Australia has published a draft rewrite of a privacy regime most of which was written around 40 years ago, and its centrepiece moves the burden off the individual and onto the company. Instead of asking people to consent to terms nobody can actually read, a fairness and reasonableness test would ask firms whether collecting and using the data was fair and reasonable in the first place. The draft also proposes a right to have information deleted. If it passes, Australian rules move considerably closer to Europe's and California's. Lizzie O'Shea, a lawyer and the chair of Digital Rights Watch, calls the draft a first step and argues that the machinery to enforce it is not there.
The support is not in doubt. Ninety-three per cent of Australians say protecting personal data matters, and 87% say they are more worried about privacy than they were five years ago. Asked what regulators should prioritise about AI, they name personal data protection first.
The case for treating privacy law as the lever is that it acts on the source rather than the symptoms. Business models built on extracting data are tied to extremist and misleading material, to addictive algorithms and to carelessly designed products; a privacy statute reaches the collection, use and storage of personal information that all of that runs on. O'Shea's argument is that this beats responding product by product to whatever the sector ships next under loose regulation. Meanwhile facial recognition is working its way into ordinary life, narrowly targeted advertising has turned algorithmic feeds into a stream of meaningless and toxic material, and Kmart has been selling so-called spy glasses, devices usable for covert surveillance.
The right to erasure is the part of the draft that will matter most to people who have already been exposed. Companies hold what you gave them for years, including services you stopped using, and after a breach there is currently no clean way to make them let go. Deletion also matters for private reasons: someone working through a gambling addiction may not want the betting industry or the ad brokers to know it. The draft carries exceptions and carve-outs, and O'Shea's point is that the window to argue them down has not closed.
Then the question of who makes any of it real. The Office of the Australian Information Commissioner, which would supervise the new rules, is under-resourced and badly outmatched in scale by the companies it oversees. A flexible, technology-neutral fairness standard can absorb changing social expectations over time, but only if it is interpreted and applied, which means people need a direct route into court. O'Shea points to Meta's recent US$17 billion settlement with US authorities: claims brought by people harmed by technology companies force evidence into the open, shape better rules, and make executives price in a kind of scrutiny they had expected to avoid.
The same gap runs through the proposed digital duty of care. The idea is sound and unenforceable without a mechanism. An Australian would struggle to bring the sort of case that produced the American settlement, even where the harm is identical, and it is not clear whether Meta will extend the changes it promised after that case to its Australian service. The government could close this by writing the role of courts and regulators into the law explicitly.
Surveillance is the piece the draft handles least. Facial recognition is deeply intrusive and close to unregulated in Australia. Parts of the reform may touch it incidentally, but a technology of this weight needs rules of its own, and Australia already has drafted proposals sitting ready that match what comparable countries have adopted.
Here is what I think the draft gets right and the debate around it keeps missing. Abandoning consent is the correct call, and Australia's 40 years of neglect turn out to be an accidental advantage: it can skip the era of cookie banners and click-through agreements that the comparable regimes are still unwinding. But a fairness test is a standard, and a standard is worth exactly as much as the number of people who can invoke it. Write it into law with a single under-funded regulator as its only interpreter and you have not shifted power; you have moved the negotiation from millions of individual users to one agency that the other side can outspend and outlast. The private right of action is not a technical addendum to this reform. It is the reform.
The other thing worth noticing is where the surveillance in this story actually comes from. A privacy statute governs entities that collect and process data. It does not govern the person who bought the spy glasses at Kmart, and it only glances at the facial recognition systems already installed in Australian retail and public space. The draft is aimed at the data economy, which is the right target and not the whole one.
The fairness test asks companies to decide whether their own collection is fair and reasonable. Someone has to be able to disagree with the answer in front of a judge. As things stand, the strongest idea in Australia's privacy reform would arrive with the weakest means of using it.