WeRise · Policy platform
Digital Rights & Privacy
Key findings
- 1,113Australia recorded 1,113 eligible data-breach notifications in 2023–24 – more than three reportable breaches every day. Source: Office of the Australian Information Commissioner · Notifiable Data Breaches Report July–December 2023 and January–June 2024 · 2024
- 67%Malicious or criminal attacks caused 67% of notified data breaches in 2023–24, making privacy inseparable from cybersecurity. Source: Office of the Australian Information Commissioner · Notifiable Data Breaches Report · 2024
- 9.8 millionOptus reported that the 2022 cyberattack affected up to 9.8 million current and former customers, showing how one failure can become a national identity-security event. Source: Optus / Australian Parliament inquiries · 2022
- 25.1%One quarter of Australians experienced a personal-data breach in the 12 months to June 2024, according to the Australian Cyber Security Centre. Source: Australian Cyber Security Centre · Annual Cyber Threat Report 2023–24 · 2024
Part 01
The Case for Change
Why Digital Rights & Privacy matters
Privacy Is the Space Where Freedom Lives
Digital convenience cannot require permanent surrender of identity, dignity and control.
Australians are asked to hand over data everywhere: when they apply for a rental, join a loyalty scheme, open a bank account, download an app, visit a doctor, enrol a child, claim a benefit or use a workplace system. Much of this collection is legitimate. The failure is that data collection has become normalised even when it is excessive, poorly secured, weakly explained or difficult to refuse.
The OAIC recorded 1,113 notifications under the Notifiable Data Breaches scheme across 2023–24. Malicious or criminal attacks accounted for 67% of these notifications.3 These figures do not measure every privacy failure; they measure only breaches reported under a threshold-based scheme. They nevertheless demonstrate that data protection is also a security issue. A database full of identity documents, location records, financial details or health information is not just an administrative asset. It is a target.
The consequences can be profound. Optus said up to 9.8 million current and former customers were affected by its 2022 breach.6 The information involved varied by customer but included identity information for some people. Medibank subsequently confirmed the theft and publication of customer data, including health claims information. No individual can realistically “change” a date of birth, historical medical record or past relationship with a service provider. That is why meaningful privacy must begin with minimisation: collect only what is necessary, use it only for a clear purpose, secure it properly and delete it when that purpose ends.
Privacy is also a power question. A platform or data broker can combine purchases, clicks, contacts, location patterns and inferred interests to predict behaviour or target persuasion. An employer can deploy monitoring software. A landlord can use opaque tenant-screening tools. A government agency can automate risk assessments. In each case, the person affected may not know what data was used, what inference was drawn or how to challenge an error. Legal rights that exist only on paper are not enough; people need simple ways to access, correct, delete, port and contest their information.
AI makes this urgent. High-impact systems can amplify existing bias if they are trained on unequal historical data, and they can obscure accountability if decisions are framed as neutral outputs of a machine. WeRise does not argue that every algorithm is dangerous or that useful innovation should be stopped. It argues that systems affecting a person’s rights, livelihood, housing, health, education, immigration status, insurance or liberty must be explainable, auditable and subject to meaningful human review.7
The reform test is simple: digital services should make life easier without requiring people to become permanently legible to corporations or the state. The rules must reward privacy-preserving design, protect children, prevent biometric mass surveillance, ensure government systems meet a higher standard, and give the OAIC the funding and powers to enforce rights quickly.
Part 02
Evidence and Experience
Digital Rights & Privacy: what other countries show
Rights That Work in the Real World
European Union · California · Canada · Brazil
The strongest international systems do not rely on a single consent checkbox. They combine enforceable legal rights, independent regulators, meaningful penalties, data-protection impact assessments, special rules for sensitive information and obligations tailored to high-risk processing. The European Union’s General Data Protection Regulation remains the most influential comprehensive model, while California illustrates a state-level consumer privacy approach with dedicated enforcement.
