Now that the Turnbull Government has embraced big data and begun collecting and collating information on all citizens across multiple agency platforms, there is a temptation to explore all the money-making potential of this data.
In March 2016 Treasurer Scott Morrison requested that the Productivity Commission:
Examine the benefits and costs of options for increasing availability of public sector data to other public sector agencies (including between the different levels of government), the private sector, research sector, academics and the community. Where there are clear benefits, recommend ways to increase and improve data linking and availability.
Upfront the aim to gather more information, limit ownership rights of citizens with regard to their own personal information and to sell-on data it collects on citizens is apparent, however it takes a few pages of the Commission’s report to discover that it probably also intends to make additional money out of the ordinary individuals who have been forced to supply government agencies with this same detailed data.
If the Commission recommendation (that a charge can levied by an agency when a citizen requests access to their data) is accepted then, by way of example, the door will have been opened to charge a cost to welfare recipients who request Centrelink statements of income required twice-yearly by social housing agencies, or who request their Basic Card transaction records for a specific period if there is a concern relating to a pension/benefit/allowance periodic payment or who request that data held in e-Health records be edited/corrected if it contains erroneous information.
Of course, this being a report whose terms of reference reflect the wishes of a right-wing federal government - the intention appears to be that all business or government agency charges to supply the individual with his or her own data will be set by those same businesses or agencies with little or no limit on the size these fees.
Knowing when your data has been sold
One of the most potentially pernicious practices with data is the onward trade or disclosure of data to third parties, leaving consumers unaware of who knows what about them. The damage is often not so much in monetary terms but in the feeling of exploitation. This has great capacity to undermine social licence over time, if misused. Around half of all Australians surveyed by Office of the Australian Information Commissioner (OAIC) have expressed concern about unknown organisations having obtained their personal information.
We do not propose that consumers be advised on each occasion data is traded or otherwise disclosed to a third party — the burden on businesses using contractors and outsourcing aspects of their operations could be enormous. Moreover, consumers in some areas could be inundated. But advising on which organisations data has been traded or disclosed to is a reasonable expectation of what is, after all, a joint right to data. You should surely be informed that something in which you now have a joint right is traded or disclosed to a third party.
Accordingly, entities should inform consumers about their data being traded or disclosed by including in their privacy policies, terms and conditions or on their websites, a list of parties to whom consumer data has been traded or otherwise disclosed over the past 12 months. Such lists should easily accessible to consumers and updated in a timely manner.
Consumers may also be at risk of loss of data access on the wind up of a firm. In such circumstances, consumers should always be advised of who now holds their data if it is transferred (as an asset) by the insolvency practitioner; or dataset owner if the data is separately sold.
Costs, timeliness and transition
We recognise that there may be costs to business associated with their adherence to the Right. There are a number of aspects of the recommendation that seek to ensure these are manageable.
First, as noted above, it is expected that industry sectors themselves would determine the scope of data to be transferred, subject to approval by the ACCC.
Second, businesses and government data holders would be able to charge for costs reasonably incurred in transferring consumer data. We fully expect that there may be a tiered approach to such charges, namely that some digital data that is of high quality, readily available, and clearly identifiable with a particular individual (such as transactions data), should be made available at low or no cost and at relatively short notice. Data stored on different (yet still digital) systems, or that is of lesser quality may require additional effort to provide in a usable format and therefore could attract a higher charge and take longer. This would be for data holders themselves to determine and explain.
Our intention in recommending the creation of this Right is to enhance consumer outcomes, as a contribution to sustaining community support for the role data will play in the future. Business and governments as data holders would need to adjust to this Right. Neither should have interests in creating a process that was so costly as to prohibit its take up by most if not all consumers, as this would be counter to enhancing consumer outcomes and may eventually undermine the quality of data collections.
To make the process manageable, it is surely preferable to offer the parties affected in incurring expense the chance to meet the intent of the Right, namely enabling consumers to use their data. This is likely to involve degrees of iteration and transition. But the clear expectation is that there would be transparency on the part of businesses and agencies. Over time as systems evolve, the time taken and the cost involved should fall as these processes become part of each firm growing its business or government agency keeping faith with its clients, and while volume of data transferred might reasonably be expected to grow.
Similarly, it is expected that businesses and government data holders themselves would likely reap benefits from system transformation and better data management, such that all of the costs would not reasonably fall to consumers availing themselves of the Right.
Support for consumers in exercising their new Right
The ACCC would be the primary government entity charged with ensuring consumers are able to transfer their data and exercise their new rights. Specifically, any charges levied by data holders for access, editing, copying and/or transferring of data should be monitored, with the methodology used by a data holder recorded, transparent (such as on the data holder’s web page) and reviewable on request by the ACCC.
While recourse for consumers not satisfied with the way their new Comprehensive Right can be exercised could primarily be through the ACCC, we recognise there are other bodies — industry-specific ombudsmen, State and Territory fair trading offices, and the OAIC — that may have industry-specific skills and knowledge to deal with particular complaints. There should be a ‘no wrong door’ approach to this. This means the key regulators need to implement systems that enable consumer concerns to be handled with efficacy — not leave the consumer straddling a regulator abyss.
While the changes proposed aim to enable consumers to exercise more control over the collection and use of their data, the onus remains on individuals to make responsible choices regarding to whom they provide personal information in the first instance and for what purposes.
