are directly relevant to the marketing and data collection industry, helping to\u00a0demonstrate\u00a0compliance and non-compliance with APP 3\u201d.\u00a0<\/p>\n
\u201cThere is\u00a0expanded guidance on\u00a0multiple existing requirements, such as\u00a0the\u00a0foundational\u00a0requirement to only collect what personal information is \u2018reasonably necessary\u2019\u00a0for an entity\u2019s functions and activities,\u00a0the requirement to collect\u00a0personal information by \u2018fair\u00a0means\u2019, and\u00a0clarifications on liability for where an entity engages a third party to collect personal information,\u201d the spokesperson noted. <\/p>\n
For industry commentators, privacy experts and lawyers Mi3 spoke to, the APP 3 update reflects all the ways Kind is wielding existing and expanded powers bestowed under Tranche 1 of Australia\u2019s privacy law changes in one document. While the guidance does not itself create new law, it provides a strong indication of how the OAIC will pursue future investigations and enforcement.<\/p>\n
Per Clayton Utz partner, Steven Klimt, APP 3 reflects Kind\u2019s position that the Privacy Act is \u2018principles-based\u2019 regulation. \u201cIts application can change as commercial practices and community standards change,\u201d Klimt said. <\/p>\n
\u201cIt has a potentially far-ranging impact in that many organisations may not have undertaken the rigorous analysis of their information collection practices the guidance requires \u2026 \u00a0This may result in these matters being further tested in Courts and Tribunals. <\/p>\n
\u201cThis may lead to some of the matters set out in the Guidance, which could be regarded as overreaches, being moderated.\u201d\u00a0 <\/p>\n
Leonard agrees. \u201cPast interpretations of the Privacy Act, by both lawyers and regulators, are no longer a reliance guide to regulatory action in future,\u201d he argues. \u201cCommissioner Kind is testing the limits of the OAIC\u2019s streamlined enforcement pathways and the capabilities of the Commissioner\u2019s expanded enforcement team. Expect more penalties, more exacting enforceable undertakings, and active use of media naming and shaming, accompanied by new instructional material that will inform acceptable industry practice in Australia in adtech and martech activities. <\/p>\n
Leonard positioned the APP 3 updates as the checklist for the Privacy Commissioner\u2019s current year headline enforcement priorities: \u201cOpaque adtech practices \u2013 that is, pixel tracking across third-party websites; other sharing of data between organisations that increases information imbalance between organisations and consumers; marketing to vulnerable groups \u2013 noting in particular, the expansive coverage of the draft Children\u2019s Online Privacy Code to cover any online site which children are reasonably likely to view, regardless of whether that online site is designed to attract children or is directed at children.\u201d<\/p>\n
Leonard also re-emphasised the overarching point: That transparency and honesty are just the first necessary part of the fee when brands engage in data collection and handling activities, yet they\u2019re ultimately \u201cinsufficient\u201d on their own. <\/p>\n","protected":false},"excerpt":{"rendered":"Dodgy dark patterns The OAIC is indeed drawing a sharper distinction between disclosure and consent, with revised APP…\n","protected":false},"author":2,"featured_media":740581,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[20],"tags":[256,254,255,64,63,105],"class_list":["post-740580","post","type-post","status-publish","format-standard","has-post-thumbnail","category-artificial-intelligence","tag-ai","tag-artificial-intelligence","tag-artificialintelligence","tag-au","tag-australia","tag-technology"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/posts\/740580","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/comments?post=740580"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/posts\/740580\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/media\/740581"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/media?parent=740580"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/categories?post=740580"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/tags?post=740580"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}