Canada and Brazil provide useful lessons in adapting rights-based privacy frameworks to federal and middle-income democracies. None is a plug-and-play solution for Australia: jurisdiction, constitutional structure, regulator resources and business composition differ. But all show that innovation and enforceable privacy rights can coexist when rules are clear, proportionate and backed by institutions that can investigate and penalise misconduct.
European Union / European Economic Area · GDPR applicable from 25 May 2018
General Data Protection Regulation: comprehensive rights and duties covering lawful processing, purpose limitation, data minimisation, access, rectification, erasure, portability, breach notification and accountability. Applies across the EU/EEA and to certain organisations outside it that offer goods or services to, or monitor, people in the EU.
- GDPR creates rights of access, rectification, erasure and data portability for eligible personal-data processing.
- Controllers must notify relevant supervisory authorities of certain personal-data breaches within 72 hours where feasible.
- Fines can reach up to €20 million or 4% of total worldwide annual turnover for the preceding financial year, whichever is higher, for specified infringements.
- Data protection impact assessments are required for processing likely to result in high risk to people’s rights and freedoms.
- The model has influenced privacy-law reform globally, while compliance burdens are material – especially for smaller organisations.
Australia can adopt comparable rights and risk-based duties without copying every EU mechanism. Clear data minimisation, impact assessments for high-risk processing, breach-response obligations, strong regulator powers and proportionate small-business support are more important than importing EU terminology.
California, United States · California Consumer Privacy Act effective 2020; California Privacy Rights Act amendments effective 2023
Consumer privacy rights including knowledge, deletion, correction, opt-out of sale/sharing, limits on use of sensitive personal information and a dedicated California Privacy Protection Agency. Applies to qualifying for-profit businesses doing business in California, using statutory thresholds rather than universal coverage.
- Consumers have rights to know, delete and correct personal information held by covered businesses.
- Consumers can opt out of the sale or sharing of personal information by covered businesses.
- The CPRA established the California Privacy Protection Agency, a dedicated enforcement body.
- Covered businesses must provide specific notices and honour certain opt-out preference signals.
- The approach demonstrates that a subnational jurisdiction can set influential privacy rules in a large digital market.
A dedicated or substantially strengthened privacy regulator can make individual rights practical, not merely aspirational. Australia should avoid a rights system that excludes people based on whether an organisation crosses a turnover or revenue threshold; sensitivity and risk matter more than corporate size alone.
Canada · Personal Information Protection and Electronic Documents Act (PIPEDA) in force since 2001; federal consumer privacy reform proposals ongoing
Federal private-sector privacy framework built around consent, accountability, access and correction, overseen by the Office of the Privacy Commissioner of Canada. Applies to private-sector organisations engaged in commercial activities, subject to provincial substantially similar laws.
- PIPEDA gives individuals rights to access and correct personal information held by organisations covered by the Act.
- Organisations must identify purposes, obtain meaningful consent in appropriate circumstances and protect information with safeguards.
- Canada’s federal–provincial structure demonstrates the need for interoperable national minimum standards with room for provincial law.
- The Canadian Privacy Commissioner can investigate complaints and issue findings, though critics have argued for stronger order-making and penalty powers.
- Continuing reform proposals show that older consent-based models struggle with data-intensive and AI-driven uses.
Canada is a close institutional comparator. Australia should set strong federal baselines while working with states and territories on health, surveillance, consumer and public-sector data rules. A complaints-only model is too slow for systemic digital harms; proactive audits and enforceable orders are needed.
Brazil · Lei Geral de Proteção de Dados (LGPD) effective from 2020; sanctions effective from 2021
Comprehensive data-protection law establishing data-subject rights, legal bases for processing, data-protection officer provisions and the National Data Protection Authority (ANPD). National law applying to processing carried out in Brazil and certain processing connected to individuals or goods/services in Brazil.
- LGPD establishes rights including confirmation of processing, access, correction, anonymisation/blocking/deletion in relevant circumstances and information about sharing.
- It recognises sensitive personal data as requiring heightened protection.
- The ANPD is responsible for guidance, supervision and sanctions.
- Administrative sanctions can include warnings, fines and publicisation of infringement, subject to statutory conditions.
