Better privacy protections for children are coming

In his second reading speech for the Privacy and Other Legislation Amendment Bill 2024, Attorney-General Mark Dreyfus KC noted that upon introduction of the original Privacy Act in 1988, then Attorney-General Lionel Bowen told Parliament ‘enormous developments in technology for the processing of information are providing new and, in some respects, undesirable opportunities for the greater use of personal information’.

Nearly 40 years later, I was struck by the foresight of these words. The underlying policy rationale for Australia’s privacy framework remains sound, but the Act itself has not kept pace with the adoption of digital technologies and the privacy risks and harms faced by Australians, particularly children and young people, in the online environment.

Children frequently spend time online to connect with friends, learn and be entertained. It is unrealistic to keep kids off the internet in the 21st century. However, online services designed to appeal to young people may not always be safe, appropriate and protect their privacy. We know Australian parents are concerned about this; a survey we conducted last year found 85% of parents believe children must be empowered to use the internet and online services, but their data privacy must be protected.

A key initiative in the Bill is a mandate for the OAIC to develop a Children’s Online Privacy Code, which would centre children in the debate around privacy in Australia and help to harmonise protections with those children already benefit from in other countries such as the UK.

Our approach to developing the code

As code developer, our ultimate objective is not to prevent children from engaging in the digital world, but rather to protect them within it through strengthened privacy protections for the handling of their personal information.

The code will apply to social media and a wide range of other internet services likely to be accessed by children, including apps, websites and messaging platforms. It will specify how these services must comply with the Australian Privacy Principles, which are the cornerstone of the privacy protection framework in the Privacy Act 1988. The code may impose additional requirements provided they are not inconsistent with the existing principles.

For example, under the Australian Privacy Principles, organisations have obligations to have a privacy policy and to provide collection notices. The code might set out how organisations should tailor privacy policies and collection notices for a child so that they are clear and easy to understand, for example, by using graphics, video and audio content, rather than relying solely on words.

Ultimately, the content of the code will be determined through the code development process. The OAIC intends to adopt a transparent and collaborative approach. We will consult widely with children, parents, child development experts, child welfare advocates, civil society, other regulators and across the online industry to ensure different voices are heard and represented throughout the process.

To the extent possible, we will look to align the code with the UK’s Age Appropriate Design Code, while recognising there are differences in the underlying legal frameworks, and leverage the learnings of our international counterparts.

We are also mindful of broader government initiatives, including the proposed introduction of a minimum age for access to social media and other relevant digital platforms, the age assurance trial, the review of the Online Safety Act 2021 and the eSafety Commissioner’s ongoing work with industry codes and standards. We will continue working with stakeholders across government, industry and the community to ensure a consistent and complementary approach to addressing online harms for all Australians.

Next steps

We look forward to starting the conversation about the Children’s Online Privacy Code and building and strengthening our existing relationships with all impacted stakeholders to help design a code that best protects children’s privacy in the Australian context.

At the same time, it is important not to lose sight of the bigger picture. All Australians, including children and young people, will benefit from the wider reforms set out in the government’s response to the Privacy Act Review. As our Privacy Commissioner Carly Kind said upon introduction of the Bill, much more needs to be done and we eagerly await consultation on the second tranche of privacy reforms.