Australian Government Seeks to Bolster Consumer Data Security with New Online Privacy Bill Draft

The Australian government is set to review and expand its 1988 Privacy Act by adding protections and privacy-focused recommendations to bolster the safety of consumer personal information, including children's online privacy.

In parallel, provisions of the newly drafted Online Privacy code (OP) cover particular organizations that collect and handle a high volume of personal information, including:

· social media services such as Facebook and Reddit, dating platforms, gaming platforms, and online messaging and videoconferencing platforms as WhatsApp and Zoom

· data brokerage services that collect information on individuals via other electronic services

· tech giants such as Apple, Google and Amazon, or media-sharing platforms such as Spotify

The proposed OP also seeks to mandate age verification on social media users and obtain parental consent for children under the age of 16 before platforms collect, use or disclose any data.

"The potential risks social media platforms pose to children are higher than those posed by data brokers or large online platforms due to the number of children who use social media services, the nature of the interactions that can occur via social media platforms, and the wide range and volume of personal information that social media platforms handle," the explanatory paper reads.

"To address these risks, the OP code will have stricter requirements for how social media platforms handle children's personal information (with a child being defined as an individual who has not reached 18 years of age)."

The draft legislation would also apply higher penalties aimed at addressing privacy risks to the community.

"These updates to penalties are needed to bring Australian privacy law into closer alignment with competition and consumer remedies," Privacy Commissioner Angela Falk said.

"Under the draft bill, the maximum penalty of AU$2.1 million for serious or repeated breaches of privacy will increase to not more than the greater of AU$10 million, or three times the value of any benefit obtained through the misuse of information, or 10% of the entity's annual Australian turnover."