- Brazil illustrates how a large, diverse democracy can establish national data rights while facing substantial implementation and capacity challenges.
Rights must be usable across different languages, incomes and levels of digital literacy. Enforcement guidance, public education and accessible complaints processes matter as much as statutory text.
Part 03
Costs and Trade-offs
The cost of Digital Rights & Privacy
Prevention Costs Less Than Permanent Exposure
The cost is not privacy; the cost is treating people’s identity as disposable.
A policy-grade fiscal estimate requires final choices about statutory rights, regulator staffing, small-business transition support, public-sector system upgrades, AI assurance and the scope of biometric controls. Those choices have not yet been costed by the Parliamentary Budget Office and should not be replaced with invented numbers. The direct Commonwealth cost would include a stronger OAIC or a dedicated digital-rights commissioner, expert investigators and technologists, accessible complaint pathways, proactive audits, public guidance, secure government-system upgrades and an AI safety capability.
The private-sector cost is also real. Organisations may need to reduce data retention, improve security, map data flows, build access and correction systems, conduct impact assessments and redesign products. Those costs are partly compliance expenditure and partly overdue risk management. They should be phased, scaled by risk and supported with templates and technical assistance for genuine small organisations – not waived for businesses handling highly sensitive data.
Gross cost is therefore the administration and transition expenditure. Net cost cannot responsibly assign a dollar value to every avoided breach, identity-theft event, discriminatory automated decision or loss of trust. The Optus and Medibank incidents illustrate that the consequences extend across individuals, firms and public agencies, but no public evidence supports a single aggregate national saving for this policy.6 The correct commitment is to obtain PBO costing and publish an implementation impact statement before final legislation.
| Item | Amount | Note |
|---|---|---|
| Strengthened OAIC / Digital Rights Commissioner | To be costed | Investigators, technologists, audit capacity, litigation, accessible complaints and proactive enforcement. |
| Privacy Act implementation and small-organisation transition support | To be costed | Model clauses, guidance, technical assistance and staged compliance for lower-risk entities; no blanket exemption for sensitive data. |
| Government privacy and cyber uplift | To be costed | Data inventories, retention reduction, security controls, procurement standards and impact assessments across Commonwealth agencies. |
| High-risk AI assurance and algorithmic-impact assessment regime | To be costed | Independent testing, reporting, public register and specialist regulatory capability; scope depends on final statutory definition. |
| Avoided breach-response and identity-protection costs | Not reliably monetisable | Better minimisation and security should reduce harm, but national savings require independent modelling rather than assertion. |
| Reduced consumer and market harm from opaque data practices | Not reliably monetisable | Potential benefits include trust and competition; do not count as fiscal savings until independently estimated. |
| Net cost estimate | Not policy-grade costable until statutory model and compliance scope are specified | Seek PBO costing, Regulatory Impact Analysis and public consultation before Active Position status. |
The strongest objections to Digital Rights & Privacy
The strongest objection is that stricter privacy rules will stifle innovation, increase compliance costs and make Australian firms less competitive.
There is a genuine risk that overly prescriptive or poorly drafted rules favour large incumbents that can afford lawyers and compliance teams. The response is risk-based regulation, not a free pass. High-risk processing, sensitive data and large-scale profiling should face strong duties; low-risk small organisations should receive clear templates, phased commencement and regulator guidance. Innovation based on minimising harm should be rewarded, not treated as a burden.
A second objection is that stronger deletion and minimisation rights could reduce data available for research, cybersecurity, fraud prevention and public services.
This is a real trade-off. Health research, disaster response and security can require data. The policy should therefore preserve carefully governed public-interest pathways: de-identified data where genuinely effective, ethics review, transparent legal authority, strict access controls, independent oversight and purpose limits. “Useful” must not become a blanket justification for indefinite collection or repurposing.
Third, automated-decision rules may be criticised as technically unrealistic because many systems are complex, probabilistic or sourced from overseas vendors.
Requiring a full explanation of every mathematical parameter may indeed be impossible or unhelpful. The practical standard should be meaningful explanation: the purpose, main data categories, role of automation, material factors, error and appeal process, and accountable human decision-maker. Vendors that cannot provide sufficient audit information should not be used for high-impact public or private decisions.
Fourth, restrictions on biometric surveillance can be criticised as limiting law-enforcement capacity.
Biometric tools may assist in locating missing people or identifying serious offenders. The risk is mission creep: technology introduced for exceptional cases becomes routine monitoring of public life, with errors and disparate impacts borne by marginalised groups. The proportionate response is narrow statutory authorisation, necessity and proportionality tests, independent warrants or judicial oversight for defined uses, accuracy standards, public reporting and remedies for misuse – not an unregulated banality of surveillance.
Fifth, some will argue that people already consent to data collection.
In practice, consent is often bundled into non-negotiable terms, obscured by design and ineffective against future inferences. Consent remains important for genuinely optional, understandable choices. It cannot be the sole legal basis for processing that people cannot realistically avoid. Fairness, necessity, transparency and accountability must carry equal weight.
Part 04
The Australian Design
How Digital Rights & Privacy would work in Australia
A Digital Bill of Rights for Everyday Life
Rights people can use, duties organisations cannot evade and safeguards for high-risk technology.
WeRise would enact a staged Digital Rights, Privacy and Automated Decision-Making Act, building on – not discarding – the Privacy Act and the 2024 reform tranche. The framework would establish a rights baseline for all Australians: to know when personal data is collected and why; to access and correct it; to have unnecessary data deleted; to object to certain secondary uses; to receive meaningful information about significant automated decisions; and to challenge those decisions through a real human review process.1,2
The first principle is minimisation. Organisations should collect only data reasonably necessary for a specific, disclosed purpose; keep it only for as long as needed; and protect it proportionately to the harm that exposure would create. Sensitive data, children’s data, precise location, biometric identifiers and information used in high-impact decisions should face heightened rules. The small-business and employee-record exemptions should be replaced with a risk-based framework: low-risk organisations receive templates, transition time and support; organisations handling sensitive or large-scale personal data meet the full standard.
Second, create a Digital Rights Commissioner within an expanded and properly funded OAIC, with technology, audit and enforcement capacity. The Commissioner should issue enforceable codes; investigate systemic practices; conduct proactive audits; require remediation; publish significant decisions; and coordinate with the ACCC, eSafety Commissioner, ACMA, cyber agencies and state privacy regulators. Government agencies should meet at least the same standard as private organisations, with independent privacy impact assessments for major data-sharing, biometric or automated-decision programs.
Third, regulate high-risk AI. Developers and deployers of systems used in employment, housing, credit, insurance, education, healthcare, policing, migration, welfare or other similarly consequential settings should undertake algorithmic impact assessments before deployment; test for accuracy, bias and security; maintain human review; keep records sufficient for audit; notify people when an automated system significantly affects them; and report serious incidents. Certain uses should be prohibited or tightly limited, including indiscriminate real-time biometric surveillance in public space except under narrow, judicially authorised conditions.
Fourth, protect children by design. A statutory children’s online privacy code should require high privacy settings, age-appropriate explanations, limits on profiling and targeted advertising, and stronger obligations for services likely to be accessed by children. This is not an argument for blanket age surveillance or forcing every Australian to hand over identity documents online. It is an argument for safer design and proportionate verification.
Implementation should occur over three years: first-year legislation and regulator funding; second-year codes, data-mapping and high-risk AI obligations; third-year review of exemptions, enforcement and outcomes. Any major scheme should be co-designed with First Nations organisations, disability advocates, consumer groups, young people, technical experts, small business and civil-liberties organisations.
Part 05
People and Transition
Who Digital Rights & Privacy affects
Privacy Is Not a Luxury Product
The people with least power over data often bear the greatest risk when it is mishandled.
Everyone has a privacy interest, but harms are not distributed equally. A major data breach can be an inconvenience for one person and a threat to safety, housing, employment, migration status or family security for another. People escaping violence may need their address and contact information protected. First Nations communities may have distinct collective interests in data governance. People with disability can rely on digital systems for essential services while facing inaccessible consent processes. Children may generate a permanent data trail before they can understand its consequences.
Case study
A woman leaving an abusive relationship changes her address, phone number and banking arrangements. A breach at a service provider exposes old identity documents and contact information. She cannot simply “opt out” after the fact. Strong retention limits, sensitive-data protections, breach support and accessible remedies reduce the chance that one organisation’s poor practices become a personal safety risk.
Case study
A young jobseeker is rejected by an online recruitment system after automated screening. They receive no useful explanation, do not know whether the system inferred disability, postcode, gender or employment history, and have no person to ask for review. A right to notice, explanation, correction and human review would not guarantee a job. It would guarantee a fair opportunity to understand and challenge a consequential decision.
Consumers, employees, small businesses and public agencies all have obligations under a better framework. Responsible organisations benefit from clear national rules rather than a race to the bottom in which privacy-respecting firms are undercut by competitors that harvest more data. Technology companies, data brokers, advertisers, some employer groups and agencies using surveillance tools may oppose stronger limits because compliance changes profitable practices or reduces operational convenience. Their concerns about cost and innovation should be heard, but they do not outweigh the principle that people should not lose control of their identity simply because they need to participate in modern society.
The policy should actively support small organisations with practical compliance tools and free advice, while imposing full duties where harm could be high. It should fund community legal services and consumer assistance so rights are usable by people without technical knowledge or money. Privacy must work for the person filling in a form at a clinic, not just for a corporate legal department.
Part 06
Related policies
Digital Rights & Privacy sits within a wider set of WeRise policies.
- Democracy & Rights: more WeRise policies in this pillar
- WeRise: all 29 policies across seven pillars
Notes
Sources and Supporting Documents
- Attorney-General’s Department. Privacy Act Review Report. Australian Government. 2023. ag.gov.au
- Federal Register of Legislation. Privacy and Other Legislation Amendment Act 2024. Australian Government. 2024. legislation.gov.au
- Office of the Australian Information Commissioner. Notifiable Data Breaches Report: January to June 2024. Australian Government. 2024. oaic.gov.au
- Office of the Australian Information Commissioner. Australian Privacy Principles Guidelines. Australian Government. 2024. oaic.gov.au
- Australian Competition and Consumer Commission. Digital Platforms Inquiry: Final Report. Australian Government. 2019. accc.gov.au
- Parliament of Australia. Cyber Security Breaches: Optus and Medibank Inquiry Materials. Parliament of Australia. 2022–23. aph.gov.au
- Department of Industry, Science and Resources. Safe and Responsible AI in Australia: Proposals Paper. Australian Government. 2024. consult.industry.gov.au
- Australian Cyber Security Centre. Annual Cyber Threat Report 2023–24. Australian Government. 2024. cyber.gov.au
- OECD. OECD AI Principles. OECD. 2019, updated resources accessed 2026. oecd.ai
- Australian Human Rights Commission. Human Rights and Technology Final Report. 2021. humanrights.gov.au
- Consumer Policy Research Centre. Consumer Data and Digital Rights Research. 2024. cprc.org.au
- UNSW Allens Hub for Technology, Law and Innovation. AI, Privacy and Digital Regulation Research. 2024. unsw.edu.au
- Digital Rights Watch Australia. Privacy and Digital Rights Policy Resources. 2024. digitalrightswatch.org.au
- Electronic Frontiers Australia. Privacy and Surveillance Policy Resources. 2024. efa.org.au
- European Union. Regulation (EU) 2016/679 (General Data Protection Regulation). 2016. eur-lex.europa.eu
- California Privacy Protection Agency. California Consumer Privacy Act Regulations. 2024. cppa.ca.gov
- Government of Canada. Personal Information Protection and Electronic Documents Act. Justice Laws Website. 2024. laws-lois.justice.gc.ca
- Autoridade Nacional de Proteção de Dados. Lei Geral de Proteção de Dados Pessoais. Government of Brazil. 2024. gov.br
Record